keqingmains.com Open in urlscan Pro
172.67.185.95 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.keqingmains.com//bennett//
Effective URL:
https://keqingmains.com/bennett/
Submission: On September 19 via api (September 19th 2024, 1:51:38 pm UTC) from US — Scanned from US

Summary HTTP 235 Redirects Links 37 Behaviour Indicators

Summary

This website contacted 65 IPs in 3 countries across 50 domains to perform 235 HTTP transactions. The main IP is 172.67.185.95, located in United States and belongs to CLOUDFLARENET, US. The main domain is keqingmains.com.
TLS certificate: Issued by WE1 on August 27th 2024. Valid for: 3 months.

This is the only time keqingmains.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3 76	172.67.185.95 172.67.185.95	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:ba1f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	104.18.2.78 104.18.2.78	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2607:f8b0:400... 2607:f8b0:4006:816::2008	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:821::200a	15169 (GOOGLE) (GOOGLE)
1	172.67.172.77 172.67.172.77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:5049	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:247... 2600:9000:247b:e200:2:d490:4d80:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2600:9000:251... 2600:9000:2511:6e00:4:b37b:9440:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:10:... 2606:4700:10::ac43:293c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	142.250.65.162 142.250.65.162	15169 (GOOGLE) (GOOGLE)
3	108.138.115.149 108.138.115.149	16509 (AMAZON-02) (AMAZON-02)
5	35.244.144.25 35.244.144.25	15169 (GOOGLE) (GOOGLE)
6	69.194.240.11 69.194.240.11	26120 (RHYTHMONE) (RHYTHMONE)
3	147.182.176.100 147.182.176.100	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
3	2607:f350:3:2... 2607:f350:3:2569:0:10:0:a	27630 (AS-XFERNET) (AS-XFERNET)
3	74.119.117.6 74.119.117.6	19750 (AS-CRITEO) (AS-CRITEO)
3	2602:803:c002... 2602:803:c002:200::32	26667 (RUBICONPR...) (RUBICONPROJECT)
4	35.227.252.103 35.227.252.103	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	3.218.122.15 3.218.122.15	14618 (AMAZON-AES) (AMAZON-AES)
3	34.120.63.153 34.120.63.153	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4	3.236.57.101 3.236.57.101	14618 (AMAZON-AES) (AMAZON-AES)
3 6	68.67.160.186 68.67.160.186	29990 (ASN-APPNEX) (ASN-APPNEX)
3	2607:f8b0:400... 2607:f8b0:4006:817::200e	15169 (GOOGLE) (GOOGLE)
2	2606:4700:20:... 2606:4700:20::ac43:4513	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.251.32.102 142.251.32.102	15169 (GOOGLE) (GOOGLE)
1	172.67.193.156 172.67.193.156	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	108.138.106.108 108.138.106.108	16509 (AMAZON-02) (AMAZON-02)
3	108.139.48.9 108.139.48.9	16509 (AMAZON-02) (AMAZON-02)
3	130.211.23.194 130.211.23.194	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	23.203.179.38 23.203.179.38	16625 (AKAMAI-AS) (AKAMAI-AS)
2	172.64.152.89 172.64.152.89	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:10:... 2606:4700:10::6816:35ad	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:10:... 2606:4700:10::6816:3456	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2620:100:a00b::4 2620:100:a00b::4	19750 (AS-CRITEO) (AS-CRITEO)
3	2607:f8b0:400... 2607:f8b0:4006:80e::200e	15169 (GOOGLE) (GOOGLE)
10	2606:4700:10:... 2606:4700:10::6816:545	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	52.46.143.56 52.46.143.56	16509 (AMAZON-02) (AMAZON-02)
1	108.138.128.28 108.138.128.28	16509 (AMAZON-02) (AMAZON-02)
1	34.102.146.192 34.102.146.192	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4	2607:f8b0:400... 2607:f8b0:4006:80f::2001	15169 (GOOGLE) (GOOGLE)
2	2606:4700:10:... 2606:4700:10::ac43:17ea	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 11	52.24.239.47 52.24.239.47	16509 (AMAZON-02) (AMAZON-02)
4 5	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
2 2	207.65.37.184 207.65.37.184	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	69.173.151.100 69.173.151.100	26667 (RUBICONPR...) (RUBICONPROJECT)
4 5	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3 4	142.251.40.130 142.251.40.130	15169 (GOOGLE) (GOOGLE)
1 9	2607:f350:3:2... 2607:f350:3:2569:0:10:0:d	27630 (AS-XFERNET) (AS-XFERNET)
1	172.64.151.101 172.64.151.101	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	52.2.190.100 52.2.190.100	14618 (AMAZON-AES) (AMAZON-AES)
2	2607:f8b0:400... 2607:f8b0:4006:80c::200a	15169 (GOOGLE) (GOOGLE)
2	142.250.81.238 142.250.81.238	15169 (GOOGLE) (GOOGLE)
1	142.250.65.200 142.250.65.200	15169 (GOOGLE) (GOOGLE)
7	142.250.65.238 142.250.65.238	15169 (GOOGLE) (GOOGLE)
2	142.250.65.194 142.250.65.194	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:823::2006	15169 (GOOGLE) (GOOGLE)
3	2600:9000:266... 2600:9000:266a:400:10:43f:4340:93a1	16509 (AMAZON-02) (AMAZON-02)
1	23.56.163.106 23.56.163.106	16625 (AKAMAI-AS) (AKAMAI-AS)
1	147.182.142.243 147.182.142.243	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	35.71.139.29 35.71.139.29	16509 (AMAZON-02) (AMAZON-02)
1	23.56.162.28 23.56.162.28	16625 (AKAMAI-AS) (AKAMAI-AS)
1	23.223.209.209 23.223.209.209	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1 1	216.200.232.253 216.200.232.253	6461 (ZAYO-6461) (ZAYO-6461)
1 1	34.36.216.150 34.36.216.150	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	199.38.167.130 199.38.167.130	54312 (ROCKETFUEL) (ROCKETFUEL)
1	104.18.41.104 104.18.41.104	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	54.159.145.75 54.159.145.75	14618 (AMAZON-AES) (AMAZON-AES)
2 2	185.184.8.90 185.184.8.90	204995 (RTB-HOUSE...) (RTB-HOUSE-AMS)
2 2	35.244.154.8 35.244.154.8	15169 (GOOGLE) (GOOGLE)
1 1	107.178.254.65 107.178.254.65	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3 3	35.211.202.130 35.211.202.130	19527 (GOOGLE-2) (GOOGLE-2)
1 1	2600:1f18:4e9... 2600:1f18:4e9:5a07:f379:24db:109a:de72	14618 (AMAZON-AES) (AMAZON-AES)
235	65

76 172.67.185.95 (United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)

www.keqingmains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
keqingmains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
hsr.keqingmains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:ba1f (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.18.2.78 (None, )

ASN13335 (CLOUDFLARENET, US)

s.nitropay.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:816::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:821::200a (United States)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.172.77 (United States)

ASN13335 (CLOUDFLARENET, US)

webnovelsai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5049 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:247b:e200:2:d490:4d80:93a1 (United States)

ASN16509 (AMAZON-02, US)

wrappers.geoedge.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2511:6e00:4:b37b:9440:93a1 (United States)

ASN16509 (AMAZON-02, US)

rumcdn.geoedge.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::ac43:293c (United States)

ASN13335 (CLOUDFLARENET, US)

btloader.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 142.250.65.162 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s71-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 108.138.115.149 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-115-149.jfk50.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.244.144.25 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 25.144.244.35.bc.googleusercontent.com

tracker.nitropay.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 69.194.240.11 (United States)

ASN26120 (RHYTHMONE, US)

targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 147.182.176.100 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

prebid.cootlogix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f350:3:2569:0:10:0:a (United States)

ASN27630 (AS-XFERNET, US)

apex.go.sonobi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 74.119.117.6 (United States)

ASN19750 (AS-CRITEO, US)

bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2602:803:c002:200::32 (United States)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.227.252.103 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.218.122.15 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-218-122-15.compute-1.amazonaws.com

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.120.63.153 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 153.63.120.34.bc.googleusercontent.com

prebid.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.236.57.101 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-236-57-101.compute-1.amazonaws.com

btlr.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 68.67.160.186 (Colonia, United States) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:817::200e (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::ac43:4513 (United States)

ASN13335 (CLOUDFLARENET, US)

ad-delivery.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.32.102 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s77-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.193.156 (United States)

ASN13335 (CLOUDFLARENET, US)

consent.nitrocnct.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.106.108 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-106-108.jfk50.r.cloudfront.net

config.aps.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 108.139.48.9 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-139-48-9.jfk50.r.cloudfront.net

aax.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 130.211.23.194 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 194.23.211.130.bc.googleusercontent.com

api.btloader.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.203.179.38 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-203-179-38.deploy.static.akamaitechnologies.com

secure.cdn.fastclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.64.152.89 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

cdn-ima.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:35ad (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.hadronid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:3456 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:100:a00b::4 (United States)

ASN19750 (AS-CRITEO, US)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:80e::200e (United States)

ASN15169 (GOOGLE, US)

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2606:4700:10::6816:545 (United States)

ASN13335 (CLOUDFLARENET, US)

id.hadron.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixels.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
seg.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
proton.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.46.143.56 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.128.28 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-128-28.jfk50.r.cloudfront.net

tags.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.146.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.146.102.34.bc.googleusercontent.com

oa.openxcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:80f::2001 (United States)

ASN15169 (GOOGLE, US)

1aad12c339679a5d9672af3b6cf77ea2.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::ac43:17ea (United States)

ASN13335 (CLOUDFLARENET, US)

a.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 52.24.239.47 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-24-239-47.us-west-2.compute.amazonaws.com

ids.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.71.131.137 (United States) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 207.65.37.184 (United States) 2 redirects

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.151.100 (United States) 1 redirects

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.111.113.62 (Kansas City, United States) 4 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.40.130 (Queens, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s80-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2607:f350:3:2569:0:10:0:d (United States) 1 redirects

ASN27630 (AS-XFERNET, US)

sync.go.sonobi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.64.151.101 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.64.218 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.2.190.100 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-2-190-100.compute-1.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80c::200a (United States)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.81.238 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s74-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.65.200 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s72-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.250.65.238 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s73-in-f14.1e100.net

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.65.194 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s72-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:823::2006 (United States)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:266a:400:10:43f:4340:93a1 (United States)

ASN16509 (AMAZON-02, US)

gw.geoedge.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.56.163.106 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-56-163-106.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.182.142.243 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

sync.cootlogix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.71.139.29 (United States)

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.56.162.28 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-56-162-28.deploy.static.akamaitechnologies.com

contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.223.209.209 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-223-209-209.deploy.static.akamaitechnologies.com

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

ggsoftware-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.200.232.253 (Frederick, United States) 1 redirects

ASN6461 (ZAYO-6461, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.36.216.150 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 150.216.36.34.bc.googleusercontent.com

pixel-sync.sitescout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.38.167.130 (United States) 1 redirects

ASN54312 (ROCKETFUEL, US)

p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.41.104 (None, )

ASN13335 (CLOUDFLARENET, US)

capi.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.159.145.75 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-159-145-75.compute-1.amazonaws.com

sync.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.184.8.90 (Amsterdam, Netherlands) 2 redirects

ASN204995 (RTB-HOUSE-AMS, CY)
PTR: ip-185-184-8-90.rtbhouse.net

creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.154.8 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 8.154.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.178.254.65 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 65.254.178.107.bc.googleusercontent.com

pippio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.211.202.130 (North Charleston, United States) 3 redirects

ASN19527 (GOOGLE-2, US)
PTR: 130.202.211.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:4e9:5a07:f379:24db:109a:de72 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
76	keqingmains.com 3 redirects www.keqingmains.com keqingmains.com hsr.keqingmains.com	3 MB
23	ad.gt 1 redirects id.hadron.ad.gt — Cisco Umbrella Rank: 1469 a.ad.gt — Cisco Umbrella Rank: 1575 p.ad.gt — Cisco Umbrella Rank: 1665 ids.ad.gt — Cisco Umbrella Rank: 1485 pixels.ad.gt — Cisco Umbrella Rank: 1652 seg.ad.gt — Cisco Umbrella Rank: 2006 proton.ad.gt — Cisco Umbrella Rank: 2452	22 KB
14	doubleclick.net 3 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 213 ad.doubleclick.net — Cisco Umbrella Rank: 153 cm.g.doubleclick.net — Cisco Umbrella Rank: 284	280 KB
12	sonobi.com 1 redirects apex.go.sonobi.com — Cisco Umbrella Rank: 2803 sync.go.sonobi.com — Cisco Umbrella Rank: 962	14 KB
10	google.com fundingchoicesmessages.google.com — Cisco Umbrella Rank: 688	78 KB
10	nitropay.com s.nitropay.com — Cisco Umbrella Rank: 19786 tracker.nitropay.com — Cisco Umbrella Rank: 19425	225 KB
9	amazon-adsystem.com 1 redirects c.amazon-adsystem.com — Cisco Umbrella Rank: 356 config.aps.amazon-adsystem.com — Cisco Umbrella Rank: 667 aax.amazon-adsystem.com — Cisco Umbrella Rank: 466 s.amazon-adsystem.com — Cisco Umbrella Rank: 367	89 KB
7	adnxs.com 3 redirects ib.adnxs.com — Cisco Umbrella Rank: 270 secure.adnxs.com — Cisco Umbrella Rank: 479 acdn.adnxs.com — Cisco Umbrella Rank: 638	6 KB
7	openx.net 2 redirects rtb.openx.net — Cisco Umbrella Rank: 599 u.openx.net — Cisco Umbrella Rank: 768 ggsoftware-d.openx.net — Cisco Umbrella Rank: 29761	2 KB
7	geoedge.be wrappers.geoedge.be — Cisco Umbrella Rank: 15229 rumcdn.geoedge.be — Cisco Umbrella Rank: 2193 gw.geoedge.be — Cisco Umbrella Rank: 3213	173 KB
6	googlesyndication.com 1aad12c339679a5d9672af3b6cf77ea2.safeframe.googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 115	65 KB
6	unrulymedia.com targeting.unrulymedia.com — Cisco Umbrella Rank: 866	762 B
5	tapad.com 4 redirects pixel.tapad.com — Cisco Umbrella Rank: 467	1 KB
5	adsrvr.org 4 redirects match.adsrvr.org — Cisco Umbrella Rank: 382	4 KB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 33	23 KB
5	rubiconproject.com 1 redirects fastlane.rubiconproject.com — Cisco Umbrella Rank: 493 token.rubiconproject.com — Cisco Umbrella Rank: 488 eus.rubiconproject.com — Cisco Umbrella Rank: 620	18 KB
4	sharethrough.com btlr.sharethrough.com — Cisco Umbrella Rank: 1046	40 KB
4	media.net prebid.media.net — Cisco Umbrella Rank: 1032 contextual.media.net — Cisco Umbrella Rank: 732	34 KB
4	3lift.com tlx.3lift.com — Cisco Umbrella Rank: 530 eb2.3lift.com — Cisco Umbrella Rank: 424	19 KB
4	cootlogix.com prebid.cootlogix.com — Cisco Umbrella Rank: 6191 sync.cootlogix.com — Cisco Umbrella Rank: 2408	3 KB
4	btloader.com btloader.com — Cisco Umbrella Rank: 869 api.btloader.com — Cisco Umbrella Rank: 1033	30 KB
3	bidswitch.net 3 redirects x.bidswitch.net — Cisco Umbrella Rank: 402	1 KB
3	criteo.net static.criteo.net — Cisco Umbrella Rank: 789	44 KB
3	criteo.com bidder.criteo.com — Cisco Umbrella Rank: 712	664 B
3	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 407 imasdk.googleapis.com — Cisco Umbrella Rank: 506	175 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 43	260 KB
2	rlcdn.com 2 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 476	835 B
2	creativecdn.com 2 redirects creativecdn.com — Cisco Umbrella Rank: 554	921 B
2	pubmatic.com 2 redirects image2.pubmatic.com — Cisco Umbrella Rank: 881	727 B
2	crwdcntrl.net tags.crwdcntrl.net — Cisco Umbrella Rank: 1023 bcp.crwdcntrl.net — Cisco Umbrella Rank: 989	13 KB
2	33across.com cdn-ima.33across.com — Cisco Umbrella Rank: 1544	13 KB
2	ad-delivery.net ad-delivery.net — Cisco Umbrella Rank: 907	1 KB
1	yahoo.com 1 redirects pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 520	624 B
1	linkedin.com px.ads.linkedin.com — Cisco Umbrella Rank: 327	249 B
1	pippio.com 1 redirects pippio.com — Cisco Umbrella Rank: 795	633 B
1	stackadapt.com 1 redirects sync.srv.stackadapt.com — Cisco Umbrella Rank: 799	227 B
1	connatix.com capi.connatix.com — Cisco Umbrella Rank: 855	82 B
1	rfihub.com 1 redirects p.rfihub.com — Cisco Umbrella Rank: 817	733 B
1	sitescout.com 1 redirects pixel-sync.sitescout.com — Cisco Umbrella Rank: 717	554 B
1	mathtag.com 1 redirects sync.mathtag.com — Cisco Umbrella Rank: 1070	863 B
1	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 368	17 KB
1	casalemedia.com ssum-sec.casalemedia.com — Cisco Umbrella Rank: 512	506 B
1	openxcdn.net oa.openxcdn.net — Cisco Umbrella Rank: 2207	8 KB
1	id5-sync.com cdn.id5-sync.com — Cisco Umbrella Rank: 984	29 KB
1	hadronid.net cdn.hadronid.net — Cisco Umbrella Rank: 1628	12 KB
1	fastclick.net secure.cdn.fastclick.net — Cisco Umbrella Rank: 1108	17 KB
1	nitrocnct.com consent.nitrocnct.com — Cisco Umbrella Rank: 24747	36 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 670	7 KB
1	webnovelsai.com webnovelsai.com	15 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 314	21 KB
235	50

	Domain	Requested by
74	keqingmains.com	2 redirects keqingmains.com
11	ids.ad.gt	1 redirects keqingmains.com
10	fundingchoicesmessages.google.com	s.nitropay.com
9	sync.go.sonobi.com	1 redirects keqingmains.com
9	securepubads.g.doubleclick.net	s.nitropay.com securepubads.g.doubleclick.net imasdk.googleapis.com
6	targeting.unrulymedia.com	s.nitropay.com
5	pixel.tapad.com	4 redirects keqingmains.com
5	match.adsrvr.org	4 redirects s.nitropay.com
5	www.google-analytics.com	www.googletagmanager.com s.nitropay.com www.google-analytics.com
5	tracker.nitropay.com	s.nitropay.com
5	s.nitropay.com	keqingmains.com s.nitropay.com
4	cm.g.doubleclick.net	3 redirects keqingmains.com
4	1aad12c339679a5d9672af3b6cf77ea2.safeframe.googlesyndication.com	s.nitropay.com
4	btlr.sharethrough.com	s.nitropay.com
4	rtb.openx.net	s.nitropay.com
3	x.bidswitch.net	3 redirects
3	gw.geoedge.be	rumcdn.geoedge.be
3	seg.ad.gt	p.ad.gt
3	secure.adnxs.com	3 redirects
3	p.ad.gt	s.nitropay.com p.ad.gt
3	static.criteo.net	s.nitropay.com static.criteo.net
3	api.btloader.com	btloader.com
3	aax.amazon-adsystem.com	c.amazon-adsystem.com
3	ib.adnxs.com	s.nitropay.com
3	prebid.media.net	s.nitropay.com
3	tlx.3lift.com	s.nitropay.com
3	fastlane.rubiconproject.com	s.nitropay.com
3	bidder.criteo.com	s.nitropay.com
3	apex.go.sonobi.com	s.nitropay.com
3	prebid.cootlogix.com	s.nitropay.com
3	c.amazon-adsystem.com	s.nitropay.com c.amazon-adsystem.com
3	rumcdn.geoedge.be	s.nitropay.com rumcdn.geoedge.be
3	www.googletagmanager.com	keqingmains.com s.nitropay.com
2	idsync.rlcdn.com	2 redirects
2	creativecdn.com	2 redirects
2	pagead2.googlesyndication.com	s.nitropay.com imasdk.googleapis.com
2	imasdk.googleapis.com	s.nitropay.com
2	u.openx.net	2 redirects
2	image2.pubmatic.com	2 redirects
2	a.ad.gt	s.nitropay.com p.ad.gt
2	s.amazon-adsystem.com	1 redirects s.nitropay.com keqingmains.com
2	id.hadron.ad.gt	cdn.hadronid.net
2	cdn-ima.33across.com	s.nitropay.com
2	ad-delivery.net	keqingmains.com
1	pr-bh.ybp.yahoo.com	1 redirects
1	px.ads.linkedin.com	keqingmains.com
1	pippio.com	1 redirects
1	sync.srv.stackadapt.com	1 redirects
1	capi.connatix.com	keqingmains.com
1	p.rfihub.com	1 redirects
1	pixel-sync.sitescout.com	1 redirects
1	sync.mathtag.com	1 redirects
1	ggsoftware-d.openx.net	s.nitropay.com
1	acdn.adnxs.com	s.nitropay.com
1	contextual.media.net	s.nitropay.com
1	eb2.3lift.com	s.nitropay.com
1	sync.cootlogix.com	s.nitropay.com
1	eus.rubiconproject.com	s.nitropay.com
1	s0.2mdn.net	s.nitropay.com
1	proton.ad.gt	s.nitropay.com
1	pixels.ad.gt	s.nitropay.com
1	bcp.crwdcntrl.net	tags.crwdcntrl.net
1	ssum-sec.casalemedia.com	keqingmains.com
1	token.rubiconproject.com	1 redirects
1	oa.openxcdn.net	s.nitropay.com
1	tags.crwdcntrl.net	s.nitropay.com
1	cdn.id5-sync.com	s.nitropay.com
1	cdn.hadronid.net	s.nitropay.com
1	secure.cdn.fastclick.net	s.nitropay.com
1	config.aps.amazon-adsystem.com	s.nitropay.com
1	consent.nitrocnct.com	s.nitropay.com
1	ad.doubleclick.net	keqingmains.com
1	btloader.com	s.nitropay.com
1	wrappers.geoedge.be	s.nitropay.com
1	static.cloudflareinsights.com	keqingmains.com
1	webnovelsai.com	keqingmains.com
1	ajax.googleapis.com	keqingmains.com
1	hsr.keqingmains.com	keqingmains.com
1	cdn.jsdelivr.net	keqingmains.com
1	www.keqingmains.com	1 redirects
235	80

This site contains links to these domains. Also see Links.

Domain
hsr.keqingmains.com
library.keqingmains.com
compendium.keqingmains.com
cards.keqingmains.com
discord.gg
genshincards.com
tcg.keqingmains.com
battlefy.com
discord.com
www.twitch.tv
www.youtube.com
twitter.com
www.reddit.com
www.instagram.com
nitropay.com
docs.google.com
frzyc.github.io
youtu.be
muakasan.github.io
1drv.ms
twitch.tv
gcsim.app
ko-fi.com
lightnovelsai.com
yamitl.com
webnovelsai.com
doanythingai.com

Subject Issuer	Validity	Valid
keqingmains.com WE1	`2024-08-27` - `2024-11-25`	3 months	crt.sh
*.jsdelivr.net Sectigo RSA Domain Validation Secure Server CA	`2024-05-04` - `2025-05-04`	a year	crt.sh
nitropay.com WE1	`2024-09-09` - `2024-12-08`	3 months	crt.sh
*.google-analytics.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
upload.video.google.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
webnovelsai.com WE1	`2024-09-11` - `2024-12-10`	3 months	crt.sh
cloudflareinsights.com WE1	`2024-09-03` - `2024-12-02`	3 months	crt.sh
gw.geoedge.be Amazon RSA 2048 M03	`2024-07-12` - `2025-08-09`	a year	crt.sh
btloader.com WE1	`2024-08-10` - `2024-11-08`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
c.amazon-adsystem.com Amazon RSA 2048 M01	`2023-12-30` - `2024-12-04`	a year	crt.sh
*.nitropay.com WR3	`2024-08-02` - `2024-10-31`	3 months	crt.sh
*.targeting.unrulymedia.com Sectigo RSA Domain Validation Secure Server CA	`2024-04-30` - `2025-05-31`	a year	crt.sh
*.cootlogix.com Sectigo RSA Domain Validation Secure Server CA	`2023-10-19` - `2024-11-17`	a year	crt.sh
*.go.sonobi.com Go Daddy Secure Certificate Authority - G2	`2023-12-07` - `2025-01-07`	a year	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-08-26` - `2024-11-20`	3 months	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2024-07-30` - `2025-04-03`	8 months	crt.sh
*.openx.net RapidSSL TLS RSA CA G1	`2024-08-14` - `2025-08-18`	a year	crt.sh
*.3lift.com Amazon RSA 2048 M02	`2024-03-13` - `2025-04-10`	a year	crt.sh
prebid.media.net WR3	`2024-08-09` - `2024-11-07`	3 months	crt.sh
*.sharethrough.com DigiCert Global G3 TLS ECC SHA384 2020 CA1	`2024-07-15` - `2025-08-15`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2024-02-14` - `2025-03-16`	a year	crt.sh
ad-delivery.net WE1	`2024-09-12` - `2024-12-11`	3 months	crt.sh
*.doubleclick.net WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
nitrocnct.com WE1	`2024-08-16` - `2024-11-14`	3 months	crt.sh
config.aps.amazon-adsystem.com Amazon RSA 2048 M02	`2024-01-21` - `2025-02-19`	a year	crt.sh
alt1-3ps.amazon-adsystem.com Amazon RSA 2048 M03	`2024-03-29` - `2025-04-28`	a year	crt.sh
api.btloader.com WR3	`2024-08-02` - `2024-10-31`	3 months	crt.sh
secure.cdn.fastclick.net DigiCert TLS RSA SHA256 2020 CA1	`2024-08-07` - `2025-08-07`	a year	crt.sh
*.33across.com Sectigo RSA Domain Validation Secure Server CA	`2024-09-05` - `2025-09-30`	a year	crt.sh
hadronid.net WE1	`2024-07-27` - `2024-10-25`	3 months	crt.sh
id5-sync.com WE1	`2024-08-02` - `2024-10-31`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-09-02` - `2024-11-28`	3 months	crt.sh
*.google.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
id.hadron.ad.gt WE1	`2024-07-23` - `2024-10-21`	3 months	crt.sh
s.amazon-adsystem.com Amazon RSA 2048 M01	`2024-04-24` - `2025-04-17`	a year	crt.sh
*.crwdcntrl.net Amazon RSA 2048 M02	`2024-09-07` - `2025-10-07`	a year	crt.sh
oa.openxcdn.net WR3	`2024-09-16` - `2024-12-15`	3 months	crt.sh
a.ad.gt WE1	`2024-08-07` - `2024-11-05`	3 months	crt.sh
p.ad.gt Cloudflare Inc ECC CA-3	`2023-11-09` - `2024-11-07`	a year	crt.sh
*.ad.gt Amazon RSA 2048 M02	`2024-03-10` - `2025-04-08`	a year	crt.sh
casalemedia.com E5	`2024-08-15` - `2024-11-13`	3 months	crt.sh
pixels.ad.gt WE1	`2024-09-05` - `2024-12-04`	3 months	crt.sh
seg.ad.gt WE1	`2024-09-05` - `2024-12-04`	3 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2024-04-23` - `2025-05-25`	a year	crt.sh
proton.ad.gt WE1	`2024-09-07` - `2024-12-06`	3 months	crt.sh
*.media.net DigiCert TLS RSA SHA256 2020 CA1	`2023-12-21` - `2024-12-21`	a year	crt.sh
cdn.adnxs.com R11	`2024-08-20` - `2024-11-18`	3 months	crt.sh
capi.connatix.com WE1	`2024-09-08` - `2024-12-07`	3 months	crt.sh

This page contains 20 frames:

Primary Page: https://keqingmains.com/bennett/
Frame ID: A40B1BE51FCB41D65BA8AAF1AEF916DC
Requests: 206 HTTP requests in this frame

Frame: https://rumcdn.geoedge.be/b0b01868-2045-4a3d-b8b0-db8e6cd0649d/grumi.js
Frame ID: B0A4B6EC66E3C1BEFEDEA2E2CA5E20C0
Requests: 4 HTTP requests in this frame

Frame: https://keqingmains.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js
Frame ID: F6D1862C30AD83FBD5D4DDF82C0B8739
Requests: 1 HTTP requests in this frame

Frame: https://keqingmains.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js
Frame ID: 2BC0EBBD3910E9F87648A5004656E64B
Requests: 2 HTTP requests in this frame

Frame: https://rumcdn.geoedge.be/b0b01868-2045-4a3d-b8b0-db8e6cd0649d/grumi.js
Frame ID: 398E6B051174B9FE93BAD0BAAAC8492B
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-LoopMe_n-adMediaV1_snb_n-acuityads_n-MediaNet_n-Beeswax_ox-db5_cnv_n-adman-v2_n-sharethrough_n-onetag_pm-db5_n-simpli.fi_ppt_n-baidu_an-db5_3lift_n-Outbrain&dcc=t
Frame ID: F48A21B4FC988147E3278DA7109D1BF7
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: 5ECF0A7920AFEE3AF0C93E56A1543A52
Requests: 1 HTTP requests in this frame

Frame: https://1aad12c339679a5d9672af3b6cf77ea2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: C437375924301D5309EAFF9081117026
Requests: 1 HTTP requests in this frame

Frame: https://1aad12c339679a5d9672af3b6cf77ea2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 557DE80C4BFC44508862F74613E6EF36
Requests: 1 HTTP requests in this frame

Frame: https://1aad12c339679a5d9672af3b6cf77ea2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: B1E604045AE7A4DA5827A3916D040C2D
Requests: 1 HTTP requests in this frame

Frame: https://1aad12c339679a5d9672af3b6cf77ea2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 0A9827E0784FEB228BBCFB6ABB3882C1
Requests: 1 HTTP requests in this frame

Frame: https://proton.ad.gt/join-ad-interest-groups.html
Frame ID: 631142C645A58E8E4717A4871B33FC42
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.667.0_en.html
Frame ID: 3D224CCC31CD71EC750CD4D9D822A8B1
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: 085D47AB0D60A94BD42554A5E0E0BE86
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?gdpr=0&us_privacy=1YNY
Frame ID: 274A0AA13726AD28082A3E1D697005B5
Requests: 1 HTTP requests in this frame

Frame: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=1YNY
Frame ID: 90C63687F0CEFCB67A6CD9A126CC0C53
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?us_privacy=1YNY&
Frame ID: C50653E70BC6401F9A99A7900CDCFD74
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU87559X&prvid=2034%2C2033%2C2031%2C2075%2C2030%2C590%2C2073%2C273%2C233%2C2028%2C2027%2C2104%2C2026%2C236%2C3038%2C2025%2C2069%2C237%2C556%2C117%2C97%2C55%2C99%2C2045%2C3012%2C2087%2C3011%2C3010%2C2041%2C122%2C201%2C2039%2C246%2C4%2C521%2C126%2C203%2C522%2C2113%2C446%2C523%2C326%2C404%2C9%2C407%2C2011%2C2055%2C2099%2C3022%2C3020%2C294%2C251%2C450%2C2009%2C255%2C3018%2C2126%2C3017%2C2125%2C214%2C2124%2C3014%2C338%2C459%2C77%2C38%2C2100%2C2022%2C182%2C141%2C262%2C3073%2C461%2C222%2C301%2C345%2C225%2C10000%2C80%2C108%2C229&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=1&usp_consent=1&uspstring=1YNY
Frame ID: 325CCD32D72BE6938314FB420FFFBF0C
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 235C401E5C0DAD62420E9E597F1AF115
Requests: 1 HTTP requests in this frame

Frame: https://ggsoftware-d.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=&us_privacy=1YNY
Frame ID: 9BDAC562F3625445CA3D00742204D6A4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.keqingmains.com//bennett// HTTP 307
https://www.keqingmains.com//bennett// HTTP 301
https://keqingmains.com/bennett/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

235
Requests

91 %
HTTPS

32 %
IPv6

50
Domains

80
Subdomains

65
IPs

3
Countries

4935 kB
Transfer

9542 kB
Size

219
Cookies

37 Outgoing links

These are links going to different origins than the main page.

URL: https://hsr.keqingmains.com/
Title: Honkai: Star Rail

Search URL Search Domain Scan URL

URL: https://library.keqingmains.com/
Title: Theorycrafting

Search URL Search Domain Scan URL

URL: https://compendium.keqingmains.com/
Title: KQM Compendium

Search URL Search Domain Scan URL

URL: https://cards.keqingmains.com/
Title: KQM GITCG

Search URL Search Domain Scan URL

URL: https://discord.gg/gitcg
Title: GITCG Discord

Search URL Search Domain Scan URL

URL: https://genshincards.com/
Title: Genshin Cards

Search URL Search Domain Scan URL

URL: https://tcg.keqingmains.com/
Title: TCG Matchmaking (Beta)

Search URL Search Domain Scan URL

URL: https://battlefy.com/gitcg
Title: Tournaments

Search URL Search Domain Scan URL

URL: https://discord.com/invite/keqing
Title: Discord

Search URL Search Domain Scan URL

URL: https://www.twitch.tv/kqm_official
Title: Twitch

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCNMBc10l3ogyBT-uMRkcvsA
Title: YouTube

Search URL Search Domain Scan URL

URL: https://twitter.com/KQM_Official
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.reddit.com/r/KeqingMains/
Title: Reddit

Search URL Search Domain Scan URL

URL: https://www.instagram.com/KQM_Official/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://nitropay.com/?utm_source=nitropay&utm_campaign=n&utm_medium=ad
Title: About these ads

Search URL Search Domain Scan URL

URL: https://discord.gg/keqing
Title: Discord

Search URL Search Domain Scan URL

URL: https://twitter.com/r1ppajun
Title: r1ppajun

Search URL Search Domain Scan URL

URL: https://twitter.com/N_S_Egg
Title: Yuqi

Search URL Search Domain Scan URL

URL: https://library.keqingmains.com/combat-mechanics/spiral-domains/ley-line-disorders
Title: Ley Line Disorders

Search URL Search Domain Scan URL

URL: https://docs.google.com/spreadsheets/d/1-vkmgp5n0bI9pvhUg110Aza3Emb2puLWdeoCgrxDlu4/copy
Title: Energy Recharge calculator

Search URL Search Domain Scan URL

URL: https://twitter.com/_Stanis23_
Title: Stanis23

Search URL Search Domain Scan URL

URL: https://frzyc.github.io/genshin-optimizer/#/
Title: Genshin optimizer

Search URL Search Domain Scan URL

URL: https://youtu.be/_4opkJodCZc
Title: its tutorial

Search URL Search Domain Scan URL

URL: https://library.keqingmains.com/combat-mechanics/snapshot-and-dynamic
Title: here

Search URL Search Domain Scan URL

URL: https://twitter.com/yunewo
Title: yunewo

Search URL Search Domain Scan URL

URL: https://muakasan.github.io/genshin-portraits/index.html
Title: Muakasan’s Genshin Team Portrait Generator for the character icons

Search URL Search Domain Scan URL

URL: https://1drv.ms/x/s!AkIAyr5qYWRKcAsgmYmGyLj1E1M?e=42uUg5
Title: Thundering-Fury calcs

Search URL Search Domain Scan URL

URL: https://twitter.com/greenwing528
Title: ペんぐぅ

Search URL Search Domain Scan URL

URL: http://twitch.tv/zajef77
Title: here

Search URL Search Domain Scan URL

URL: https://gcsim.app/
Title: gcsim

Search URL Search Domain Scan URL

URL: https://ko-fi.com/yami
Title: Website built by ~ Yami

Search URL Search Domain Scan URL

URL: https://lightnovelsai.com/
Title: Chinese Yuri Translations

Search URL Search Domain Scan URL

URL: https://yamitl.com/
Title: Mistress I was wrong translations

Search URL Search Domain Scan URL

URL: https://webnovelsai.com/
Title: Asian Novel Translation Tool

Search URL Search Domain Scan URL

URL: https://doanythingai.com/
Title: ChatGPT AI tool

Search URL Search Domain Scan URL

URL: https://webnovelsai.com/?utm_source=kqm

Search URL Search Domain Scan URL

URL: https://discord.com/channels/763583452762734592/953216453077794857
Title: Click Here

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.keqingmains.com//bennett// HTTP 307
https://www.keqingmains.com//bennett// HTTP 301
https://keqingmains.com/bennett/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 126

https://keqingmains.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://keqingmains.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js

Request Chain 127

https://keqingmains.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://keqingmains.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js

Request Chain 148

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-LoopMe_n-adMediaV1_snb_n-acuityads_n-MediaNet_n-Beeswax_ox-db5_cnv_n-adman-v2_n-sharethrough_n-onetag_pm-db5_n-simpli.fi_ppt_n-baidu_an-db5_3lift_n-Outbrain HTTP 302
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-LoopMe_n-adMediaV1_snb_n-acuityads_n-MediaNet_n-Beeswax_ox-db5_cnv_n-adman-v2_n-sharethrough_n-onetag_pm-db5_n-simpli.fi_ppt_n-baidu_an-db5_3lift_n-Outbrain&dcc=t

Request Chain 167

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&adnxs_id=$UID&gdpr=0 HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fmatch%3Fid%3DAU1D-0100-001726753891-8JQZDW3T-E8HQ%26adnxs_id%3D%24UID%26gdpr%3D0 HTTP 302
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&adnxs_id=4617267580394984253&gdpr=0

Request Chain 168

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001726753891-8JQZDW3T-E8HQ&gdpr=0 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001726753891-8JQZDW3T-E8HQ&gdpr=0 HTTP 302
https://ids.ad.gt/api/v1/t_match?tdid=faef1d29-3001-4128-bb4e-24fa47627f12&id=AU1D-0100-001726753891-8JQZDW3T-E8HQ

Request Chain 169

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001726753891-8JQZDW3T-E8HQ HTTP 302
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001726753891-8JQZDW3T-E8HQ HTTP 302
https://ids.ad.gt/api/v1/pbm_match?pbm=20210A7D-5EF3-4396-A986-E239010B967F&id=AU1D-0100-001726753891-8JQZDW3T-E8HQ

Request Chain 170

https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001726753891-8JQZDW3T-E8HQ&gdpr=0 HTTP 302
https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&rub=M19COJF8-J-IFPX&gdpr=0

Request Chain 171

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001726753891-8JQZDW3T-E8HQ%26tapad_id%3D%24%7BTA_DEVICE_ID%7D HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001726753891-8JQZDW3T-E8HQ%26tapad_id%3D%24%7BTA_DEVICE_ID%7D HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=23edf488-1b8e-4b82-80fd-5fb45452619b%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fid%25253DAU1D-0100-001726753891-8JQZDW3T-E8HQ%252526tapad_id%25253D23edf488-1b8e-4b82-80fd-5fb45452619b%252C&gdpr=0&gdpr_consent= HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=faef1d29-3001-4128-bb4e-24fa47627f12&ttd_puid=23edf488-1b8e-4b82-80fd-5fb45452619b%2Chttps%253A%252F%252Fids.ad.gt%252Fapi%252Fv1%252Ftapad_match%253Fid%253DAU1D-0100-001726753891-8JQZDW3T-E8HQ%2526tapad_id%253D23edf488-1b8e-4b82-80fd-5fb45452619b%2C HTTP 302
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&tapad_id=23edf488-1b8e-4b82-80fd-5fb45452619b

Request Chain 172

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001726753891-8JQZDW3T-E8HQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm=&google_sc=&google_ula=450542624&id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&google_tc= HTTP 302
https://ids.ad.gt/api/v1/g_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&google_error=15

Request Chain 173

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTcyNjc1Mzg5MS04SlFaRFczVC1FOEhR

Request Chain 174

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&uid=[UID]&gdpr=0 HTTP 302
https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&uid=9093df01-cc1f-4fb5-8dd0-325a815ec597&gdpr=0

Request Chain 176

https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001726753891-8JQZDW3T-E8HQ%26auid%3DAU1D-0100-001726753891-8JQZDW3T-E8HQ HTTP 302
https://u.openx.net/w/1.0/cm?cc=1&id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001726753891-8JQZDW3T-E8HQ%26auid%3DAU1D-0100-001726753891-8JQZDW3T-E8HQ HTTP 302
https://ids.ad.gt/api/v1/openx?openx_id=4c529cc1-ee4e-46c7-9287-6f3f19bf5391&id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&auid=AU1D-0100-001726753891-8JQZDW3T-E8HQ

Request Chain 221

https://sync.mathtag.com/sync/img?cs_wd_sy=1&dp=43&redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dif%26nuid%3D[MM_UUID] HTTP 302
https://sync.go.sonobi.com/us.gif?nw=if&nuid=b7dc66ec-2c66-4900-a876-a0be7d800006

Request Chain 222

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=140&gdpr=0&gdpr_consent= HTTP 302
https://sync.go.sonobi.com/us.gif?nw=bs&nuid=db0f47e3-604a-4a32-9d70-0cc84673795b-66ec2c63-5553&gdpr=0&gdpr_consent=

Request Chain 223

https://p.rfihub.com/cm?pub=35683&in=1 HTTP 302
https://sync.go.sonobi.com/us.gif?nw=zt&nuid=969470228759202582

Request Chain 226

https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_cm&google_hm=YzllYzQ0YzEtMTQzNy00NTYyLTk0MDktNDg1ZWYzNTNjMDAz HTTP 302
https://sync.go.sonobi.com/usg.gif?google_error=15

Request Chain 227

https://sync.srv.stackadapt.com/sync?nid=286 HTTP 302
https://sync.go.sonobi.com/us.gif?nw=st&nuid=aaJNYqyYU2x3YdaV4St9XqL1zvY

Request Chain 228

https://creativecdn.com/cm-notify?pi=sonobi HTTP 302
https://creativecdn.com/cm-notify?pi=sonobi&tc=1 HTTP 302
https://sync.go.sonobi.com/us.gif?nw=rh&nuid=uCA8BrXFuqFCbJMcIkTBjNlfwg43T8N7zwGygqAuagY&pi=sonobi&tc=1

Request Chain 229

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=97d6fcd501&gdpr=0&gdpr_consent= HTTP 302
https://sync.go.sonobi.com/us.gif?nw=td&nuid=faef1d29-3001-4128-bb4e-24fa47627f12&pubid=97d6fcd501

Request Chain 230

https://idsync.rlcdn.com/711892.gif?partner_uid=c9ec44c1-1437-4562-9409-485ef353c003 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CNS5KxIwCiwIARDAlQEaJGM5ZWM0NGMxLTE0MzctNDU2Mi05NDA5LTQ4NWVmMzUzYzAwMxAAGg0I5tiwtwYSBQjoBxAAQgBKAA HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=31f5f2c3fba88020be7402dda4847de5ba1214788aa941ca9d3aceb4e07736e3791426b5417dce21&_=2 HTTP 307
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=31f5f2c3fba88020be7402dda4847de5ba1214788aa941ca9d3aceb4e07736e3791426b5417dce21&rand=02456420

Request Chain 231

https://x.bidswitch.net/sync?ssp=sonobi&gdpr=0&gdpr_consent= HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=sonobi&gdpr=0&gdpr_consent= HTTP 302
https://pr-bh.ybp.yahoo.com/sync/iponweb?bidswitch_ssp_id=sonobi&ssp_user_id=d4483e65-826f-423d-913d-2374bccd1343&gdpr=0&gdpr_consent= HTTP 302
https://x.bidswitch.net/sync?dsp_id=74&&user_id=y-m30jTlJE2plphDcnnnzIlgthYW2HNvTyLS6EPw--~A&expires=5&ssp=sonobi HTTP 302
https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=d4483e65-826f-423d-913d-2374bccd1343&gdpr=&gdpr_consent=&us_privacy=

Request Chain 232

https://pixel.tapad.com/idsync/ex/receive?partner_id=3061&partner_device_id=c9ec44c1-1437-4562-9409-485ef353c003 HTTP 302
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D23edf488-1b8e-4b82-80fd-5fb45452619b%252C%252C HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=4617267580394984253&pt=23edf488-1b8e-4b82-80fd-5fb45452619b%2C%2C

235 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request / Show response
keqingmains.com/bennett/
Redirect Chain

http://www.keqingmains.com//bennett//
https://www.keqingmains.com//bennett//
https://keqingmains.com/bennett/

161 KB
33 KB

166ms
151ms

Document
text/html

172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea8df23700e799287216855b0cbf8210647757725ce6464b113d1945f8202670

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8c5a0cec29f008ae-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 19 Sep 2024 13:51:26 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jF2%2BUeRWDj%2FnJK4DmVYK9PM1JN%2B3XScc7l4BSo14lhcwDxFtNYjXyKJ1%2BuUfOiNA3ikMdBnBOfYpUFlsWzJhIKIfs8NvisqDxoIqtx%2FSL%2Bwh21bMdYR9uSD0OqMUrGmIf1o%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding
x-content-type-options: nosniff

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=3600
cf-ray: 8c5a0ceb68de08ae-LAX
content-length: 167
content-type: text/html
date: Thu, 19 Sep 2024 13:51:26 GMT
expires: Thu, 19 Sep 2024 14:51:25 GMT
location: https://keqingmains.com/bennett/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tN4ZsnuD9z4la%2BRJSx98ORNrQEtWYUcoGUl%2FH%2BTvdjgXhm5zwbupnNhpRrBgOrC%2FHsrQ6UFQfryvq%2B1ofI6xnNskLjq3MUL91VBF5KO9t0PHYPGYvyMhUFvQlrEp0lWzPxVXJBNS"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding

GET
H3 200 speculation
keqingmains.com/cdn-cgi/ 128 B
566 B 102ms
100ms Other
application/speculationrules+json 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://keqingmains.com/cdn-cgi/speculation
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://keqingmains.com
Referer: https://keqingmains.com/bennett/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sXB8elRwu8ENhQgLb6hSauvuhHfNYgKtlLfdfW17Xd4Rf5jLAxk7lr6CVzA2bzncsguytVq7ZYvinyPKlEM%2FwSFF9FN401sP97RuCgzS7cv6z9ObQ4b0QOxqBl2wvZFzoqs%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c5a0ced8b9008ae-LAX
access-control-allow-origin: https://keqingmains.com
alt-svc: h3=":443"; ma=86400
content-length: 128
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: application/speculationrules+json
vary: Origin, Accept-Encoding
server: cloudflare
priority: u=4,i

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/ 160 KB
21 KB 293ms
95ms Stylesheet
text/css 2606:4700::6812:ba1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ba1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

62f74b1cf824a89f03554c638e719594c309b4d8a627a758928c0516fa7890ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://keqingmains.com
Referer: https://keqingmains.com/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: HIT
etag: W/"28021-7Ba9Gb9K6bwuIzasQJpQO7varK0"
age: 2161127
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X%2B6t5cFhpnSskOYGdxH7sC90YOPkglIfNP4ackY3%2BbvQSyeZ1%2Bia8E%2FPKkdTmEKeNgTorcJnQqTCKgq3XAakVM1BtwqZ%2Fg16aEIqMrdaQw%2BS6QoXxGY%2FJ8kOEoTjeuYY4pCqVed3HyEXpIiDC%2Fs%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443"; ma=86400
x-cache: HIT, HIT
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: text/css; charset=utf-8
x-served-by: cache-fra-etou8220101-FRA, cache-lga21958-LGA
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8c5a0ceececc0916-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 20842
server: cloudflare
x-jsd-version: 5.1.3

GET
H3 200 style.min.css
keqingmains.com/wp-includes/css/dist/block-library/ 95 KB
13 KB 196ms
189ms Stylesheet
text/css 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://keqingmains.com/wp-includes/css/dist/block-library/style.min.css?ver=6.2.2

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"9391de6300b06e4d9fbf07bb56ff2b01"
age: 5890
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z4jSoFX6udOkgrdXcRdxDibzLwzWr08MNS55bjQnMmPhAOFQfnAJj%2BxjuUC0w6X71QeuFGx0264WWPo1Edb4ygijwac31BtuzSGkZbcSDsYcFrILiVRix5jgWXv%2FnhkLdhY%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
priority: u=0,i=?0
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cedbbbf08ae-LAX
access-control-allow-origin: *
server: cloudflare

GET
H3 200 blocks.style.build.css
keqingmains.com/wp-content/plugins/ultimate-blocks/dist/ 51 KB
10 KB 114ms
107ms Stylesheet
text/css 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://keqingmains.com/wp-content/plugins/ultimate-blocks/dist/blocks.style.build.css?ver=2.5.6

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2aa5749e39fd54de253a61f0601bf9b75425b485ad33dcd47b9f42f69e51ec22

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"28f7d12e6f3d0e0e8434aa56f44c2b9d"
age: 5203
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kC68D3MBiEWlouCnXBv4pyLXInncCwjtShoKkl4L7ACLEzdrBwKQNye2WL3drrGq68Zmmj31tyGlMJV0%2BktRaqa3z0GSz9%2B%2BrtkKLW9ObkrQbZsp5QWX7hpGPaLZbgRJ1hg%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
priority: u=0,i=?0
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cedbbc108ae-LAX
access-control-allow-origin: *
server: cloudflare

GET
H3 200 classic-themes.min.css
keqingmains.com/wp-includes/css/ 291 B
744 B 194ms
187ms Stylesheet
text/css 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://keqingmains.com/wp-includes/css/classic-themes.min.css?ver=6.2.2

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"a9599e5949c606a58e812b97752ac113"
age: 808
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GY2VkufcQmsCaKb3Oi9duFaYHXWsgSHcAIvJJ%2BAkl1CsS5id6%2BYgWAO9gv4I%2F28sUjxn7HJXN3nXpOyXHA8COLSARWfymOO6QvdG3qqXdXFpCnE4wSqEmEf%2Byji5ljqOXH4%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
priority: u=0,i=?0
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cedbbc708ae-LAX
access-control-allow-origin: *
server: cloudflare

GET
H3 200 styles.css
keqingmains.com/wp-content/plugins/sitepress-multilingual-cms/dist/css/blocks/ 58 KB
9 KB 117ms
110ms Stylesheet
text/css 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://keqingmains.com/wp-content/plugins/sitepress-multilingual-cms/dist/css/blocks/styles.css?ver=4.6.7

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

58c855e7eb9b917e71e6b733e73c542c25bacb986f3ba7df2be1570200312135

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"1eb5842f39b7c27c0eb8b17787bb4b86"
age: 5890
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oBkHq2E8pOc%2BLCog9%2B3adsQg%2Bi%2FXJ4e4p3ASi00IbxF7I0mi1IDKEWNRUYbbizt33eJ88B1zd0QMXotFpCCXMfBwQt%2BG%2FdjKqr0Bm8JliCz4BTm3eHiLA%2B8%2FaZDIuJ%2FkloQ%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
priority: u=0,i=?0
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cedbbc808ae-LAX
access-control-allow-origin: *
server: cloudflare

GET
H3 200 style.min.css
keqingmains.com/wp-content/plugins/easy-table-of-contents/vendor/icomoon/ 438 B
751 B 115ms
108ms Stylesheet
text/css 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://keqingmains.com/wp-content/plugins/easy-table-of-contents/vendor/icomoon/style.min.css?ver=2.0.32

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b88fca268e1352a0922f301c6b88f0499606c01faa8d0718de11a8153a5edc3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"14584f1d37ddd2ce8915a85bc2553193"
age: 2546
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oz%2FXdq08%2F%2FXGeAi8%2Fm3ngSZ9VSpogq8m2HOOTMCS9dhbARY2t95fraxK10kcHB5ESCMUUn68jN%2BsHvbu1sU68j2ZTu8ME3Nwqh6SjR57XWKkBx8U%2BgDRuxKzDrqCQQKlDIw%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
priority: u=0,i=?0
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cedbbc908ae-LAX
access-control-allow-origin: *
server: cloudflare

GET
H3 200 screen.min.css
keqingmains.com/wp-content/plugins/easy-table-of-contents/assets/css/ 7 KB
2 KB 115ms
109ms Stylesheet
text/css 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://keqingmains.com/wp-content/plugins/easy-table-of-contents/assets/css/screen.min.css?ver=2.0.32

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f5500d17042bda82d8edb2a270d4181506a8d2c0fc9906bf42f57a9882a64fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"e5b6dd3cf8b1cbabce0bead9b1310bd6"
age: 6796
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jyq%2FtAIoprI5xGpsvisWGpaduSHotm3K1jY%2BknmACl10jbSi9cjslcfEbA%2BVLqFLHT94nqRy3imiMFJvt9ys0zgQ5pu6M3%2BmcOj1RkDG11czoKSoJ7SGvCoFF3rspA%2F62hk%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
priority: u=0,i=?0
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cedbbcc08ae-LAX
access-control-allow-origin: *
server: cloudflare

GET
H3 200 main.min.css
keqingmains.com/wp-content/themes/generatepress/assets/css/ 19 KB
5 KB 195ms
191ms Stylesheet
text/css 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://keqingmains.com/wp-content/themes/generatepress/assets/css/main.min.css?ver=3.1.3

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

33a3b2b4bb13ccc6ea24e09ac28cf3934212a8191289ff8e032b8a25d84997f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"990d5c8312d4ad8abe3914c020be1207"
age: 808
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SCUNNJeHcTLxX6a37kqvf%2F7QgRZ261JfkShTxfxpvWMsPEkD68y44r881tSFAqWGY3rsiW8h1Uwik9KcXm4XIfSwxSpyIbQK3cSB5%2FKcbdArFFnLgpsG65KbZiKIhwuuwqA%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
priority: u=0,i=?0
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cedbbcd08ae-LAX
access-control-allow-origin: *
server: cloudflare

GET
H3 200 style.css
keqingmains.com/wp-content/themes/generatepress/ 17 KB
5 KB 196ms
192ms Stylesheet
text/css 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://keqingmains.com/wp-content/themes/generatepress/style.css?ver=1726689795

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec2abddda17d263f847005252ec4184763f00415ff0472c58be8508f39f05031

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

content-encoding: gzip
cf-cache-status: REVALIDATED
etag: W/"55707594b7e98f1af32de1cc57c61653"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ov0uefArgmIv%2BtkssLgpbR5RsApShv6J0%2B55Hx14WbOQwK%2FIaFGiGpGclakfC2EwKfW3k6bxv9f4u%2F6BHN6IcKp5nDOY%2FjdaQ2yUmEuxv2Et%2FXQC8uJrNTbtXYzbMvtvPVk%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
priority: u=0,i=?0
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cedbbce08ae-LAX
access-control-allow-origin: *
server: cloudflare

GET
H3 200 language-cookie.js Show response
keqingmains.com/wp-content/plugins/sitepress-multilingual-cms/res/js/cookies/ 271 B
689 B 194ms
192ms Script
application/javascript 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://keqingmains.com/wp-content/plugins/sitepress-multilingual-cms/res/js/cookies/language-cookie.js?ver=4.6.7

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

20be9b3c63a01d921697a0ef1c1596f647678498eefe6dc508e2363be25277f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"a4a24fece2d52f139d82cdfd9366db75"
age: 4460
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cHfk09uq7xkBfj%2FIkjRQecj%2BW2VORCfZmgquimF%2Bqy25rW8l8IbiriM2O6%2BdGehp4NrgCPpoOQUp3aMLuOhFSZlGyvpTNLTX8BHUewP7VN3ZsXspuX1dfyUo8PSIogIYO4w%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=1,i=?0
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cedbbcf08ae-LAX
access-control-allow-origin: *
server: cloudflare

GET
H3 200 ads-938.js Show response
s.nitropay.com/ 543 KB
172 KB 230ms
118ms Script
text/javascript 104.18.2.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://s.nitropay.com/ads-938.js

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.2.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb9bda901746b11d31201634e958852c9fa6051e73b779ced39a4d291c10dc6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Type
x-goog-meta-goog-reserved-file-mtime: 1725467330
x-goog-hash: crc32c=MXTn4A==, md5=qOCg2/EmpbG2sD6UPway2A==
cf-cache-status: HIT
etag: W/"a8e0a0dbf126a5b1b6b03e943f06b2d8:1726749763000"
age: 4045
content-encoding: gzip
x-goog-stored-content-encoding: identity
expires: Fri, 19 Sep 2025 12:44:01 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 551171
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: text/javascript
last-modified: Thu, 19 Sep 2024 12:42:43 GMT
vary: Accept-Encoding
x-guploader-uploadid: AD-8ljt0KpvJT0GIPnon96WMbGMc3RqKHF-wtgreqwFCXYn68fNazyl4DzV3njAG4W51LJJqR7oUh3rbig
strict-transport-security: max-age=2592000; includeSubDomains
cache-control: private, max-age=600
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 8c5a0cf04967cba4-LAX
access-control-allow-origin: *
x-goog-generation: 1725468276718614
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 283 KB
98 KB 555ms
197ms Script
application/javascript 2607:f8b0:4006:816::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VBESH40ETT

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9006171bbbacaf04ad7f3c0d047c7183ac693dcdca6c70fa2c180f90079b1c41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Thu, 19 Sep 2024 13:51:27 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 99537
date: Thu, 19 Sep 2024 13:51:27 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H3 200 kqm-logo-full-e1633177025729.png
keqingmains.com/wp-content/uploads/2021/10/ 34 KB
34 KB 192ms
190ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/10/kqm-logo-full-e1633177025729.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5d39f5ed48e498c81253ee9aad52fd996a814257489afabe5166dbe572088ee9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: HIT
etag: "8fdc4375089a49f038178e79065b6b4c"
age: 2580
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mj%2FAyx90r6%2FUi4Oj5pq4L3u5ctdPsgkGliRO9R1egsczyZ0P7sALRH%2BP5VME6xn7i47k8oV7Ne4UpBn2SE6SzuyIMOnJETWKOXHRSSB9CO0Np1fAwIzoBd4zSDlgQlra1gI%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=2,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cedbbd108ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 34586
server: cloudflare

GET
H3 200 cropped-Untitled_Artwork_65-1.png
hsr.keqingmains.com/wp-content/uploads/2023/04/ 450 KB
451 KB 318ms
278ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hsr.keqingmains.com/wp-content/uploads/2023/04/cropped-Untitled_Artwork_65-1.png
Requested by: Host: keqingmains.com
URL: https://keqingmains.com/bennett/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06e38460a0bf0f44161d62a6464695b44fb3f4adedc3b2807c511bb68ff89878

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cf-cache-status: HIT
etag: "64463464-70877"
age: 4793468
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PGjVYxJtUC50yQvbDF3gLvWCkfFGovhSF2gauoW%2BetjTPzZthCK96oFMTebl%2BMJBP%2FhRcoY5neJrPK%2FtDihi6d3XPM0MTFAxP7riaw33HKTgi13k4z4R7uBoYk%2FLEyLqEsbHefIS"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
last-modified: Mon, 24 Apr 2023 07:48:52 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8c5a0cefbee908ae-LAX
accept-ranges: bytes
content-length: 460919
server: cloudflare

GET
H3 200 twitch-wh.png
keqingmains.com/wp-content/uploads/2023/12/ 1 KB
2 KB 134ms
107ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2023/12/twitch-wh.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d9db0bc787491b0bef26558aa356cb9a980c74a7417c5278cad4c0497b1a2ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: HIT
etag: "98387b5ba07aa806febf7c7743179092"
age: 2546
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GjibCDowKsbPxT4KkrSiYxzfO%2FdfJcU1LuCzlhnC6JwQFy8lxBY9iiYaYsg8OuVZwwUGTqN5am3t1VURAabMtxyPB%2Bj1ET9s%2FU6n7qQwy00P1yKXXcJ6LyASweNll%2FyQY00%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbeac08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1244
server: cloudflare

GET
H3 200 youtube-wh.png
keqingmains.com/wp-content/uploads/2023/12/ 2 KB
3 KB 137ms
111ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2023/12/youtube-wh.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8688fe233ca17120e18097051f989d40756e35fc6b930efbd6da6dc0811526d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: HIT
etag: "0681d5db7e03830f0fb7823d2ef56c29"
age: 4684
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5bk41CIL1Ty4pEe3G%2BL9%2FMkgVbP8bhHDu417Zw%2BLT2RHQHBqpI%2BXPNAjsjfMBXlKCGMUnU6liejPgJcDOrXZRgHCD8ifWw6QjyJ%2B18sbNfTJ3ALg9%2Fo6nkGFIhG8JQigjJA%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbead08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2081
server: cloudflare

GET
H3 200 twitter-wh.png
keqingmains.com/wp-content/uploads/2023/12/ 3 KB
4 KB 137ms
111ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2023/12/twitter-wh.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

07005bb65e83788fa03e1aea148ca8e22ce8789f1e73f5d83150315382ccc7ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: HIT
etag: "331ef17943371d7c57af5993e5c386fa"
age: 808
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pqe6P4b1xjA%2Bu8rmDw6Y2CKS0FW9g4HieCaQulnT%2FDbvYwT1n60D1ddBJYzSXxuA5N4PzXzFdG46K%2BWVgVARiFPMT5ArBh3Ihux2u5tmNWKxf7uFG34QO8hxMsSYA5GD1h8%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbeb008ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3448
server: cloudflare

GET
H3 200 reddit-wh.png
keqingmains.com/wp-content/uploads/2023/12/ 6 KB
7 KB 138ms
111ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2023/12/reddit-wh.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42b886f2077269e007ca68cf3ea0fb734e35b0da5ddf403560e4cdc32ba282bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: HIT
etag: "e5c37e69847b71cd40bab8570df68c01"
age: 808
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cU6eLUmHeKzsmFITiKVq18yFqgALGZMpjdnAdA0rUH1%2BPHCwx6e6ui4rq3P%2F7BAXQR4OmGPxVWppSpzFLHQUt9AihN5EJ3ZgkrBGQln7K52Hx8yHeMmtbQxs%2Bf%2FLV6vtFCU%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbeb308ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6490
server: cloudflare

GET
H3 200 instagram-wh-1.png
keqingmains.com/wp-content/uploads/2023/12/ 7 KB
7 KB 132ms
106ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2023/12/instagram-wh-1.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f82459f8fe4be4d767220367b0ff2463eba2d4dc9ab6dbc523a5c76367de2b37

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: HIT
etag: "ee4beafec6b7fe1b3c7f95339f4e08e1"
age: 808
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AhrTRA0ZpT7EqfZBkLQP07TnRsSf87EgvHAAnUo7C4bU6%2FwD3dB76nnCBO1pqNCTICz92ZbeqOc2RTVcyRxgA%2Byms6sNz2C%2FqA4yfD9YrRwEzudshkFeY3i0307Ogh%2FPZpA%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbeb608ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6666
server: cloudflare

GET
H3 200 patreon-wh.png
keqingmains.com/wp-content/uploads/2023/12/ 3 KB
3 KB 132ms
107ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2023/12/patreon-wh.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4e6f36cc1ee2825124f5231e5f32182d4e0f045cd9b60bbd05f6482976c5d9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: HIT
etag: "41baa6845848dd414672373144d695e7"
age: 808
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qZt0YV5wFzoov35nOLSGAuxYg9%2Bg%2B3Jrb94kFgUGsoaMsD2PDPzecp7C%2Fa3rBkqwDZ44gZ8hMTtM8NL%2BMKJPWfA2sb%2FxIsveT8GU5pcjWjvK82vBgJOetYAJ494Hr7SH4kM%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbeb808ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2975
server: cloudflare

GET
H3 200 en-us-flag.png
keqingmains.com/wp-content/uploads/flags/ 324 B
849 B 192ms
187ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/flags/en-us-flag.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d9eb239afd91fca6d3602571e40d9e5dfc16edc9fe2e8074651e0b228fd1919

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: HIT
etag: "f87acac58120277bfa9aa4517b09c004"
age: 4447
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XyGAfPAquVhdzQrU%2Fa%2FfSDMlJ6POGRSbSNtH0w9TKxOoh0GQmUyDDkIcH3%2FfEiM%2BXtZMJ7qRjxfaobztBs2UML%2BiNtw4FEvMX8HPmQ4U12pHr%2FwlX%2F7vDg5SCMCkefaHUsrhDuqhh6wS6Zh09KY%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=2,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cedbbd308ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 324
server: cloudflare

GET
H3 200 zh-hans.svg
keqingmains.com/wp-content/plugins/sitepress-multilingual-cms/res/flags/ 609 B
930 B 92ms
91ms Image
image/svg+xml 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/plugins/sitepress-multilingual-cms/res/flags/zh-hans.svg

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b023af9d9a9bde7e7f6136b1ba2fbcc5807af1c5f6dac17b383c29a8692f851c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"3bd646e84a820a2f6e2d5bdcc897f565"
age: 624
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TpfdwD1xU093HgcgQDbZkv%2FYrNL8lNp5Dmh87GMI3c04dQU8XrXLnuQU4g9FmEMf5QqaTB6N%2BNCJsCXcPL585KBkHEPK%2Fgi4hYupCuwf5SZEhx7iqwukvDvuZXs8Vz2knDE%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/svg+xml
vary: Accept-Encoding
priority: u=2,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0ceedd5208ae-LAX
access-control-allow-origin: *
server: cloudflare

GET
H3 200 pt-br.svg
keqingmains.com/wp-content/plugins/sitepress-multilingual-cms/res/flags/ 3 KB
2 KB 96ms
95ms Image
image/svg+xml 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/plugins/sitepress-multilingual-cms/res/flags/pt-br.svg

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

414878d5f95d09d4b5e65cdcdda185c7be3c775ba366add3b36d31479707b926

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"4c38ac2426f46bb8dd67984743b47864"
age: 624
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xG2OZwr7C6w3kT%2F3tTQ%2B67GydTtcZee3x6H%2FCG7piG0Cc5WbtU2oFkdOev9R6Qreez1LhP7l8X6j%2FNnJlMhonh7easiNyzP%2BQeJqGip4H0KVP5QDaytv%2FCgb9Psdd3kvD%2Bw%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/svg+xml
vary: Accept-Encoding
priority: u=2,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cef5def08ae-LAX
access-control-allow-origin: *
server: cloudflare

GET
H3 200 ru.svg
keqingmains.com/wp-content/plugins/sitepress-multilingual-cms/res/flags/ 355 B
769 B 95ms
94ms Image
image/svg+xml 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/plugins/sitepress-multilingual-cms/res/flags/ru.svg

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0a720bc83f72d17849bd213570ed808ae6b430fa5f3d50dc7fdb32413f7ade01

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"311270664d9535f7be1476e2fb05dc95"
age: 4460
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tfu%2BbmYFP%2FDJiH741p%2BrwcuxnUNX62%2FUvnPJlZ1Im4i1dhXpdqR1NFi4MMoGk10hlCHXy95lNXtm%2FUxUGM1jGfuTZEEoMVj0rfUi%2Bx4kJBYop0xn8hRLa2Uz4xJf9kq2tgI%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/svg+xml
vary: Accept-Encoding
priority: u=2,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cef7e1308ae-LAX
access-control-allow-origin: *
server: cloudflare

GET
H3 200 bennettart-min.jpg
keqingmains.com/wp-content/uploads/2022/04/ 71 KB
72 KB 163ms
137ms Image
image/jpeg 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/04/bennettart-min.jpg

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ba19a20a0168f0d770864fecc18010cdadd87daba010bb37caed2d182c2946b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "eab7b14340fd06c0a21a12ff9b9387df"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aTgn1HDeVEk5znvpR5MTQoe6bVEp%2BoxWP1QQ6mA6YpmQJ%2BAKrG1cwkAEp654DnIIXyU2rC1uGO9w%2FQi%2BhX0hPJD1vSNWCgSIK8ZjP8jI8AfjCxDOECSOABVY5%2FX%2FoXawkkg%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/jpeg
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbeb908ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 72764
server: cloudflare

GET
H3 200 bennettart1-min.jpg
keqingmains.com/wp-content/uploads/2022/04/ 42 KB
42 KB 202ms
176ms Image
image/jpeg 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/04/bennettart1-min.jpg

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5cee8d8b9d467a474abbfb821bf59a4d8e2b2c98ede8870234d676c837569e1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "9c1e984181a68b30d9d3bfe193de2ddd"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qJLm7n%2BhO9YZYU1rsX3rQTHmUBPkSTNGUkw2tFSuQ9k0cndXPgM2IluZB2ARviO%2F7GRQ%2FuC%2BWh7g45kUsHv8rWeclVRHIimRdm8MELmCeJhn5Pq9hroPe9toIYO7A0o3yUoVneyjiUeCBbq05jI%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/jpeg
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbebc08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 42932
server: cloudflare

GET
H3 200 Bennett_5.0_-_cote.png
keqingmains.com/wp-content/uploads/2023/12/ 1 MB
1 MB 210ms
184ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2023/12/Bennett_5.0_-_cote.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3e44ad339a57ea4e2911a92a7dbe6fff4b9867da387563b4997701bf70858467

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "e3c46bac1ed25ba3125aebda9be5f7ab"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9yYZ9DK0H9KfeqCHeOeO182UE5rYrjjpVebOHZlcnneQ8iH20bbtcQsZ%2BolqStq%2BlAKM%2F8FEaWoTGOrg87pGrL740AlUJLkRniWL%2FI6VgW61WxHqJwhqlSCVfQ8BJ894OfQ%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbebd08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1188084
server: cloudflare

GET
H3 200 C6funny-min.png
keqingmains.com/wp-content/uploads/2022/04/ 7 KB
7 KB 213ms
187ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/04/C6funny-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a092bcc80c5e3c0a5dcae2ae6733af0381a926049ea39633c075f31075530f33

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "9b631b13901e7b58eae55461df119864"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DoNkyW6LPco%2BaVwx8FG9T5iVL59kEIB2hHnZRZu5Q3nRP3aGQAVC6TUYdsENsDmrAL34oRrgSJ%2B%2BlnAF8fzb6EirALI4tojp0vHTeaCtLjUcZg2Q4%2BL9NPSHZW9jc%2Fs6g8GLnppHgprby7wJS%2FQ%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbebf08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7079
server: cloudflare

GET
H3 200 bennettart4-min.jpg
keqingmains.com/wp-content/uploads/2022/04/ 233 KB
233 KB 211ms
186ms Image
image/jpeg 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/04/bennettart4-min.jpg

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0f0fa7f333e1e2e4510bef36e8a4b3f4be5f284d1bee62bf66e1740194a05fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "2d015e453170da098c430925afd9cd9a"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Fdrm5r3gvX91vSUv9SfgiJl3fdxS7W%2BeY6Trm7NCYyMKT4%2BS6bo4Hr0%2FQgBxxobVng46MFSO6VFjZUF9bcg6D3BghgFtzlHq92A14suxHwuhDJV4ivwlxiHeL6TecyKsfZ1kkSHZT4SCTmsygU%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/jpeg
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbec008ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 238288
server: cloudflare

GET
H3 200 calc1-min.png
keqingmains.com/wp-content/uploads/2022/04/ 5 KB
5 KB 211ms
186ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/04/calc1-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c3f6c6207bb7c29ac03c61c81b9774dbe42c3754ae4d5b14a3abdad8f8eec3eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "3b33d78d66775cf2a80cbdf2414e4e37"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N24fsnm7wMWoz5elGILYcRB4nZXlLuzPl%2BhZg%2FAQ4Dd3N4ez6rKcN5mKTIc0gBuFpXo4hKVL39hQ8%2BmLC0mm9gSoFWvEpFUukBvBDTyO%2BXHYyy6tQAYO%2F%2FI5oa3TmSmhzl4gIJcDMA4qMuz1gnw%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbec208ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4752
server: cloudflare

GET
H3 200 Weapon_Mistsplitter_Reforged_2nd-min-e1632282574509.png
keqingmains.com/wp-content/uploads/2021/09/ 30 KB
31 KB 212ms
186ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/Weapon_Mistsplitter_Reforged_2nd-min-e1632282574509.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3c684655428e5082088953a6cadc6b3815f52094cd9bc1e43389c8320fb7fba

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "526482620dcdc40a9ad094c4717e2735"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zzDAddgUny3z55IpVc6DQmRZ18jinGQgJBVSyKB9WGcSYqnJSOabGR%2BYYz3DyJmryTws%2FW%2BMCB8yfbAK7fZs6LQI10TroO0yURSstdZ2fkc6YG0t2VY1ck9PxK%2BbTb%2B8Ov2ZIgHYxwhnX7pUa6o%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbec308ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 31152
server: cloudflare

GET
H3 200 Weapon_Aquila_Favonia_2nd-min.png
keqingmains.com/wp-content/uploads/2021/09/ 10 KB
10 KB 214ms
188ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/Weapon_Aquila_Favonia_2nd-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0691d3c3e5f0c0a22b1c7de123b1c0868112538d17023b842a75829e238a8c03

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "d6b10b69920f5a12bbd74a5d18bea137"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nTExdtQUERB829%2FP1lsA%2FtAOjzfz7gKIaPpYPehTD9DgjE8IzY1XYN81%2Fkts6PGoltIMmmVcYpExYI%2FKRsffmvuuL7KfD4Y2wsk5lUs%2FjLGxV7TVKlK8MQUTdQ0CN2wq8Bk%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbec508ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 9804
server: cloudflare

GET
H3 200 Weapon_Freedom-Sworn_2nd-min.png
keqingmains.com/wp-content/uploads/2021/09/ 10 KB
10 KB 131ms
105ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/Weapon_Freedom-Sworn_2nd-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6ec59cebcb824176265d0d4f97417e9e3d5b7f96c5252ce6f788126a8861e747

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: HIT
etag: "c1cd9b60517d4477c40f3655f493a841"
age: 441
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=isuFulyu3ErKVLBXDg8lAmB92JeonwmFyBQBs8uW4gqj0I863pKyyqgQltIEOmVrsJGqULxZbXy7YJdgyS889TEHiDTVRtSCjrfbQYjfwaNLhsomFBK7EnvDiFudFoGvryHJ0cPPoSh34jabf7w%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbec608ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 10170
server: cloudflare

GET
H3 200 Weapon_The_Alley_Flash_2nd-min.png
keqingmains.com/wp-content/uploads/2021/09/ 9 KB
10 KB 212ms
187ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/Weapon_The_Alley_Flash_2nd-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3db99837ccd549701c0167668ca20bd8f849e749982563b4a84d6dd9fe365f58

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "3127a7db8a149ee0a582fbded8b67791"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ji7k4jRsirU0Cp13y2KJzdPM08EVmdMt3AHpKC%2FGCrvzHGzI0DwSgvSL4Qye3G4v%2F0P%2BCxmMVWJRrUkL7ZfGKUAzEHNM350mU1zIwm8SjjQGYeTDDgy4z6%2B8u466faoyWBI%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbec808ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 9613
server: cloudflare

GET
H3 200 Weapon_Skyward_Blade_2nd-min.png
keqingmains.com/wp-content/uploads/2021/09/ 13 KB
14 KB 131ms
106ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/Weapon_Skyward_Blade_2nd-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e70ca8adaf2a3332da66ebfade75f960e19897b45fad5a93e5215bbe436b575c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: HIT
etag: "dbed22408d1c4ad1168008233d162d84"
age: 441
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2KAaNcMaj4cTBSSHck4eQcldVnxNBZywa5t6VsqA8GhJQppbn3c0OT8vpmu26XhzvbfZ31D6StIwpH1uF3EjLB1FqxNgIDR52WqH1TuTgQCGVnTfgi2tCpBEVv9NDIG4tmxjWxGLRTQNN%2Bir%2B3s%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbec908ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 13425
server: cloudflare

GET
H3 200 Weapon_Haran_Geppaku_Futsu_2nd-min.webp
keqingmains.com/wp-content/uploads/2022/03/ 11 KB
11 KB 212ms
187ms Image
image/webp 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/03/Weapon_Haran_Geppaku_Futsu_2nd-min.webp

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

353084a56f108105c69f98b94e44f851f61aca314d465d5591a7698f1ea00461

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "473e60c01f5f6687f7901283b57ff378"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=85ii8fePQIN9pKCTuchk6zUjDQFXXMvLuaiddLfEzu1pSTCdCNAxJomm%2FFpino5HXXPWpoeig63CQ46JtG4hz1phNOgy6oYCTJkpEoEqBZoG%2FZTxqp44v7VzYOlqSGSTNq4%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/webp
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbecb08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11200
server: cloudflare

GET
H3 200 Weapon_Summit_Shaper-min.png
keqingmains.com/wp-content/uploads/2022/02/ 11 KB
12 KB 228ms
203ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/02/Weapon_Summit_Shaper-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02f368e3e00cd0895bdd319438b927d3ff463bfb538bb5ba29d376e863cc7a16

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "592b8c00b6e499bad99f30757dc68705"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YsCeb4RiOxU%2BRB%2Fy8x4sGsDaCliTa8%2BzD5IAeaiZmcOfKzQj%2FjfcUsLcRS%2FUHDJgb7frmRWH0kj5gJbLTCW%2F9JG3K67zS2jGAgVu4MZv1fZ3xK%2FalHBkrcGGY%2BvG2wqAR38%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbecc08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11295
server: cloudflare

GET
H3 200 Weapon_Prototype_Rancour_2nd-min.png
keqingmains.com/wp-content/uploads/2021/09/ 10 KB
11 KB 228ms
203ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/Weapon_Prototype_Rancour_2nd-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

63aec577e18e7dee271b7bf5e09a95e0e162e3981b4738fbe54e6b8c8cd35089

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "1d09a8a5476d7effa0ee97834b0071a8"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L3q3UTPSDL3puHo%2Bv7EK5QUdvda3FpGZid2vsux771djdbaOApA%2FAtYdxlzUlkXJ1wHrcH%2FBwzkud81PuySrRx54OOTRr%2FbrgfukduqD0ieiXmTphCmCwJ3ASLAN6mY98c0%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbecd08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 10547
server: cloudflare

GET
H3 200 Weapon_Blackcliff_Longsword_2nd-min.png
keqingmains.com/wp-content/uploads/2021/09/ 10 KB
11 KB 260ms
235ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/Weapon_Blackcliff_Longsword_2nd-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d1d52fe6d9363ed21c47c5f6c44a7ca75c59dada42492bc87398fe85df669033

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "5abe886f168e874bfa98f06354f203a0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NvQgNXQYmJ%2FXtXS8delqXAW4%2BkSvqe6sGsz0OEhqhg0j48iARRgm28YRParWeXGDh9GcTgGpVO%2BaUzHRoTkeX7qfxPRYAaJbreoy5AGuE2tRT758oNjopOyFLmUtinKAq88%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbece08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 10348
server: cloudflare

GET
H3 200 Weapon_Festering_Desire_2nd-min.png
keqingmains.com/wp-content/uploads/2021/09/ 11 KB
12 KB 281ms
256ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/Weapon_Festering_Desire_2nd-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9934ab1e56240576ee15734643323fdb2f92ba6c9b1fe9aaf435078faaed38cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "3aa386fa7ebd5fe3c9e15f212ad5528d"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5lZYO97r2K85rEDTJl4rF8zy1gmia%2F%2FgWAXjt7%2BnGqDahfnWlJRBeg0qKgvrapFd5aiRZIHRTxPAMrp%2BsaM6bB7DxAwrzz9C3HpFT2ZJXGXoSiWJaE1ckqgTnFZCamRaHUo%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbed208ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11441
server: cloudflare

GET
H3 200 13uBn-Kpwy3ImQdCD0hDoZzpjWn-dCDuhFiHOkCMiMS6mtMnzC9J8ue7XURNOtA-min.png
keqingmains.com/wp-content/uploads/2022/02/ 16 KB
17 KB 282ms
257ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/02/13uBn-Kpwy3ImQdCD0hDoZzpjWn-dCDuhFiHOkCMiMS6mtMnzC9J8ue7XURNOtA-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

784d4b038004a104c0243dbb9f8ddeb90e3d25be1865577a8aaaf4ed972b7417

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "b2865aef1ff16085107f248db6d3d4b9"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sd1L4E6bypun2zVOmctNATcpsktSQzyNVKl5Zf1y1SFjSv0B9i3BDmeBZNEFZLkDOPPRwZqhsKI97jMAU%2F4dcxGhqrN7vtnncIqTUa3Egmg%2BSAsBQIdh%2BE%2F0b%2BrHuhFGST8%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbed408ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 16468
server: cloudflare

GET
H3 200 Item_Royal_Flora-min.png
keqingmains.com/wp-content/uploads/2021/09/ 18 KB
19 KB 294ms
267ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/Item_Royal_Flora-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b3549d45fa65a3f7d3911d58c6493d9884e782eaf3bacc8e2d4e501229661031

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: HIT
etag: "5cc3843aaf5b6d3097aab32659bda4b7"
age: 1520
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BytAVvsqMr00rxu5qZ0ZrNi1iH%2BDjmBMFq9S%2F6xSYDh4jEEx0co%2BU1OFHJZ8wE86%2BzZo89dn%2Bm1499gbDzRMoKt1dZHRxHteoM7w59nxZeiiScVDfiCbxMBI9CHejLXhRhQ%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbed708ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18453
server: cloudflare

GET
H3 200 Item_Instructor27s_Brooch-min.png
keqingmains.com/wp-content/uploads/2021/09/ 12 KB
13 KB 294ms
268ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/Item_Instructor27s_Brooch-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

219aa860d0d8f8173da0ccdb5c385c4171ec91481764dd32fbc67e6c8ebe3f17

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: HIT
etag: "8e20918c7146f24b2cd16e0c4b94e28d"
age: 2546
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DzlcZ3GUHWiaPM%2BobHKj3CRO9xD4VsZiXvaUIuaBXJckjfaP38vs%2BW4cjRR8axfCnVADTUd1ERF8ETtX3VUfbC1YK89t3pitEx6exRHwgEK54tW8l%2FSBZxhrfrr4RYd%2FJYc%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbed808ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12647
server: cloudflare

GET
H3 200 mIQN6Aw-min.png
keqingmains.com/wp-content/uploads/2021/09/ 17 KB
18 KB 294ms
268ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/mIQN6Aw-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ba6fc7291382afd4db70cf3f7864e3fdc4433e31d9603fa3865e0344c8741efa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: HIT
etag: "874169cd1a03c0a6cf29d6c32d06199e"
age: 5367
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2iV0jUGcJ5POMrvdcJXcJIHQtGI1AZMdTDnTjfWmrHTroAFYT4A10Lfl2yowjytKn6VVKJmDz%2FuktC%2Bd8Q2aoo44RPwHX15ZmcGVZQ41lW%2Fq1pS%2F26kwDg0KWf5FKP8%2BWik%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbed908ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 17581
server: cloudflare

GET
H3 200 wuHeSoq-min-e1637148143677.png
keqingmains.com/wp-content/uploads/2021/09/ 33 KB
34 KB 299ms
273ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/wuHeSoq-min-e1637148143677.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

264a7a3f6b4cd2c915c1ecf881f9f1db575d999646eb68985d355bb53a215fdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: HIT
etag: "686f84e5e7e6ecd93f0983d54e97cc8f"
age: 7033
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6UZziK3%2Feao4fMOmYfVIBI%2B4ownt%2BqJTVnjmVW%2FuFXen0NcZJJ9Lx6oax5TJoSRwQht%2Bqax6Hl9YUMgIFkpVDlWDzpAPpYX4DKRTVHpTNB%2Fxed0qTxaCHnxyq7n170DNBfk%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbeda08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 34179
server: cloudflare

GET
H3 200 Item_Maiden27s_Distant_Love-min.png
keqingmains.com/wp-content/uploads/2021/09/ 22 KB
22 KB 300ms
273ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/Item_Maiden27s_Distant_Love-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0252600ecbed609ad12306983a27067828685d3fa1552113d3d21c817dec9d90

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: HIT
etag: "6eb21f9778f7591d385f2f17d910ea14"
age: 3933
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3NBNPo28di9KuNwXngAT5mWpGNkocwwB1dlwc7ZXt0NSCH6cbxax6fkV9IX2BB6%2FGj%2FZaGuAulD46Ftyb3s0GOpyjlZyNmYuDPVsErjMDcklLScUoDAbG2TDlMiXunKxmkQ%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbedb08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 22201
server: cloudflare

GET
H3 200 Weapon_Primordial_Jade_Cutter_2nd-min.png
keqingmains.com/wp-content/uploads/2021/09/ 9 KB
10 KB 300ms
273ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/Weapon_Primordial_Jade_Cutter_2nd-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e47021acbbf7c80d41c292e5e45782a63244ebe1284cb76738b7536777c40626

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: HIT
etag: "737e399b5048b117065231a2541d1e6d"
age: 3225
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dkC4zur7ur6fM72qe7yRODCTpp5bC%2F7xwDk8iDaOvgoh0QHLzzVBFtukyXcDh%2B%2BpVjIcagHltFWz3gx3AfXz8WHYlCpeBdthMUKQS29fm3FamW0jOmjjP3%2BKjLeRV0W0nGg%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbedc08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 9577
server: cloudflare

GET
H3 200 Weapon_Iron_Sting_2nd-min.png
keqingmains.com/wp-content/uploads/2021/09/ 9 KB
10 KB 294ms
267ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/Weapon_Iron_Sting_2nd-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bdece35135342a5afc1ec79832e95d4be85141acdca0630d25b39ad82824e185

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "d5d7faf4e4be589f28002b15f5dcb658"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7twsI9QXwX5DjoGTCzjiDpOHrv%2F9QdzGLK3sDhbp7NiuQKsMFh6tdnNIY74mLENG%2BHi%2Bht0Q67JSjpzCaqvE%2B7qJk6VGy2t8bm9Xme5wfPpZpPcoVYUMA52gMPtVbGvKEhg%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbedd08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 9341
server: cloudflare

GET
H3 200 Weapon_Lion27s_Roar_2nd-min.png
keqingmains.com/wp-content/uploads/2021/09/ 9 KB
10 KB 294ms
268ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/Weapon_Lion27s_Roar_2nd-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ba1502a803f8732ec8af88147f79b0c1c0c0d095207c8eb174f183d8c9c5b8d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "71bf1ae7dd80962c4f5c7ac63491892e"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dTyiDY7XW4wPyOy5YlOYsYGuTWWYInCucVLkKZ1Xdneo5E9sgfw0SQFYEKaDAN%2BSdoGou8XTdZ%2F6EK3XCx7%2FQl%2FZwJkDtBcW8rE%2BHZbMG7x6iLKxyCTwtZUuS5JzMjB7774%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbede08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 9649
server: cloudflare

GET
H3 200 Weapon_The_Black_Sword_2nd-min.png
keqingmains.com/wp-content/uploads/2021/09/ 10 KB
10 KB 294ms
268ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/Weapon_The_Black_Sword_2nd-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e21a8a9bf0dc931e42935bf06fcf6c104cc05d015375c23a8be779dedeb35429

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "44fec3d6a68c800caba9ca8324ed4590"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FVkDvVztkW0xMzgz9D3rhIh6xH9mM2EGMsgkEp6KnEP9MLAzvEMgR191et9y6JK4Y0oklIl9wGjc24vd2JpaevQfpleq6uhXsC8aiUfmGrKR9K1Xemc3igo6UltCVPpaeaUk49nX%2BmNArtz0pfg%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbee008ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 10177
server: cloudflare

GET
H3 200 Weapon_Amenoma_Kageuchi_2nd-min.png
keqingmains.com/wp-content/uploads/2021/09/ 8 KB
8 KB 288ms
268ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/Weapon_Amenoma_Kageuchi_2nd-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0bdbc152035040cd1ea9e54cb34fe3c648438db0637c7fcb35109a8ac049a574

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: HIT
etag: "7e16bdb70b7570a83a79bb450136f7ef"
age: 3208
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BfNPqBfjjCieyBdNovs%2F7WlOJ%2BhVosA4%2F0J3%2BPp%2FBGCVX%2BxSuz8AHKh2L%2BXrJnIpADxenlYC4K0gykfd6Sg%2B9C%2BNgOvzUgUqgKL%2B11X9kBFgJL%2FSRx89jdWHYJL3OaoRMu%2F1n36Hc9UtKZ%2F2Ynw%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbee108ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8038
server: cloudflare

GET
H3 200 Item_Witch27s_Flower_of_Blaze-min.png
keqingmains.com/wp-content/uploads/2021/09/ 21 KB
21 KB 288ms
268ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/Item_Witch27s_Flower_of_Blaze-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0a364be4b6af0c1f3f5a8396cd9e35563e488aa820d02b17655b11f94dc37c95

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: HIT
etag: "c3e452aabdb42e3f9504295fc07db47c"
age: 1453
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w3mPukmZ0VxktoHWpAA%2BNNL1VZ9jgnIZynIXMeVqqlEQ1iE7uEor35dkMJY50EKr1b%2Bh183iRUkgNzu64TdMTg9qUvzInfajkgecS1rwkggRq4qs%2FOALF%2Fi2noF035Nrq78%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbee308ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21450
server: cloudflare

GET
H3 200 u6FzXcH-min.png
keqingmains.com/wp-content/uploads/2021/09/ 22 KB
23 KB 288ms
269ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/u6FzXcH-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0562a13430ea6507a81a32a76c0ecf28ba5279a56448cb24d47123334fbaa766

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: HIT
etag: "f154219c1084b4f4e8dc85b55329a7e4"
age: 841
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kPoAnYmVcHFohsgOa9otdr%2FKbD%2BFzlJi%2FZXjU8VMxjH4WLie5dZivoc%2FK2yh%2Fvh97ve8sRIul8I15uTjccTsQuzaAfkLORPA8xHZcTMUS6bIRTobKEx6uwmWWm9puNXE1KI%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbee608ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 22700
server: cloudflare

GET
H3 200 Item_Lavawalker27s_Resolution-min.png
keqingmains.com/wp-content/uploads/2021/09/ 20 KB
20 KB 288ms
269ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2021/09/Item_Lavawalker27s_Resolution-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

deaf98ef17a0c1ade86e0bb1d5cc78a56f72ae827d8d5e3cef4edfbd4fe01a57

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "2dba3a6bc3f0b4a84f109d75264b740a"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PcfrT%2F80XXN0DhOwMF5HYDq%2FLNdaCBBSQIKr0u9ONhGzhUcLtadLkYxyCQVwizHpTHaDObv9oxI3DXpnOq%2BpO5R1f2sb2h9HpL5kyHZ1sgHwctJGgkciWRLUd0m0IfoeBMQ%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbee708ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 20244
server: cloudflare

GET
H3 200 anemo_black-min.png
keqingmains.com/wp-content/uploads/2022/04/ 187 KB
187 KB 288ms
269ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/04/anemo_black-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6219c6d2c7ab41596c47189ba137821caebeb0dbdcbbe8889c4ee24994084faf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "739e4f26c648a8fc79663ebbc354067c"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B2tEeaDgv9xIvFwQtRv9hSgENGN1LnfTiXTcMNFjI4Zwi2om2F4Z7CotL%2BBOT%2FSbwI%2Fdp7zPm%2Ft%2B16Wa7Qv%2BDfyu4XWGADMsRm%2FP%2FLa396lFc5baKEMgV709NwkfUzR%2FnbburvURJYf%2BGkHJBJI%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbee808ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 191058
server: cloudflare

GET
H3 200 Jean2-min.png
keqingmains.com/wp-content/uploads/2022/04/ 10 KB
10 KB 319ms
299ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/04/Jean2-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5da26dfdbd824c88ae390fb9b8390f4a29242275434d79c644e39e1e0f85532c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "1bc264ec27f009603001a5fcaa71bcd1"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VEzpVdiqM2XFO3%2BvXPmPfProT4Bm6GvNITXPthGR8hJWocybscJ4%2FhGFK89Ob3T%2Fnc640mWdo32p0HhObDB6WNZQfjjlj7QjX%2BTiNmsF7ikCzFCecjHv3iDQhPKshiqYgA41VZk4CU9X0BbmzxY%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbeea08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 10027
server: cloudflare

GET
H3 200 Kazuha2-min.png
keqingmains.com/wp-content/uploads/2022/04/ 14 KB
15 KB 351ms
332ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/04/Kazuha2-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3fc4fb491c573ab23eededc46f4ba9fe909a93b88f1ffd9218869ab413056c3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "8ce2e00b4ffad1caf3cfcede7a18bf0e"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A2wu0KEvFvDyUYWrCN6WGVky4yAydqyw0O5UoqNyU0xeg2LDHtf7DEMOun1KdcCQAQ8XyHq%2FlNbQMVqWMfmILblAmwj8wOCZtpE45iHesuqdzrldLef8qZjkB8fnxfhm8moqb9XdFCXj8RvTp4M%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbeeb08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14414
server: cloudflare

GET
H3 200 bennettart2-min-e1650200659528.jpg
keqingmains.com/wp-content/uploads/2022/04/ 202 KB
202 KB 351ms
332ms Image
image/jpeg 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/04/bennettart2-min-e1650200659528.jpg

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9956e5379e21e76783759961d879892394c4d45f30074cb03415b5b67ca42f47

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "ce65a5fb369790bd89ed6b1cc2b02b7c"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1ork5FVSJy0yZ6vu%2Fye77FCWEpSt8OVpa%2FWgGuSFih436dFGmSUm%2FbUtnMT6prR9bvG1Xc8Q%2F%2F%2FLNrsjnqhMrKx9NK61XBAKZ%2FS4fUo%2FccadiEgUjP5psj3X1Rjtsl1vV%2F8%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/jpeg
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbeed08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 206438
server: cloudflare

GET
H3 200 team1-min-1.png
keqingmains.com/wp-content/uploads/2022/04/ 17 KB
17 KB 350ms
332ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/04/team1-min-1.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49fffc8e4a933146d9811902f403f64d91e5d0f0e444e3eacee7a4938ddb4dc4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "8da8a9d66ad44d285c9644ba63b38b95"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a%2BPVRnkI7pGSI6F51jKZ3Hwub1eDraKdXhJTlYDbWsmrcGxzu7fDqtx6aqSHHhxpWOtebqrLVCfT868T6NI33s7n9%2FkmiDqfvS9i19Pa1HIdKn0Fp%2BKiSO3kiPFaXUkWl50%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbeee08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 16943
server: cloudflare

GET
H3 200 team2-min-1.png
keqingmains.com/wp-content/uploads/2022/04/ 18 KB
18 KB 350ms
332ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/04/team2-min-1.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ca1334ac75220a7273fa1feecac99be82876950c1a54056d4f19c2fe7ef8cf14

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "1726a4bf3bd7975e4e34c395ab1a590c"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C2vSbETpg8EHHB5nnsMaMkJdXpEOS%2BntFnpU%2BQRrsp28ILtfypmJsIB8wBDNLemcVCUW2b9lLk%2Fpm92DacTd5W3LvHFWmFZgK%2BiWd%2FzFA91Wg84kY%2F5qQR2sqNoqKlVcqxM%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbeef08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18098
server: cloudflare

GET
H3 200 team3-min-1.png
keqingmains.com/wp-content/uploads/2022/04/ 18 KB
19 KB 350ms
332ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/04/team3-min-1.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

44991c668c6dd957d7721311365b087e17448385c2511d4e7525c6fc48f84815

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "06325408f9b339949673d0354cff46c8"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9Chdaa1fIEss06uR8EHQWvRVdACGQEZdmjPxBP9egLCV45VIfsbGIF2sHtC2svIq37WOJD3MWSy3Cl1L%2BIcX1zJgTn8aUODarqQvPvPOn73n0XsG%2BK9JEMb2ZcgN2GeSKWw%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbef208ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18783
server: cloudflare

GET
H3 200 team4-min-1.png
keqingmains.com/wp-content/uploads/2022/04/ 17 KB
18 KB 350ms
333ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/04/team4-min-1.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8a024dd7820e2cbc97d9acea0b1aeb555a529c924ac65e615bbcdb3f3146a54f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "b1e7531881fbd853b3b8da8fc6802e7b"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j8huu%2B4LZy7yOjMM4nsngN5Edw%2FRE7GBgsbqREfXYZ%2FxCFgvRJtYfpvulBJylm0gJvqK6lCJRoSujv9AeFgRsCEcBtXTdOqLZdy83YqRfXkGWZCClODGSCZsWB8GbTa5SD6FTgZyMoNPL7siKbE%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbef408ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 17445
server: cloudflare

GET
H3 200 team5-min-1.png
keqingmains.com/wp-content/uploads/2022/04/ 15 KB
15 KB 351ms
333ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/04/team5-min-1.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8aa9a6ff115fb15b144cdfc76be8ae14cb49439daf9ddc1a7caf29bfa387910f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "23316cc829c8ad7578985d3ba9a6e5b5"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wMZA8CSdlKJg8%2BuEMV5XgUCVhOVtM5873qh5LdnAs52giCKaG088bGXSi3Ulikbm%2BwN6IHPRgnIWduuzocg0S3bt2o0RDd%2BjmFXPAQwE0FA8ppIjDLyTYXK9H0H%2BnVJ02Jccp%2FTU6jrpn%2ByCww0%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbef508ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14921
server: cloudflare

GET
H3 200 team6-min-1.png
keqingmains.com/wp-content/uploads/2022/04/ 14 KB
14 KB 352ms
334ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/04/team6-min-1.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

846846e7240f09047df2221ac35216258f9afce46c5043cf7e1975df389c79bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "5e94580113a42ee38188b22a139f817b"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pJtxHzpkKR38N13IxBJqgBb1yp9VhlT6Wdsz5I8%2FRua7ccC178Js1LE9O21ibQKezgBadazuuMjM%2BCf%2B2S85%2BCMVOtQ2oaB4eAyZNMDE%2Bma3Y6%2F%2FwPKgf5NVyMK4tPH%2BcGA%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbef708ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14229
server: cloudflare

GET
H3 200 team7-min.png
keqingmains.com/wp-content/uploads/2022/04/ 13 KB
14 KB 352ms
335ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/04/team7-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d7c256e7cafa896a90a65bbfb10d3e02d302d4ef02bfd4c0ab15397a1fadf3af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "a7cb1273119d3d0ac3c9554c9fc49104"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fbTaZUejaxNnRH5k%2BzXBV%2BDsVwjJSzWbQ5MbFDKPsWJ%2FzuYM5LIkMnV1L3AvuDQG4x7En6d6YBJa5IM%2FWIRddC46KVmg2Vj6kTvXykOjpykoiLswOo8YVidstXG33J74Rvw%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbefb08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 13399
server: cloudflare

GET
H3 200 BennettSolo-min.png
keqingmains.com/wp-content/uploads/2022/04/ 11 KB
11 KB 352ms
335ms Image
image/png 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/04/BennettSolo-min.png

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6cee8a9b84cca3205cc6eccaa32c65de20b972efe7a06731ca020ccb8f16c237

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "61bff1861388e704ff66e51e57550844"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z41A9vJKsypo0rkqL2S3Q%2BUYAeIjHpccbcdkhF2LdJ6v%2BIrUpBsbKi7yQHUovlMhEpLymzylOhfipu88fOfvlQILbcaf36ed5rl4wJT0FjYpu2zAiKMqF9mWteaXPEIoqDs%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbeff08ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11003
server: cloudflare

GET
H3 200 bennettart3-min.jpg
keqingmains.com/wp-content/uploads/2022/04/ 113 KB
113 KB 358ms
341ms Image
image/jpeg 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keqingmains.com/wp-content/uploads/2022/04/bennettart3-min.jpg

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

436bac3de075756eccfcc48cca98f864eaf0a5f7d46be45c3ee820efd4adfc3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

cf-cache-status: REVALIDATED
etag: "e406bebc68d9fb1ebf2461908d3cdd3d"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NQfhNgStxMrszYnajTeEZ%2FWyjSeB4JUjFtQmDigjLxtPGe6a7CbJYT2Etmko8IdUd%2BBza0z7l5gYywSlQZYz4d9IngEVzxUKDq9qsNoNbOQcw%2F9piS3JTmpiVpV5kn9TtrI%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/jpeg
vary: Accept-Encoding
priority: u=3,i
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbf0108ae-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 115336
server: cloudflare

GET
H3 200 front.build.js Show response
keqingmains.com/wp-content/plugins/ultimate-blocks/src/blocks/content-toggle/ 7 KB
2 KB 110ms
101ms Script
application/javascript 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://keqingmains.com/wp-content/plugins/ultimate-blocks/src/blocks/content-toggle/front.build.js?ver=2.5.6

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

93f5340be787ad57c98fdcbc4f8a1aaf3b67a4ffa62e1c8e0abb5e98fe88a673

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"bb6a540e752f12db4de79cd2194a7182"
age: 5203
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5V36q3c7LHBa%2BZ1uxr0lQTaO5cY%2BtSRJCfa0%2BJBgH8Fi34%2BxeQyG1yQgCWnO629e4tGqea2C8hSuC2cAUCn2WO5Wcb0AzsGz3Dmo46pfStSYeoGtL0QFOE6y7qaRwRV0DLU%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=2,i=?0
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cef9e6b08ae-LAX
access-control-allow-origin: *
server: cloudflare

GET
H3 200 front.build.js Show response
keqingmains.com/wp-content/plugins/ultimate-blocks/src/blocks/tabbed-content/ 25 KB
5 KB 136ms
124ms Script
application/javascript 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://keqingmains.com/wp-content/plugins/ultimate-blocks/src/blocks/tabbed-content/front.build.js?ver=2.5.6

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4f5f4f49c1e5c5797093a90bb5abec9594429c8b1f0d69ede9e381ab9cdf9c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"978a8f2c1de25f98a96639e54bcdb8a4"
age: 3251
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KoedS3T2LdTnKvfj5EsxZ5Pwh9ou6FFg3KuTrZQQGBga2dAiGjj1Jxxn%2F5I9Uzmy9nC5FzuxhNL6vV%2FtgC6H1atGYDgy8Gv724UWwCJzCPFi6E1KbcvVPfUAON95fXIUoqo%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=2,i=?0
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cef9e7e08ae-LAX
access-control-allow-origin: *
server: cloudflare

GET
H3 200 scrollby-polyfill.js Show response
keqingmains.com/wp-content/plugins/ultimate-blocks/src/blocks/ 11 KB
4 KB 107ms
94ms Script
application/javascript 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://keqingmains.com/wp-content/plugins/ultimate-blocks/src/blocks/scrollby-polyfill.js?ver=2.5.6

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

82792dd2bb6b493c2aa5000dcbb067b18f06121d03f454e16a188a3e6e67276c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"8346824d78990c1b6fbb0689b9044210"
age: 3251
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=opZGj8Eiozus7PULLhwmuSB%2FrOqrHdgKMS0aBkXMc4mWxpq0SpClJoN9EAl9REgj6R%2FGpRlGaw0L9raaW%2BFWSnc8J7VbhyMYON0Fong28cwBJ9E76TpC6s0xO0p0%2BxKqrbc%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=2,i=?0
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cef9e9308ae-LAX
access-control-allow-origin: *
server: cloudflare

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.1.1/ 85 KB
30 KB 514ms
155ms Script
text/javascript 2607:f8b0:4006:821::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: gzip
age: 77481
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Thu, 18 Sep 2025 16:20:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 18 Sep 2024 16:20:06 GMT
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30244
x-xss-protection: 0
server: sffe

GET
H3 200 menu.min.js Show response
keqingmains.com/wp-content/themes/generatepress/assets/js/ 7 KB
2 KB 135ms
111ms Script
application/javascript 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://keqingmains.com/wp-content/themes/generatepress/assets/js/menu.min.js?ver=3.1.3

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

775a02c37772954d38fe41b802b94a0ee37dccb98a03827cdef3eddd2abc13d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/bennett/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"f4a0b3c8666683ede3d0ae94ab3c84de"
age: 2546
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lJqBzlhW82WyryG9YIxXRF%2BOKy7TuN%2BkQi%2FEvLnDWey9D0pHwHiElbUGr8eAUmbGjGqTXU26ITQtb9sVV%2Bx%2FhqtTkJNukt2ReK1wFGOLRQo01J%2BooIKl78d9mwrOCHVK4U4%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=2,i=?0
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c5a0cefbea808ae-LAX
access-control-allow-origin: *
server: cloudflare

GET
H3 200 translate-any-novel-with-webnovelsai.png
webnovelsai.com/wp-content/uploads/2024/06/ 14 KB
15 KB 208ms
92ms Image
image/png 172.67.172.77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://webnovelsai.com/wp-content/uploads/2024/06/translate-any-novel-with-webnovelsai.png
Requested by: Host: keqingmains.com
URL: https://keqingmains.com/bennett/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.172.77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 91d5e898e7717945e369fa992ef4ed50d2697c102d26bd8c0b0d5ccc6743923f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: max-age=315360000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: HIT
etag: W/"66702b3c-38a5"
age: 1190149
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2ngG5ei4pPJjlwG0DckrC49sfKy2fLxQe33sO4G6xJGk3GXXOqcLuim%2Feilb0KVXHMyhtYBjarCFmItSCMRtZbtCcG6vPumsx%2FcmrBlrZdYQOV2FgYmlGBIvkKtZf%2BwEAh8%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c5a0cf06acad7ac-LAX
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: image/png
last-modified: Mon, 17 Jun 2024 12:25:32 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 313ms
119ms Script
text/javascript 2606:4700::6810:5049
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: keqingmains.com
URL: https://keqingmains.com/bennett/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://keqingmains.com
Referer: https://keqingmains.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 8c5a0cf0e96d2b60-LAX
access-control-allow-origin: *
date: Thu, 19 Sep 2024 13:51:26 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 wrapper.html Show response
wrappers.geoedge.be/ 3 KB
4 KB 520ms
163ms Fetch
text/html 2600:9000:247b:e200:2:d490:4d80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://wrappers.geoedge.be/wrapper.html
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:247b:e200:2:d490:4d80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 68de9947c014ba26a1d48132dc5a94697f4c575972d2944da8e496f5780fd7b2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

x-amz-version-id: SIv.6LiuODikErkt8hGkZr.zJWI3NFp8
etag: "6a6d57dbabaa297544a761a67d32156f"
age: 58754
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: IZFSw1mBMRDmltK5yhK4MpAn-zWVTQ1cNch8HTcKpexgRJFSzPGHgA==
date: Wed, 18 Sep 2024 21:32:15 GMT
content-type: text/html
last-modified: Tue, 19 Dec 2023 13:15:23 GMT
via: 1.1 19f6dea8d52f4770f090ce0929599570.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3527
x-amz-cf-pop: JFK52-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 grumi.js Show response
rumcdn.geoedge.be/b0b01868-2045-4a3d-b8b0-db8e6cd0649d/ Frame B0A4 512 KB
163 KB 560ms
182ms Script
text/javascript 2600:9000:2511:6e00:4:b37b:9440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rumcdn.geoedge.be/b0b01868-2045-4a3d-b8b0-db8e6cd0649d/grumi.js
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2511:6e00:4:b37b:9440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5ce5f6f6af82674cd3c8f7f8640556d21112deb2718812dcace5ad1eb0cfcc7e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
x-amz-version-id: wIaMQYCWy9JhxgrWioJgAbILffUGktPk
etag: W/"54ece8ed8e3ae5d251dc1d086945b151"
age: 32
x-cache: Hit from cloudfront
x-amz-cf-id: pFNoMHLmoKzhvVf17DTEkr-jyiagF5SFhBezy9RfksEKY2ANrEuHGg==
date: Thu, 19 Sep 2024 13:50:57 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Thu, 19 Sep 2024 13:11:46 GMT
cache-control: public,max-age=3600,stale-while-revalidate=3600,immutable,must-revalidate
timing-allow-origin: *
via: 1.1 ae4e162eb9c0a598fcb6475e70daa530.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P6
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 tag Show response
btloader.com/ 104 KB
30 KB 274ms
92ms Script
application/javascript 2606:4700:10::ac43:293c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://btloader.com/tag?o=6278260873756672&upapi=true
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:293c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: af9747cbe0f1d8d87ea0347804376d6e3140c733d2e29ae08f11298d8b1d28ae

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "83ed3ab4ea39ef728f6969c96f014332"
age: 282
via: 1.1 google
cf-ray: 8c5a0cf87c6f7d5c-LAX
accept-ranges: bytes
content-length: 30266
date: Thu, 19 Sep 2024 13:51:28 GMT
content-type: application/javascript
last-modified: Thu, 19 Sep 2024 13:43:39 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 grumi-ip.js Show response
rumcdn.geoedge.be/b0b01868-2045-4a3d-b8b0-db8e6cd0649d/ 16 KB
6 KB 949ms
572ms Script
application/javascript 2600:9000:2511:6e00:4:b37b:9440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rumcdn.geoedge.be/b0b01868-2045-4a3d-b8b0-db8e6cd0649d/grumi-ip.js
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2511:6e00:4:b37b:9440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2c2dfe6e5ac215728c72b90926e35a22da1e6a5424094bb20d80bc78c5280f03

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=14400, stale-while-revalidate=14400, immutable
content-encoding: br
x-amz-version-id: LZuTdbyptmNU5g8kHGyQEzsXSshvu.pp
etag: W/"f2cb174a2a3ae8a763fd6c650b4ce0c5"
age: 31
via: 1.1 ae4e162eb9c0a598fcb6475e70daa530.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: KlTctEJKzUL7Kr2FUtdkLIdXLKsDITnTsrjdKNADfGCZFsd7o_oXOA==
date: Thu, 19 Sep 2024 13:50:58 GMT
content-type: application/javascript
last-modified: Tue, 10 Sep 2024 17:37:17 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P6
x-amz-server-side-encryption: AES256

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 106 KB
32 KB 555ms
244ms Script
text/javascript 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

cafe /

Resource Hash

de5efccfe2ee17b8c8b60f9c6aeb6345dce664faf30087618a7bdcab3d0f5bc1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: br
etag: 497 / 19985 / 31087261 / config-hash: 9432996471840705653
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 13:51:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 19 Sep 2024 13:51:28 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 32998
x-xss-protection: 0
server: cafe

GET
H3 200 gpp-df59d81.min.js Show response
s.nitropay.com/ 266 KB
50 KB 95ms
95ms Script
application/javascript 104.18.2.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://s.nitropay.com/gpp-df59d81.min.js

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.2.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

40d3155aba7594ec43e3a0fb10f6b0c922815701b09861664150bdd5d4311f95

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Type
x-goog-hash: crc32c=mjEkgA==, md5=DFGabn2jAJnhc0e0KNABNA==
cf-cache-status: HIT
etag: W/"0c519a6e7da30099e17347b428d00134"
age: 578113
content-encoding: gzip
x-goog-stored-content-encoding: identity
expires: Thu, 19 Sep 2024 21:08:47 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 272066
date: Thu, 19 Sep 2024 13:51:27 GMT
content-type: application/javascript
last-modified: Thu, 29 Aug 2024 21:07:44 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHxI1nPFR7Om69THnlDhXNyCvm2CwFC7N9tsJzlrBGbr9vj7NEtQwAOP8n_D6xwfLRq7CtgWTWM
strict-transport-security: max-age=2592000; includeSubDomains
cache-control: public, max-age=604800
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 8c5a0cf76df5cba4-LAX
access-control-allow-origin: *
x-goog-generation: 1724965664063706
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 324 KB
80 KB 517ms
184ms Script
application/javascript 108.138.115.149
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.115.149 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-115-149.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6fdb7c12792ebd6e785128456249178e9b508c9677a300df8fbc6e7520147baa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"907cbdd883935369790d45cc9bd9e8b7"
age: 3454
via: 1.1 613faec4b883bfe2ebdd8a74d5006f4c.cloudfront.net (CloudFront), 1.1 e7e95bff6b1d430c678b4f86ab211a1a.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: SR4QXXYutGTWwbUr4Yqo9XsOKSkKkjQzVz_lk--CBk6BzHAAhELj3Q==
date: Thu, 19 Sep 2024 12:53:55 GMT
content-type: application/javascript
last-modified: Wed, 28 Aug 2024 22:46:36 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-C3, JFK50-P3
x-amz-server-side-encryption: AES256

GET
H2 204 938
tracker.nitropay.com/a/ 0
0 325ms
134ms Fetch 35.244.144.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tracker.nitropay.com/a/938?d=eyJocmVmIjoiaHR0cHM6Ly9rZXFpbmdtYWlucy5jb20vYmVubmV0dC8iLCJ2Ijo1NywiYSI6ZmFsc2UsInMiOnRydWUsImMiOiJVUyIsInIiOiJDQSJ9
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.144.25 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 25.144.244.35.bc.googleusercontent.com
Software: nginx/1.27.0 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:28 GMT
server: nginx/1.27.0

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 463ms
142ms Preflight
text/plain 69.194.240.11
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 69.194.240.11 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://keqingmains.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://keqingmains.com
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Thu, 19 Sep 2024 13:51:07 GMT

POST
H2 204 64ad08781b504dd7d06be9f7 Show response
prebid.cootlogix.com/prebid/multi/ 0
1 KB 1075ms
724ms Fetch 147.182.176.100
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.cootlogix.com/prebid/multi/64ad08781b504dd7d06be9f7
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 147.182.176.100 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

access-control-allow-origin: https://keqingmains.com
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
content-length: 0
date: Thu, 19 Sep 2024 13:51:28 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control

GET
H2 200 trinity.json Show response
apex.go.sonobi.com/ 2 KB
3 KB 497ms
192ms Fetch
application/json 2607:f350:3:2569:0:10:0:a
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%225c84d0d1cfe401%22%3A%2273417d48500921b44e50%7C970x90%2C728x90%2C320x50%2C320x100%7Cf%3D0.1%2Cgpid%3D%2Fbennett%2F%23KQM-anchor%2Cc%3Dd%2C%22%7D&ref=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&s=bcd63c55-18b0-4112-baef-b70c41b9c535&pv=440b7c73-fdb8-4150-b4e1-1620c955ae80&vp=desktop&lib_name=prebid&lib_v=8.52.0&us=999&iqid=%7B%22pcid%22%3A%227a7b737c-13c7-4c71-9b97-705687a6ec44%22%2C%22pcidDate%22%3A1726753887924%7D&fpd=%7B%22source%22%3A%7B%22tid%22%3A%221e3fae82-38af-4846-ab13-9e59ce5eb07f%22%7D%2C%22site%22%3A%7B%22domain%22%3A%22keqingmains.com%22%2C%22publisher%22%3A%7B%22domain%22%3A%22keqingmains.com%22%7D%2C%22page%22%3A%22https%3A%2F%2Fkeqingmains.com%2Fbennett%2F%22%2C%22name%22%3A%22KQM%22%2C%22cattax%22%3A7%2C%22cat%22%3A%5B%22680%22%5D%2C%22privacypolicy%22%3A1%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%2C%22us_privacy%22%3A%221YNY%22%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%7D%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F129.0.0.0%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%2C%22sua%22%3A%7B%22source%22%3A1%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%7D%7D%7D&ius=1&gdpr=false&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22nitropay.com%22%2C%22sid%22%3A%22796%22%2C%22hp%22%3A1%7D%5D%7D&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22371f0943-a6dd-46b1-a413-621eb0fe45ed%22%2C%22atype%22%3A1%7D%5D%7D%5D&us_privacy=1YNY&coppa=0

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f350:3:2569:0:10:0:a , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

e8669d8011a8f4aacae9efbde86820503d379cfd80be7d62215e95e5b8f84fe9

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, private
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: https://keqingmains.com
content-length: 709
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 19 Sep 2024 13:51:28 GMT
tcn: Choice
content-type: application/json
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-94
x-xss-protection: 0

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
222 B 466ms
151ms Fetch 74.119.117.6
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=8.52.0&cb=56206332758&lsavail=1

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.6 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
observe-browsing-topics: ?1
access-control-allow-origin: https://keqingmains.com
date: Thu, 19 Sep 2024 13:51:28 GMT
vary: Origin
server: Kestrel

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 12 KB
6 KB 628ms
302ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17374&site_id=399242&zone_id=2233226&size_id=2&alt_size_ids=43%2C55%2C117&gdpr=0&us_privacy=1YNY&rp_schain=1.0,1!nitropay.com,796,1,,,&eid_pubcid.org=371f0943-a6dd-46b1-a413-621eb0fe45ed%5E1&rf=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&tg_i.domain=keqingmains.com&tg_i.page=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&tg_i.name=KQM&tg_i.cattax=7&tg_i.cat=680&tg_i.privacypolicy=1&tg_i.pbadslot=%2Fbennett%2F%23KQM-anchor&tk_flint=pbjs_lite_v8.52.0&x_source.tid=1e3fae82-38af-4846-ab13-9e59ce5eb07f&l_pb_bid_id=907ca9e8f300d5&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=f450983a-e5b6-4eef-a3eb-0d919751ddd4&rp_hard_floor=0.1&rp_maxbids=1&p_gpid=%2Fbennett%2F%23KQM-anchor&m_ch_mobile=%3F0&slots=1&rand=0.5767298162710444
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: fe6f601ea540a8ae0e4a32395893fec25b4e8168f282f608c342515ecb6e0317

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://keqingmains.com
date: Thu, 19 Sep 2024 13:51:28 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.21.4

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
386 B 320ms
110ms Fetch
text/plain 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 10499271384b842b53a4c882e1d86fb2bea33e97430928a0f9bcffcd5b7f17af

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

content-encoding: gzip
x-forwarded-for: 162.245.206.246
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
access-control-allow-origin: https://keqingmains.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Thu, 19 Sep 2024 13:51:27 GMT
content-type: text/plain
vary: Origin

POST
H2 200 auction Show response
tlx.3lift.com/header/ 12 KB
6 KB 637ms
281ms Fetch
application/json 3.218.122.15
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.52.0&referrer=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&tmax=1200&gdpr=false&us_privacy=1YNY

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.218.122.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-218-122-15.compute-1.amazonaws.com

Software

Resource Hash

643dd30ac55596b07a4817ae0b058d496b5d5fee5efff3532533d9072bbeef38

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: zstd
pragma: no-cache
accept-ch: sec-ch-ua-bitness,sec-ch-device-memory,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ect,sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform,sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list,sec-ch-downlink,sec-ch-viewport-width,sec-ch-ua-mobile,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua
access-control-allow-credentials: true
observe-browsing-topics: ?1
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://keqingmains.com
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
content-length: 5488
x-xss-protection: 0
content-type: application/json; charset=utf-8

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 25 KB
12 KB 497ms
324ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU87559X
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: 54f88341f4c5cef033edf9ac0484a99ac2095ccfd1c56314218f471af7c81c16

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
x-envoy-upstream-service-time: 139
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
expires: Thu, 19 Sep 2024 13:51:28 GMT
access-control-allow-origin: https://keqingmains.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:27 GMT
content-type: application/json;charset=utf-8
server: envoy

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 25 KB
15 KB 809ms
439ms Fetch
application/json 3.236.57.101
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.236.57.101 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-236-57-101.compute-1.amazonaws.com

Software

Resource Hash

79efcdb1426bb34dbca8312341780d42c7022a92ddac01e620c8d04e381f5914

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://keqingmains.com
content-encoding: gzip
content-length: 15108
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 unruly_prebid Show response
targeting.unrulymedia.com/ 11 B
277 B 550ms
272ms Fetch
application/json 69.194.240.11
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.unrulymedia.com/unruly_prebid

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

69.194.240.11 , United States, ASN26120 (RHYTHMONE, US),

Reverse DNS

Software

Resource Hash

846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer: https://keqingmains.com/

Response headers

strict-transport-security: max-age=63072000
cache-control: private, max-age=0, no-cache, no-store
pragma: no-cache
access-control-allow-credentials: true
observe-browsing-topics: ?1
access-control-allow-origin: https://keqingmains.com
alt-svc: h3=":443"; ma=900
content-length: 11
date: Thu, 19 Sep 2024 13:51:18 GMT
content-type: application/json

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 139 B
831 B 496ms
151ms Fetch
application/json 68.67.160.186
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.186 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

c6bfc83a5b0a4516d0356fd463bb9da45655d025378bb581049f85bc8fccf87e

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.246; 162.245.206.246; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://keqingmains.com
an-x-request-uuid: 1dfbbfea-a763-4944-b07b-3f4aaba55e3a
content-length: 139
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 19 Sep 2024 13:51:28 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 411ms
142ms Preflight
text/plain 69.194.240.11
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 69.194.240.11 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://keqingmains.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://keqingmains.com
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Thu, 19 Sep 2024 13:51:26 GMT

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 250 B
943 B 454ms
150ms Fetch
application/json 68.67.160.186
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.186 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

7df15191038a38f830e855233cab604891635f74541dd3680ab4abcf8442ad6e

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.246; 162.245.206.246; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://keqingmains.com
an-x-request-uuid: b3a4a356-841d-4926-bc49-a49d4032d6e4
content-length: 250
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 19 Sep 2024 13:51:28 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

GET
H2 200 trinity.json Show response
apex.go.sonobi.com/ 2 KB
3 KB 424ms
184ms Fetch
application/json 2607:f350:3:2569:0:10:0:a
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%22266d5767d3cf46f%22%3A%2273417d48500921b44e50%7C300x250%7Cf%3D0.1%2Cgpid%3D%2Fbennett%2F%23sidebar-right%2Cc%3Dd%2C%22%2C%22279f28fb692a586%22%3A%2203b4b3582d3dcb19e84c%7C300x250%7Cf%3D0.5%2Cgpid%3D%2Fbennett%2F%23sidebar-right%2Cc%3Dv%2Cpm%3D2%2Cp%3D2%2Cpl%3D4%2C%22%7D&ref=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&s=c02392ca-6292-48e1-879d-640d4d520804&pv=440b7c73-fdb8-4150-b4e1-1620c955ae80&vp=desktop&lib_name=prebid&lib_v=8.52.0&us=999&iqid=%7B%22pcid%22%3A%227a7b737c-13c7-4c71-9b97-705687a6ec44%22%2C%22pcidDate%22%3A1726753887924%7D&fpd=%7B%22source%22%3A%7B%22tid%22%3A%223620d86a-2fa7-434d-aa18-a081922c3e8f%22%7D%2C%22site%22%3A%7B%22domain%22%3A%22keqingmains.com%22%2C%22publisher%22%3A%7B%22domain%22%3A%22keqingmains.com%22%7D%2C%22page%22%3A%22https%3A%2F%2Fkeqingmains.com%2Fbennett%2F%22%2C%22name%22%3A%22KQM%22%2C%22cattax%22%3A7%2C%22cat%22%3A%5B%22680%22%5D%2C%22privacypolicy%22%3A1%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%2C%22us_privacy%22%3A%221YNY%22%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%7D%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F129.0.0.0%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%2C%22sua%22%3A%7B%22source%22%3A1%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%7D%7D%7D&ius=1&gdpr=false&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22nitropay.com%22%2C%22sid%22%3A%22796%22%2C%22hp%22%3A1%7D%5D%7D&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22371f0943-a6dd-46b1-a413-621eb0fe45ed%22%2C%22atype%22%3A1%7D%5D%7D%5D&us_privacy=1YNY&coppa=0

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f350:3:2569:0:10:0:a , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

1a9e851d1650a43f06e367984a24f4cb9cce7b2a13c039d6173f2cd12394fe6c

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, private
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: https://keqingmains.com
content-length: 728
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 19 Sep 2024 13:51:28 GMT
tcn: Choice
content-type: application/json
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-56
x-xss-protection: 0

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 12 KB
6 KB 558ms
291ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17374&site_id=399242&zone_id=2233226&size_id=15&gdpr=0&us_privacy=1YNY&rp_schain=1.0,1!nitropay.com,796,1,,,&eid_pubcid.org=371f0943-a6dd-46b1-a413-621eb0fe45ed%5E1&rf=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&tg_i.domain=keqingmains.com&tg_i.page=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&tg_i.name=KQM&tg_i.cattax=7&tg_i.cat=680&tg_i.privacypolicy=1&tg_i.pbadslot=%2Fbennett%2F%23sidebar-right&tk_flint=pbjs_lite_v8.52.0&x_source.tid=3620d86a-2fa7-434d-aa18-a081922c3e8f&l_pb_bid_id=29d69cc0438fbb5&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=15286372-f540-4bf9-bf8c-8ca36c976572&rp_hard_floor=0.1&rp_maxbids=1&p_gpid=%2Fbennett%2F%23sidebar-right&m_ch_mobile=%3F0&slots=1&rand=0.8910318324240141
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 27fa38db3d75c78ebcf4fde1e00421653b6550612d8be86ec461bb0893cfabca

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://keqingmains.com
date: Thu, 19 Sep 2024 13:51:28 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.21.4

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 25 KB
15 KB 594ms
273ms Fetch
application/json 3.236.57.101
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.236.57.101 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-236-57-101.compute-1.amazonaws.com

Software

Resource Hash

f05f6135a8445097c3aceff10a0195461582292b97c189919eb6905bacaa207a

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://keqingmains.com
content-encoding: gzip
content-length: 15132
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 6 KB
1 KB 760ms
439ms Fetch
application/json 3.236.57.101
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.236.57.101 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-236-57-101.compute-1.amazonaws.com

Software

Resource Hash

cb3f2fc5b6c442153535679f667a0e7b39f3ce5954f665b878899eda3f89504e

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://keqingmains.com
content-encoding: gzip
content-length: 1121
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 auction Show response
tlx.3lift.com/header/ 13 KB
7 KB 815ms
517ms Fetch
application/json 3.218.122.15
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.52.0&referrer=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&tmax=1200&gdpr=false&us_privacy=1YNY

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.218.122.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-218-122-15.compute-1.amazonaws.com

Software

Resource Hash

41fd18521ddf546cfeff37ae285c1a0dd24fe20f6d71f5b36e32a0124a40f99f

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: zstd
pragma: no-cache
accept-ch: sec-ch-viewport-width,sec-ch-ua-mobile,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness,sec-ch-device-memory,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ect,sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform,sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list,sec-ch-downlink
access-control-allow-credentials: true
observe-browsing-topics: ?1
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://keqingmains.com
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
content-length: 5734
x-xss-protection: 0
content-type: application/json; charset=utf-8

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
222 B 260ms
109ms Fetch
text/plain 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: c312f4359cd34b67c15308e9c5e80f61d4c42eedc6985936da168eb60a3cb6d4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

content-encoding: gzip
x-forwarded-for: 162.245.206.246
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
access-control-allow-origin: https://keqingmains.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Thu, 19 Sep 2024 13:51:27 GMT
content-type: text/plain
vary: Origin

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
222 B 265ms
114ms Fetch
text/plain 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 83e8554cb19f8fb449a742ddc017568b0a74e08d771498ff4088b0f4fb41c313

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

content-encoding: gzip
x-forwarded-for: 162.245.206.246
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
access-control-allow-origin: https://keqingmains.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Thu, 19 Sep 2024 13:51:28 GMT
content-type: text/plain
vary: Origin

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ 0
207 B 550ms
271ms Fetch 69.194.240.11
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.unrulymedia.com/unruly_prebid

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

69.194.240.11 , United States, ASN26120 (RHYTHMONE, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer: https://keqingmains.com/

Response headers

strict-transport-security: max-age=63072000
access-control-allow-origin: https://keqingmains.com
cache-control: private, max-age=0, no-cache, no-store
alt-svc: h3=":443"; ma=900
date: Thu, 19 Sep 2024 13:51:28 GMT
pragma: no-cache
access-control-allow-credentials: true

POST
H2 204 64ad08781b504dd7d06be9f7 Show response
prebid.cootlogix.com/prebid/multi/ 0
1 KB 765ms
489ms Fetch 147.182.176.100
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.cootlogix.com/prebid/multi/64ad08781b504dd7d06be9f7
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 147.182.176.100 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

access-control-allow-origin: https://keqingmains.com
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
content-length: 0
date: Thu, 19 Sep 2024 13:51:28 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 27 KB
11 KB 364ms
249ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU87559X
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: ad3782846773d9fd85e679f239814c72e43c994e6a521ddc516ac6aa859075f6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
x-envoy-upstream-service-time: 138
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
expires: Thu, 19 Sep 2024 13:51:28 GMT
access-control-allow-origin: https://keqingmains.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:27 GMT
content-type: application/json;charset=utf-8
server: envoy

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
221 B 549ms
304ms Fetch 74.119.117.6
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=8.52.0&cb=22320946450&lsavail=1

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.6 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
observe-browsing-topics: ?1
access-control-allow-origin: https://keqingmains.com
date: Thu, 19 Sep 2024 13:51:28 GMT
vary: Origin
server: Kestrel

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 376ms
142ms Preflight
text/plain 69.194.240.11
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 69.194.240.11 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://keqingmains.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://keqingmains.com
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Thu, 19 Sep 2024 13:51:15 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 12 KB
6 KB 525ms
292ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17374&site_id=399242&zone_id=2233226&size_id=2&alt_size_ids=55&gdpr=0&us_privacy=1YNY&rp_schain=1.0,1!nitropay.com,796,1,,,&eid_pubcid.org=371f0943-a6dd-46b1-a413-621eb0fe45ed%5E1&rf=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&tg_i.domain=keqingmains.com&tg_i.page=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&tg_i.name=KQM&tg_i.cattax=7&tg_i.cat=680&tg_i.privacypolicy=1&tg_i.pbadslot=%2Fbennett%2F%23post-header&tk_flint=pbjs_lite_v8.52.0&x_source.tid=4efa8660-0a84-413b-9218-40b525346e3f&l_pb_bid_id=5194972f181f91e&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=18109540-fbf1-4550-b53f-ff4067392f97&rp_hard_floor=0.1&rp_maxbids=1&p_gpid=%2Fbennett%2F%23post-header&m_ch_mobile=%3F0&slots=1&rand=0.9397307059524151
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 85128143a6ae724da3e9d71d3d276c3a3e79c347a5ee4745142faaaad35a6024

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://keqingmains.com
date: Thu, 19 Sep 2024 13:51:28 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.21.4

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
221 B 370ms
151ms Fetch 74.119.117.6
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=8.52.0&cb=40336159801&lsavail=1

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.6 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
observe-browsing-topics: ?1
access-control-allow-origin: https://keqingmains.com
date: Thu, 19 Sep 2024 13:51:27 GMT
vary: Origin
server: Kestrel

POST
H2 204 64ad08781b504dd7d06be9f7 Show response
prebid.cootlogix.com/prebid/multi/ 0
1 KB 606ms
364ms Fetch 147.182.176.100
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.cootlogix.com/prebid/multi/64ad08781b504dd7d06be9f7
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 147.182.176.100 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

access-control-allow-origin: https://keqingmains.com
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
content-length: 0
date: Thu, 19 Sep 2024 13:51:28 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 24 KB
12 KB 296ms
214ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU87559X
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: e73a9ebbfc1d2394c13d8a38721d66ae2ef42b6c5ad2206af949498809602bf1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
x-envoy-upstream-service-time: 106
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
expires: Thu, 19 Sep 2024 13:51:28 GMT
access-control-allow-origin: https://keqingmains.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:27 GMT
content-type: application/json;charset=utf-8
server: envoy

POST
H2 200 unruly_prebid Show response
targeting.unrulymedia.com/ 11 B
278 B 416ms
140ms Fetch
application/json 69.194.240.11
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.unrulymedia.com/unruly_prebid

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

69.194.240.11 , United States, ASN26120 (RHYTHMONE, US),

Reverse DNS

Software

Resource Hash

846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer: https://keqingmains.com/

Response headers

strict-transport-security: max-age=63072000
cache-control: private, max-age=0, no-cache, no-store
pragma: no-cache
access-control-allow-credentials: true
observe-browsing-topics: ?1
access-control-allow-origin: https://keqingmains.com
alt-svc: h3=":443"; ma=900
content-length: 11
date: Thu, 19 Sep 2024 13:51:23 GMT
content-type: application/json

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 17 KB
9 KB 750ms
471ms Fetch
application/json 3.236.57.101
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.236.57.101 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-236-57-101.compute-1.amazonaws.com

Software

Resource Hash

7098528b458dc31ac4a8ffa6166be0309fd2f36ad7ebec28ab2c60f222edb80b

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://keqingmains.com
content-encoding: gzip
content-length: 8593
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
222 B 299ms
187ms Fetch
text/plain 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: b9bb7345d06a9b8f756628804f59742eaa0bf760aca8581345f96f03d293d286

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

content-encoding: gzip
x-forwarded-for: 162.245.206.246
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
access-control-allow-origin: https://keqingmains.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Thu, 19 Sep 2024 13:51:28 GMT
content-type: text/plain
vary: Origin

GET
H2 200 trinity.json Show response
apex.go.sonobi.com/ 2 KB
3 KB 377ms
182ms Fetch
application/json 2607:f350:3:2569:0:10:0:a
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%2265b140eb47fd4b9%22%3A%2273417d48500921b44e50%7C970x90%2C728x90%7Cf%3D0.1%2Cgpid%3D%2Fbennett%2F%23post-header%2Cc%3Dd%2C%22%7D&ref=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&s=91c64fb9-7b53-466f-8a9c-5be279d4e865&pv=440b7c73-fdb8-4150-b4e1-1620c955ae80&vp=desktop&lib_name=prebid&lib_v=8.52.0&us=999&iqid=%7B%22pcid%22%3A%227a7b737c-13c7-4c71-9b97-705687a6ec44%22%2C%22pcidDate%22%3A1726753887924%7D&fpd=%7B%22source%22%3A%7B%22tid%22%3A%224efa8660-0a84-413b-9218-40b525346e3f%22%7D%2C%22site%22%3A%7B%22domain%22%3A%22keqingmains.com%22%2C%22publisher%22%3A%7B%22domain%22%3A%22keqingmains.com%22%7D%2C%22page%22%3A%22https%3A%2F%2Fkeqingmains.com%2Fbennett%2F%22%2C%22name%22%3A%22KQM%22%2C%22cattax%22%3A7%2C%22cat%22%3A%5B%22680%22%5D%2C%22privacypolicy%22%3A1%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%2C%22us_privacy%22%3A%221YNY%22%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%7D%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F129.0.0.0%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%2C%22sua%22%3A%7B%22source%22%3A1%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%7D%7D%7D&ius=1&gdpr=false&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22nitropay.com%22%2C%22sid%22%3A%22796%22%2C%22hp%22%3A1%7D%5D%7D&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22371f0943-a6dd-46b1-a413-621eb0fe45ed%22%2C%22atype%22%3A1%7D%5D%7D%5D&us_privacy=1YNY&coppa=0

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f350:3:2569:0:10:0:a , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

3b6ddc84f1a652048a754eb3ce26fa0513e8015c85b6ff00223fd9b7433c782e

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, private
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: https://keqingmains.com
content-length: 714
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 19 Sep 2024 13:51:28 GMT
tcn: Choice
content-type: application/json
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-6-211
x-xss-protection: 0

POST
H2 200 auction Show response
tlx.3lift.com/header/ 13 KB
6 KB 520ms
268ms Fetch
application/json 3.218.122.15
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.52.0&referrer=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&tmax=1200&gdpr=false&us_privacy=1YNY

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.218.122.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-218-122-15.compute-1.amazonaws.com

Software

Resource Hash

a655f0540cff07142a61f6aac327592d767f2e70a11cf7c9d031eb62d88aa7ac

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: zstd
pragma: no-cache
accept-ch: sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width
access-control-allow-credentials: true
observe-browsing-topics: ?1
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://keqingmains.com
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
content-length: 5558
x-xss-protection: 0
content-type: application/json; charset=utf-8

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 139 B
831 B 414ms
161ms Fetch
application/json 68.67.160.186
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.186 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

131e71a1bfc433990f6a43a5fa4da6a269a5faabd7c310db4356dd3be639d1ad

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.246; 162.245.206.246; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://keqingmains.com
an-x-request-uuid: 9aa885b0-e203-473f-873d-612e30e479f5
content-length: 139
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 19 Sep 2024 13:51:28 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

GET
H3 200 1.gif
s.nitropay.com/ 42 B
623 B 92ms
91ms Image
image/gif 104.18.2.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.nitropay.com/1.gif?x=1&adslot=

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.2.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

x-goog-metageneration: 3
access-control-expose-headers: Content-Type
x-goog-hash: crc32c=ljrbyA==, md5=2JdGiI2i2VELZKnwMers1Q==
cf-cache-status: HIT
etag: "d89746888da2d9510b64a9f031eaecd5"
age: 170487
x-goog-stored-content-encoding: identity
expires: Tue, 24 Sep 2024 14:30:01 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 42
date: Thu, 19 Sep 2024 13:51:28 GMT
x-goog-custom-time: 1970-01-01T00:00:00Z
content-type: image/gif
last-modified: Fri, 22 Jan 2021 08:58:45 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHxI1nOLXIFrH7YSOFnMKht2WQk4gVVbeF1HpcXVczXGCIhT21teSIlRuDp9a8tTtSDuVb5RPChjCWBz1A
strict-transport-security: max-age=2592000; includeSubDomains
cache-control: public, max-age=604800
x-goog-meta-
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 8c5a0cf88958cba4-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1611305925409947
content-length: 42
server: cloudflare

GET
H3 200 close2.svg
s.nitropay.com/assets/ 305 B
801 B 91ms
90ms Image
image/svg+xml 104.18.2.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.nitropay.com/assets/close2.svg

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.2.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

70d791d587d64a5694f37ce7927a71f38d4b8d7b0c643a51d6ceeb3d26201e30

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

x-goog-metageneration: 2
access-control-expose-headers: Content-Type
x-goog-hash: crc32c=tLOOxQ==, md5=yibkqTGrQ09HVJG8qwYTKw==
cf-cache-status: HIT
etag: W/"ca26e4a931ab434f475491bcab06132b"
age: 2589691
content-encoding: gzip
x-goog-stored-content-encoding: identity
expires: Fri, 19 Sep 2025 13:51:28 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 305
date: Thu, 19 Sep 2024 13:51:28 GMT
x-goog-custom-time: 1970-01-01T00:00:00Z
content-type: image/svg+xml
last-modified: Wed, 08 Dec 2021 23:38:47 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHxI1nOs_Rgkxt3f99Zjjh0sTEMREgsmCsppzU0orRNhsb9Z9rYDP7a5WQUznfLjw_iFIwUU5R1Sso9xiw
strict-transport-security: max-age=2592000; includeSubDomains
cache-control: public, max-age=31536000
x-goog-meta-
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 8c5a0cf8895acba4-LAX
access-control-allow-origin: *
x-goog-generation: 1639006727668923
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 199 KB
72 KB 192ms
189ms Script
application/javascript 2607:f8b0:4006:816::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-117136430-6&l=dataLayer&cx=c

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

797a9741ccc17299503578674e6e98c46fc60246337d1511b26b28b5f03af0bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: br
expires: Thu, 19 Sep 2024 13:51:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:28 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 19 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 73601
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 661ms
175ms Fetch
text/plain 2607:f8b0:4006:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VBESH40ETT&gtm=45je49h0v872289340za200&_p=1726753886601&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=0&cid=626411807.1726753888&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1726753888&sct=1&seg=0&dl=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&dt=Bennett%20Guide%3A%20Trial%20by%20Fire%20-%20KQM&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2638
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VBESH40ETT
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:817::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://keqingmains.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 19 Sep 2024 13:51:28 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 px.gif
ad-delivery.net/ 43 B
342 B 570ms
94ms Image
image/gif 2606:4700:20::ac43:4513
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: keqingmains.com
URL: https://keqingmains.com/bennett/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4513 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 2677908
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u%2FBsfruLIDcuAbVwjH7e07vE2VSxdkrpYaB4JtGAgG2JVAKkKNTIhkl4Ec5vpHfi6%2B4q1rsj%2FRQ96CPifdH%2BplHWHMadEjf%2FNXcrf6FL7Pe8Wb%2BiwwIYs7vso7RZkJxBe0jIVZUEoF9GY8frOw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Mon, 19 Aug 2024 14:49:02 GMT
x-goog-stored-content-length: 43
date: Thu, 19 Sep 2024 13:51:28 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: ABPtcPra9d8_1cAUA1puYgPaDlSF3jxVddoyAk-EtkXyHJkJZG-bxPqX7Ma8N1zwawfflvspzxc
cache-control: public, max-age=86400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 8c5a0cfcfbcb2ae1-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 637ms
166ms Image
image/x-icon 142.251.32.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.102 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: gzip
age: 77783
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 16:15:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 18 Sep 2024 16:15:05 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
914 B 566ms
94ms Image
image/gif 2606:4700:20::ac43:4513
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.886308051625931
Requested by: Host: keqingmains.com
URL: https://keqingmains.com/bennett/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4513 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 2677908
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4NNa6echGiIFNt6%2B3lrLRUfdbAZ5bjymF87Lpc1XGbUIsVKXaddVdd7Km4d8VjiCxX%2BdWVWDTVcxQH6xSVUKduYFc3RZvb1ybnKnNcl%2FEtgSsIKVgRtTP5mGyxqDOKP8XNsK5krBFu3KerWEbw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Mon, 19 Aug 2024 14:49:02 GMT
x-goog-stored-content-length: 43
date: Thu, 19 Sep 2024 13:51:28 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: ABPtcPra9d8_1cAUA1puYgPaDlSF3jxVddoyAk-EtkXyHJkJZG-bxPqX7Ma8N1zwawfflvspzxc
cache-control: public, max-age=86400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 8c5a0cfcfbcf2ae1-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 additional-consent-providers.csv Show response
consent.nitrocnct.com/ 116 KB
36 KB 544ms
105ms XHR
text/plain 172.67.193.156
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://consent.nitrocnct.com/additional-consent-providers.csv
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/gpp-df59d81.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.193.156 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 006b6d64d07be11c46ecbbff71b2a1a7ed3d408a26687241849ff1bc0d177015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

x-goog-metageneration: 4
access-control-expose-headers: Content-Length, Content-Type, Date, Origin, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=x8iKUw==, md5=gfloZ1I7fqSi8Fpiuf3xxw==
cf-cache-status: HIT
etag: W/"81f96867523b7ea4a2f05a62b9fdf1c7"
age: 232863
content-encoding: br
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DDtGTpjOExN%2BNWhRtwUyI2aOnpiEkTjslh4jSJD4SkuLWGdG8xJ0pQWYSDAoik6De26k0GDGmGoeU68h4Uv1LcDX8RQyk3hHZfR8ZHLsOCKcan9Gc4tvoJlvlbiqOy5jhngOVDbHIp8%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Mon, 23 Sep 2024 20:50:07 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 119221
date: Thu, 19 Sep 2024 13:51:28 GMT
content-type: text/plain
last-modified: Wed, 12 Jul 2023 07:31:30 GMT
vary: Accept-Encoding
x-guploader-uploadid: ABPtcPoz4RgdcEfA65B6lESx13IixyN8JUnoP0McS8XHP-gRk1aAX5BojTigX0WTgVy3nTczt-4
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: STANDARD
cf-ray: 8c5a0cfce8232eef-LAX
access-control-allow-origin: *
x-goog-generation: 1689147090287559
server: cloudflare

GET
H3

200

main.js Show response
keqingmains.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/ Frame F6D1
Redirect Chain

https://keqingmains.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://keqingmains.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js?

8 KB
4 KB

92ms
91ms

Script
application/javascript

172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://keqingmains.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js?

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b5fd639beacbe103ab8112ed843e493a92d40188bf126b497df761802c0f1406

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4dLxYDiMR%2FX%2FBX7I6f%2FvKboajAArKU1Mdm0lIuPwRu0Rjus1vlAFKmM5laUQkCBZV51KaHZR2JxTPRistj3jrRuY2btjC6vEwOiYvbCcryU8UbmDpbGGdhEfDhzRZQPoGts%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-ray: 8c5a0cfacc6a08ae-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:28 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

Redirect headers

cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js?
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UjhdRhE0btGKw5qiFAtxdvqWMXWnqasx0i7dB5esTbe1hE6jPmUdtuYEEU6HE03iXTBAC3UhcVwE5xpZ7DQape%2Ba%2Bss75sL%2FN4kGWa7tAV4vVIKecqLeEW2sf0cdd10TPK8%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c5a0cfa2bc408ae-LAX
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Thu, 19 Sep 2024 13:51:28 GMT
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H3

200

main.js Show response
keqingmains.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/ Frame 2BC0
Redirect Chain

https://keqingmains.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://keqingmains.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js?

8 KB
0

92ms
92ms

Script
application/javascript

172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://keqingmains.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js?

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Server

172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b5fd639beacbe103ab8112ed843e493a92d40188bf126b497df761802c0f1406

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4dLxYDiMR%2FX%2FBX7I6f%2FvKboajAArKU1Mdm0lIuPwRu0Rjus1vlAFKmM5laUQkCBZV51KaHZR2JxTPRistj3jrRuY2btjC6vEwOiYvbCcryU8UbmDpbGGdhEfDhzRZQPoGts%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-ray: 8c5a0cfacc6a08ae-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:51:28 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

Redirect headers

cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js?
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UjhdRhE0btGKw5qiFAtxdvqWMXWnqasx0i7dB5esTbe1hE6jPmUdtuYEEU6HE03iXTBAC3UhcVwE5xpZ7DQape%2Ba%2Bss75sL%2FN4kGWa7tAV4vVIKecqLeEW2sf0cdd10TPK8%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c5a0cfa2bc408ae-LAX
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Thu, 19 Sep 2024 13:51:28 GMT
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

POST
H3 200 8c5a0cec29f008ae Show response
keqingmains.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 2BC0 0
934 B 103ms
91ms XHR
text/plain 172.67.185.95
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://keqingmains.com/cdn-cgi/challenge-platform/h/g/jsd/r/8c5a0cec29f008ae
Requested by: Host: keqingmains.com
URL: https://keqingmains.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.185.95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ROopkZL8r3s5ZsVo0gsl2eBqqU8A8DISq5kVF0tD7YLXa2aEs%2BKqOrnhhVnZVoM7lCk90VyWPNcIW%2FEOsyod0SJqAvNcDn9YPqZhcGVJ7OnDOq8eZ2gb%2FrrOE%2FaCeFhK6sc%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c5a0cfd5f6608ae-LAX
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Thu, 19 Sep 2024 13:51:28 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare
priority: u=1,i

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409170101/ 479 KB
149 KB 159ms
159ms Script
text/javascript 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409170101/pubads_impl.js?cb=31087261

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

cafe /

Resource Hash

cb95a582de73802e636457f750ccc00545d657ed918d385cd95d32c60ee1ae56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: br
etag: 3697167613350629614
age: 862
x-content-type-options: nosniff
expires: Fri, 19 Sep 2025 13:37:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 19 Sep 2024 13:37:06 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 152556
x-xss-protection: 0
server: cafe

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 157ms
156ms Script
text/javascript 2607:f8b0:4006:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
content-encoding: gzip
age: 6324
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 14:06:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
date: Thu, 19 Sep 2024 12:06:04 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
server: Golfe2
vary: Accept-Encoding

GET
H2 200 da657530-03e5-4306-95bc-d4eb370426c9 Show response
config.aps.amazon-adsystem.com/configs/ 563 B
829 B 796ms
158ms Script
application/javascript 108.138.106.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/da657530-03e5-4306-95bc-d4eb370426c9
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.106.108 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-106-108.jfk50.r.cloudfront.net
Software: CloudFront /
Resource Hash: b7f6896554e5d137a0c1a3fcd424b4f7c3ef36c3cf642700f847c3204553c27c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: max-age=3600
age: 3145
via: 1.1 749177a97cae42477f22c33c927ca0ce.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: 5Mlm8NqTcMIQOUYBYVTZ8Z05NOakE6dxS1tm2Vd6jo62aGBA2Y6jpg==
date: Thu, 19 Sep 2024 12:59:04 GMT
content-type: application/javascript
x-amz-cf-pop: JFK50-P3
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 2 KB
3 KB 161ms
161ms XHR
application/json 108.138.115.149
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fkeqingmains.com&pubid=da657530-03e5-4306-95bc-d4eb370426c9
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.115.149 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-115-149.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 920b790d251ec18c573d8966f2699475b3ecf848fde4bb331d95d5be255b72f6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 8531
access-control-allow-credentials: true
via: 1.1 e7e95bff6b1d430c678b4f86ab211a1a.cloudfront.net (CloudFront)
access-control-allow-origin: https://keqingmains.com
x-cache: Hit from cloudfront
content-length: 2349
x-amz-cf-id: th0ELADhfn5Pm7tFTODe-4DUs66MkHTSoGEXcHVcMLSV2afpjghgQg==
date: Thu, 19 Sep 2024 11:29:18 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK50-P3
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 734 B
825 B 1092ms
418ms XHR
text/javascript 108.139.48.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&pid=JRvpSOiJviUEB&cb=0&ws=1600x1200&v=24.827.1552&t=1200&slots=%5B%7B%22sd%22%3A%22KQM-anchor%22%2C%22s%22%3A%5B%22970x90%22%2C%22728x90%22%2C%22320x50%22%2C%22320x100%22%5D%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A10%7D%5D&pj=%7B%22us_privacy%22%3A%221YNY%22%2C%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&schain=1.0%2C1%21nitropay.com%2C796%2C1%2C%2C%2C&gpp=DBABT%7E1YNY&gpp_sid=%5B6%5D&sm=9933ff3a-660e-4223-b1bf-31bbe8fe49aa&pubid=da657530-03e5-4306-95bc-d4eb370426c9&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.48.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-48-9.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 2ad138fffd1ef33e101aeb01bf6962787e069d7367f4bba45cd1eba4231a89ed

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 c3fb7b0c0d3cbd002fed2c3d958d111e.cloudfront.net (CloudFront)
access-control-allow-origin: https://keqingmains.com
x-cache: Miss from cloudfront
content-length: 492
x-amz-cf-id: aVOniquDkDTF7Bj5kNYZLaIKP0oAnXVGtMuKE6kNbVffSTzID706Dg==
date: Thu, 19 Sep 2024 13:51:29 GMT
content-type: text/javascript;charset=UTF-8
x-amz-cf-pop: JFK50-P1
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
374 B 841ms
177ms XHR
text/javascript 108.139.48.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&pid=JRvpSOiJviUEB&cb=1&ws=1600x1200&v=24.827.1552&t=1200&slots=%5B%7B%22sd%22%3A%22sidebar-right%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A50%7D%5D&pj=%7B%22us_privacy%22%3A%221YNY%22%2C%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&schain=1.0%2C1%21nitropay.com%2C796%2C1%2C%2C%2C&gpp=DBABT%7E1YNY&gpp_sid=%5B6%5D&sm=9933ff3a-660e-4223-b1bf-31bbe8fe49aa&pubid=da657530-03e5-4306-95bc-d4eb370426c9&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.48.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-48-9.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 c3fb7b0c0d3cbd002fed2c3d958d111e.cloudfront.net (CloudFront)
access-control-allow-origin: https://keqingmains.com
x-cache: Miss from cloudfront
content-length: 43
x-amz-cf-id: f0_OYAx5td8CTMSz8HgsGTmvR6HPSULX5Cc520JeFGr_HlNbSae2og==
date: Thu, 19 Sep 2024 13:51:29 GMT
content-type: text/javascript;charset=UTF-8
x-amz-cf-pop: JFK50-P1
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 253 B
544 B 936ms
294ms XHR
text/javascript 108.139.48.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&pid=JRvpSOiJviUEB&cb=2&ws=1600x1200&v=24.827.1552&t=1200&slots=%5B%7B%22sd%22%3A%22post-header%22%2C%22s%22%3A%5B%22970x90%22%2C%22728x90%22%5D%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A10%7D%5D&pj=%7B%22us_privacy%22%3A%221YNY%22%2C%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&schain=1.0%2C1%21nitropay.com%2C796%2C1%2C%2C%2C&gpp=DBABT%7E1YNY&gpp_sid=%5B6%5D&sm=9933ff3a-660e-4223-b1bf-31bbe8fe49aa&pubid=da657530-03e5-4306-95bc-d4eb370426c9&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.48.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-48-9.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 6cf2c7c16287156d8fee8aced6a750cdc7f73d02fca99d10992dc5d73a275bf2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 c3fb7b0c0d3cbd002fed2c3d958d111e.cloudfront.net (CloudFront)
access-control-allow-origin: https://keqingmains.com
x-cache: Miss from cloudfront
content-length: 214
x-amz-cf-id: 5xupoodcic8hmYK7GrohQ8ziy7ktWzepsLu7McptrDiMUrR_odkLNA==
date: Thu, 19 Sep 2024 13:51:29 GMT
content-type: text/javascript;charset=UTF-8
x-amz-cf-pop: JFK50-P1
server: Server

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 478ms
162ms XHR
application/javascript 108.138.115.149
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.115.149 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-115-149.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
age: 17096
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: ay1TablL4SbZinuveC0H9sRkWWUc8nyNodnzrLbwCZXuqmCvTIFpoA==
date: Thu, 19 Sep 2024 09:06:34 GMT
content-type: application/javascript
vary: Accept-Encoding,Origin
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 84fd743af5e8639c32332cec06beef46.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 country Show response
api.btloader.com/ 37 B
215 B 638ms
128ms Fetch
application/json 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/country?o=6278260873756672
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=6278260873756672&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: b8f0ca68362cf245f891fc09ddfa50806d195e78e196cf96ac5d9cf72be2577a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
date: Thu, 19 Sep 2024 13:51:29 GMT
content-type: application/json
vary: Origin

GET
H2 200 grumi.js Show response
rumcdn.geoedge.be/b0b01868-2045-4a3d-b8b0-db8e6cd0649d/ Frame 398E 512 KB
0 0ms
0ms Script
text/javascript 2600:9000:2511:6e00:4:b37b:9440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rumcdn.geoedge.be/b0b01868-2045-4a3d-b8b0-db8e6cd0649d/grumi.js
Requested by: Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b0b01868-2045-4a3d-b8b0-db8e6cd0649d/grumi-ip.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2511:6e00:4:b37b:9440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5ce5f6f6af82674cd3c8f7f8640556d21112deb2718812dcace5ad1eb0cfcc7e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
x-amz-version-id: wIaMQYCWy9JhxgrWioJgAbILffUGktPk
etag: W/"54ece8ed8e3ae5d251dc1d086945b151"
age: 32
x-cache: Hit from cloudfront
x-amz-cf-id: pFNoMHLmoKzhvVf17DTEkr-jyiagF5SFhBezy9RfksEKY2ANrEuHGg==
date: Thu, 19 Sep 2024 13:50:57 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Thu, 19 Sep 2024 13:11:46 GMT
cache-control: public,max-age=3600,stale-while-revalidate=3600,immutable,must-revalidate
timing-allow-origin: *
via: 1.1 ae4e162eb9c0a598fcb6475e70daa530.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P6
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 648ms
172ms Script
application/javascript 23.203.179.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.203.179.38 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-203-179-38.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Thu, 19 Sep 2024 14:06:29 GMT
accept-ranges: bytes
content-length: 17407
date: Thu, 19 Sep 2024 13:51:29 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 ima.js Show response
cdn-ima.33across.com/ 16 KB
6 KB 553ms
95ms Script
application/javascript 172.64.152.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ima.js
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.152.89 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 712369aef7db8ee613780ed94892762890345add2113c7749b2f03b819c0a4fc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66ce363e-403e"
age: 148091
cf-ray: 8c5a0d027ce508ab-LAX
expires: Sun, 22 Sep 2024 13:51:29 GMT
date: Thu, 19 Sep 2024 13:51:29 GMT
content-type: application/javascript
last-modified: Tue, 27 Aug 2024 20:25:34 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 56 KB
12 KB 564ms
108ms Script
application/javascript 2606:4700:10::6816:35ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&ref=&_it=amazon&partner_id=720
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:35ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 492db2ca577f4d221e3e28239c19e7db05f1701b298bf278fc4d1fcb92563586

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: public, max-age=432000
content-encoding: br
cf-bgj: minify
etag: W/"1e77f38a1df1490d4175e3c4878bd150"
age: 24
cf-cache-status: HIT
x-amz-request-id: 4GNMNHQXA94JVW78
expires: Tue, 24 Sep 2024 13:51:29 GMT
cf-ray: 8c5a0d027ef87ce0-LAX
date: Thu, 19 Sep 2024 13:51:29 GMT
content-type: application/javascript
last-modified: Tue, 04 Jun 2024 15:30:02 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-id-2: FNS8Lc8R9Qji432eQyZbGDDgvyWHvIXmOzDykwh9qe1J2fX8u6aO0aANuFN3vxu6aVi9rB6lRRQ=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 98 KB
29 KB 541ms
86ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

827eba33ff7f627627e79285ae329f7269998b7ca965f96f2c1ee59ce7116406

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"6f43174cf2798dcd024756859322fc73"
age: 9
expires: Thu, 19 Sep 2024 14:51:29 GMT
date: Thu, 19 Sep 2024 13:51:29 GMT
content-type: text/javascript;charset=utf-8
last-modified: Mon, 16 Sep 2024 11:24:35 GMT
vary: Accept-Encoding
x-amz-id-2: yW25rWzkbaV6B2510SrTPsJvSYx3WS7VOS7BfcuB2XRsKRWFStFA5WUi7kkminZO73w8mgj/IEM=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
x-amz-request-id: NWT00XA1G43VNHG1
cf-ray: 8c5a0d027f39cb7e-LAX
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 publishertag.prebid.144.js Show response
static.criteo.net/js/ld/ 96 KB
31 KB 761ms
312ms Script
text/javascript 2620:100:a00b::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.144.js

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

66776998b10e583a72f8fd29391a50e2c80eb3bc9a65b0dafe97e576d7d88507

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"653b5c0e-1811e"
cross-origin-resource-policy: cross-origin
expires: Fri, 20 Sep 2024 13:51:29 GMT
access-control-allow-origin: *
date: Thu, 19 Sep 2024 13:51:29 GMT
content-type: text/javascript
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx

GET
H2 204 pv Show response
api.btloader.com/ 0
66 B 574ms
131ms XHR
text/plain 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/pv?tid=a8MaI2Ssqf&w=5170814121934848&o=6278260873756672&cv=2.1.54-1-gd587dc3&widget=false&r=false&vr=1600x1200&pageURL=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&sid=f25AnkZg&pm=true&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=6278260873756672&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:29 GMT
vary: Origin

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
91 B 194ms
192ms XHR
text/plain 2607:f8b0:4006:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=666266199&t=pageview&_s=1&dl=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&ul=en-us&de=UTF-8&dt=Bennett%20Guide%3A%20Trial%20by%20Fire%20-%20KQM&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1253950367&gjid=741332610&cid=626411807.1726753888&tid=UA-117136430-6&_gid=685154630.1726753889&_r=1&gtm=457e49h0z8872289340za200zb872289340&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&jsscut=1&z=868887637

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://keqingmains.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
date: Thu, 19 Sep 2024 13:51:29 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 21726375739 Show response
fundingchoicesmessages.google.com/i/ 208 KB
69 KB 549ms
199ms Script
application/javascript 2607:f8b0:4006:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/21726375739?href=https%3A%2F%2Fkeqingmains.com%2Fbennett&ers=3

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fc91b779307ff79ddb447185bea7033ac4a6fe49ee48ec73ae3e40a578faf9a1

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-NQwI_VJjFv2FUkUS1_o8Dg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:29 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmJw1pBiOO90h-k6EEt8fcmkBcRO6TNYQ4C49eY51ulAnPTvPGsJELtrXWT1B-IlERdZjyReZDVUuMTqDMSORZdYPYH4_rpLrM-BeO_HS6xHgbhI4gprCxAL8XA8vLFhO5vAjnnPDzMraSTlF8Yn5-eVFGUmlZbkF6Ulp6UWpxaVpRbFGxkYmRhYGprrGZjGFxgAAFBjQg8"
content-security-policy: script-src 'report-sample' 'nonce-NQwI_VJjFv2FUkUS1_o8Dg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 125 B
282 B 104ms
103ms XHR
application/json 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=720&sync=0&domain=keqingmains.com&url=https://keqingmains.com/bennett/
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&ref=&_it=amazon&partner_id=720
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c54826e05a2f28188da1dc3f4c5d4e656246906e7e43c43f45632ba0d467c4e7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://keqingmains.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
debug: NON-OPTIONS
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
access-control-allow-credentials: true
cf-ray: 8c5a0d0648aa0cbb-LAX
access-control-allow-origin: *
date: Thu, 19 Sep 2024 13:51:30 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: authorization,content-type

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/ Frame F48A
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-LoopMe_n-adMediaV1_snb_n-acuityads_n-MediaNet_n-Beeswax_ox-db5_cnv_n-adman-v2_n-sharethrough_n-onetag_pm-db5_n-simpli.fi_ppt_n-baidu...
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-LoopMe_n-adMediaV1_snb_n-acuityads_n-MediaNet_n-Beeswax_ox-db5_cnv_n-adman-v2_n-sharethrough_n-onetag_pm-db5_n-simpli.fi_ppt_n-baidu...

0
0

183ms
183ms

Document
text/html

52.46.143.56
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-LoopMe_n-adMediaV1_snb_n-acuityads_n-MediaNet_n-Beeswax_ox-db5_cnv_n-adman-v2_n-sharethrough_n-onetag_pm-db5_n-simpli.fi_ppt_n-baidu_an-db5_3lift_n-Outbrain&dcc=t

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

52.46.143.56 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://keqingmains.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 423
Content-Type: text/html;charset=ISO-8859-1
Date: Thu, 19 Sep 2024 13:51:30 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: S6M9R7JT5GSVBAXTKZS3

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Thu, 19 Sep 2024 13:51:30 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-LoopMe_n-adMediaV1_snb_n-acuityads_n-MediaNet_n-Beeswax_ox-db5_cnv_n-adman-v2_n-sharethrough_n-onetag_pm-db5_n-simpli.fi_ppt_n-baidu_an-db5_3lift_n-Outbrain&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: QRWCV5SPBTYMH25047A8

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 330ms
104ms Preflight
application/json 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=720&sync=0&domain=keqingmains.com&url=https://keqingmains.com/bennett/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://keqingmains.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cf-cache-status: DYNAMIC
cf-ray: 8c5a0d05985b0cbb-LAX
content-length: 0
content-type: application/json
date: Thu, 19 Sep 2024 13:51:30 GMT
debug: OPTIONS block
server: cloudflare

GET
H2 200 AGSKWxX-OFIEdYE6fYhMvTW_bb9gy6gd-8d39Z4SRCZh7yP8t2k4YYSjBr5QCeNIGi8k84SLeREidf566LvlRjnqMegTkUuwNHFaeerwo2skeHVgFAaO0_fhZ0k72XUjtGrZlOedIbO0EA== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 211ms
197ms Script
application/javascript 2607:f8b0:4006:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxX-OFIEdYE6fYhMvTW_bb9gy6gd-8d39Z4SRCZh7yP8t2k4YYSjBr5QCeNIGi8k84SLeREidf566LvlRjnqMegTkUuwNHFaeerwo2skeHVgFAaO0_fhZ0k72XUjtGrZlOedIbO0EA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI2NzUzODkwLDM4NDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9rZXFpbmdtYWlucy5jb20vYmVubmV0dC8iLG51bGwsW1s4LCIyeDJRYVQwYVoxRSJdLFs5LCJlbi1VUyJdLFsyMCwiW251bGwsbnVsbCxbMzEwODQyNjldLG51bGwsMThdIl0sWzE5LCIyIl0sWzE3LCJbMF0iXV1d

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e44f89d8336281696075a1c36377e3949617f53f113c0cef667e5625671c4d87

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-5dSS7vk8uXjhl6pSo7W4gQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:30 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjytDikmJw05BiOO90h-k6EEt8fcmkBcRO6TNYQ4C49eY51ulAnPTvPGsJELtrXWT1B-IlERdZjyReZDVUuMTqDMSORZdYPYH4_rpLrM-BeO_HS6xHgbhI4gprCxAL8XA8urFhO5tAx8WuT4xKGkn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUXxRgZGJgaWhuZ6BqbxBQYASitB5g"
content-security-policy: script-src 'report-sample' 'nonce-5dSS7vk8uXjhl6pSo7W4gQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame 5ECF 0
0 478ms
152ms Document
text/html 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://keqingmains.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2980
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29981
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 19 Sep 2024 13:01:50 GMT
expires: Thu, 19 Sep 2024 13:51:50 GMT
last-modified: Mon, 16 Sep 2024 19:45:28 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 192ms
191ms Script
text/javascript 2620:100:a00b::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

5e8020e3d61bfee03a48ca66498521053b0bdcc1a3d8791250ac9bf0f768cbf2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"66d98e6d-a677"
cross-origin-resource-policy: cross-origin
expires: Fri, 20 Sep 2024 13:51:30 GMT
access-control-allow-origin: *
date: Thu, 19 Sep 2024 13:51:30 GMT
content-type: text/javascript
last-modified: Thu, 05 Sep 2024 10:56:45 GMT
server: nginx

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 43 KB
13 KB 530ms
171ms Script
text/javascript 108.138.128.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.28 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-28.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 30b32e97f2e3e06deb742bf2e19daeb4f4657a956e836c2a25a7df2bc72f7500

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7db46e1255a018ecf02f47b2c19c26c4"
age: 4078
via: 1.1 3155a44b32f22cf1d72a9a7b7439a6e2.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: fvKTEKk9ZLfk9-txYI2zqeOLraL1BwFTaBhqUymvo6uxhNxWM_SifQ==
date: Thu, 19 Sep 2024 12:43:33 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:40 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 293ms
83ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 310902
x-goog-stored-content-encoding: gzip
expires: Mon, 15 Sep 2025 23:29:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Sun, 15 Sep 2024 23:29:48 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AD-8ljt_bC4k7oJPcU76CYLG4LenFqS41scO6nu2SgdGFQFr9Ju41Jt0e4FnhwfaGMB6wiHA_xo
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 101ms
93ms Script
application/javascript 172.64.152.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.152.89 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a2ab36c83d5d55e311fbf787dbc7de0a17b89eb0b30b1772f518a79db334001

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66ce3644-43df"
age: 148092
cf-ray: 8c5a0d077aec08ab-LAX
expires: Sun, 22 Sep 2024 13:51:30 GMT
date: Thu, 19 Sep 2024 13:51:30 GMT
content-type: application/javascript
last-modified: Tue, 27 Aug 2024 20:25:40 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 59 KB
19 KB 565ms
564ms Fetch
text/plain 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3812880664913307&correlator=3541937051607424&eid=31085739%2C31087213%2C31087261%2C31084271&output=ldjh&gdfp_req=1&vrg=202409170101&ptt=17&impl=fif&gdpr=0&us_privacy=1YNY&gpp=GPP_ERROR_STRING_IS_DEPRECATED_SPEC&iu_parts=308365556%3A22656834653%2Cinterstitial&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=1&sfv=1-0-40&ists=1&fas=8&fsapi=1&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1726753890429&lmt=1726753890&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&td=1&egid=31650&tan=79af689e-8e55-488c-8912-fb2e940b04d3&tdf=2&topics=9&tps=9&htps=10&a3p=EhwKDWNyd2RjbnRybC5uZXQY7sC11KAySABSAghkEh0KDmVzcC5jcml0ZW8uY29tGO7AtdSgMkgAUgIIZBIUCgVvcGVueBjuwLXUoDJIAFICCGQSGwoMMzNhY3Jvc3MuY29tGO7AtdSgMkgAUgIIZA..&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1726753886276&idt=3049&adks=4129868805&frm=20&eoidce=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409170101/pubads_impl.js?cb=31087261

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

cafe /

Resource Hash

07dd1c3d2d338804448058545cf553151e2b63b099047067c7a7cc31b7b6b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: br
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 19 Sep 2024 13:51:30 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://keqingmains.com
content-length: 19707
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 35 KB
14 KB 566ms
564ms Fetch
text/plain 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3812880664913307&correlator=3052938351698202&eid=31085739%2C31087213%2C31087261%2C31084271&output=ldjh&gdfp_req=1&vrg=202409170101&ptt=17&impl=fif&gdpr=0&us_privacy=1YNY&gpp=GPP_ERROR_STRING_IS_DEPRECATED_SPEC&iu_parts=308365556%3A22656834653%2Cnadx&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C728x90%7C320x50%7C320x100&ifi=2&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1726753890444&lmt=1726753890&adxs=315&adys=1150&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&vis=1&psz=1600x26268&msz=1600x-1&fws=512&ohw=0&td=1&egid=31650&tan=79af689e-8e55-488c-8912-fb2e940b04d4&tdf=2&topics=9&tps=9&htps=10&a3p=EhwKDWNyd2RjbnRybC5uZXQY7sC11KAySABSAghkEh0KDmVzcC5jcml0ZW8uY29tGO7AtdSgMkgAUgIIZBIUCgVvcGVueBjuwLXUoDJIAFICCGQSGwoMMzNhY3Jvc3MuY29tGO7AtdSgMkgAUgIIZA..&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1726753886276&idt=3049&prev_scp=ncpm%3D0.70%26sticky%3Dhorizontal-bottom%26refresh%3D30%26domain%3Dkeqingmains.com%26hostname%3Dkeqingmains.com%26contax%3D680&cust_params=amznbid%3D1%26amznp%3D1&adks=1566598609&frm=20&eoidce=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409170101/pubads_impl.js?cb=31087261

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

cafe /

Resource Hash

5dd3cece395882a5141f104ebe5e1a7f56d9f6520a93661902c3efdf8e729d91

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: br
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 19 Sep 2024 13:51:30 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://keqingmains.com
content-length: 13966
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 753 B
360 B 567ms
566ms Fetch
text/plain 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3812880664913307&correlator=2942682589879512&eid=31085739%2C31087213%2C31087261%2C31084271&output=ldjh&gdfp_req=1&vrg=202409170101&ptt=17&impl=fif&gdpr=0&us_privacy=1YNY&gpp=GPP_ERROR_STRING_IS_DEPRECATED_SPEC&iu_parts=308365556%3A22656834653%2Cnadx&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=3&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1726753890452&lmt=1726753890&adxs=1288&adys=226&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&vis=1&psz=300x0&msz=300x0&fws=512&ohw=0&td=1&egid=31650&tan=79af689e-8e55-488c-8912-fb2e940b04d5&tdf=2&topics=9&tps=9&htps=10&a3p=EhwKDWNyd2RjbnRybC5uZXQY7sC11KAySABSAghkEh0KDmVzcC5jcml0ZW8uY29tGO7AtdSgMkgAUgIIZBIUCgVvcGVueBjuwLXUoDJIAFICCGQSGwoMMzNhY3Jvc3MuY29tGO7AtdSgMkgAUgIIZA..&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1726753886276&idt=3049&prev_scp=ncpm%3D1.40%26sticky%3Dvertical%26refresh%3D30%26domain%3Dkeqingmains.com%26hostname%3Dkeqingmains.com%26contax%3D680&cust_params=amznbid%3D1%26amznp%3D1&adks=3355819211&frm=20&eoidce=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409170101/pubads_impl.js?cb=31087261

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

cafe /

Resource Hash

04deb78d309b904f08c3edf766e6fcdb92a63002e4f04e522a1e67d678ef777a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 19 Sep 2024 13:51:30 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://keqingmains.com
content-length: 329
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 122 KB
48 KB 581ms
580ms Fetch
text/plain 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3812880664913307&correlator=2397276845598440&eid=31085739%2C31087213%2C31087261%2C31084271&output=ldjh&gdfp_req=1&vrg=202409170101&ptt=17&impl=fif&gdpr=0&us_privacy=1YNY&gpp=GPP_ERROR_STRING_IS_DEPRECATED_SPEC&iu_parts=308365556%3A22656834653%2Cnadx&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C728x90&ifi=4&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1726753890457&lmt=1726753890&adxs=152&adys=116&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&vis=1&psz=1320x90&msz=1296x90&fws=0&ohw=0&td=1&egid=31650&tan=79af689e-8e55-488c-8912-fb2e940b04d6&tdf=2&topics=9&tps=9&htps=10&a3p=EhwKDWNyd2RjbnRybC5uZXQY7sC11KAySABSAghkEh0KDmVzcC5jcml0ZW8uY29tGO7AtdSgMkgAUgIIZBIUCgVvcGVueBjuwLXUoDJIAFICCGQSGwoMMzNhY3Jvc3MuY29tGO7AtdSgMkgAUgIIZA..&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1726753886276&idt=3049&prev_scp=ncpm%3D0.35%26refresh%3D30%26domain%3Dkeqingmains.com%26hostname%3Dkeqingmains.com%26contax%3D680&cust_params=amznbid%3D1%26amznp%3D1&adks=2322580310&frm=20&eoidce=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409170101/pubads_impl.js?cb=31087261

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

cafe /

Resource Hash

6bac6349351916700c5ee69dfb78c175d71f026ead3b334f2477376e5f52db2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: br
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 19 Sep 2024 13:51:30 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://keqingmains.com
content-length: 49113
x-xss-protection: 0
server: cafe

GET
H2 200 container.html
1aad12c339679a5d9672af3b6cf77ea2.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C437 0
0 517ms
178ms Document
text/html 2607:f8b0:4006:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1aad12c339679a5d9672af3b6cf77ea2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://keqingmains.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 19 Sep 2024 13:51:30 GMT
expires: Thu, 19 Sep 2024 13:51:30 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409170101/ 48 KB
15 KB 157ms
157ms Script
text/javascript 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409170101/pubads_impl_page_level_ads.js?cb=31087261

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

cafe /

Resource Hash

5d6e63f307669cd8b20434020de5747fd61a8e481c266dc6891c6b86a75aad14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: br
etag: 16829459998856206082
age: 13525
x-content-type-options: nosniff
expires: Fri, 19 Sep 2025 10:06:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 19 Sep 2024 10:06:05 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 15487
x-xss-protection: 0
server: cafe

GET
H2 200 720 Show response
a.ad.gt/api/v1/u/matches/ 13 KB
4 KB 297ms
111ms Script
application/javascript 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/720?_it=amazon
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe1a55f7dc63bacfa1253a5a88233c62dc4d40965ca7f7835b827d1fe83c818

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 205
cross-origin-resource-policy: cross-origin
cf-ray: 8c5a0d090b4f14fe-LAX
date: Thu, 19 Sep 2024 13:51:30 GMT
content-type: application/javascript
last-modified: Thu, 19 Sep 2024 13:46:16 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 AGSKWxWNE8urA-8eEjS7ZWhfpV0ogAFZKJIRkXQa2YgdDxxpiuTSVYq3lAw5Kk-EPQwE5KfjNNdCdL7E_D_-iaPb6NP4LQ-WIc8Vi1vMhWB-JVOy1_4Krz-HjNiWp7Cl-yFKVzt-C4jX3A== Show response
fundingchoicesmessages.google.com/f/ 10 KB
5 KB 203ms
200ms Script
application/javascript 2607:f8b0:4006:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWNE8urA-8eEjS7ZWhfpV0ogAFZKJIRkXQa2YgdDxxpiuTSVYq3lAw5Kk-EPQwE5KfjNNdCdL7E_D_-iaPb6NP4LQ-WIc8Vi1vMhWB-JVOy1_4Krz-HjNiWp7Cl-yFKVzt-C4jX3A==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI2NzUzODkwLDYxMjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuLUdCIl0sImh0dHBzOi8va2VxaW5nbWFpbnMuY29tL2Jlbm5ldHQvIixudWxsLFtbOCwiMngyUWFUMGFaMUUiXSxbOSwiZW4tVVMiXSxbMjAsIltudWxsLG51bGwsWzMxMDg0MjY5XSxudWxsLDE4XSJdLFsxOSwiMiJdLFsxNywiWzBdIl1dXQ

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

704fd3569872b88068057bb5852f593dcade58ebcbd4aee0e303accae696056f

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-WIg-yGc07wHdo6aMNAjA4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:30 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjytDikmLw1pBiOO90h-k6EEt8fcmkBcRO6TNYQ4C49eY51ulAnPTvPGsJELtrXWT1B-IlERdZjyReZDVUuMTqDMSORZdYPYH4_rpLrM-BeO_HS6xHgbhI4gprCxAL8XA8urFhO5vAg-mzbzEpaSTlF8Yn5-eVFGUmlZbkF6Ulp6UWpxaVpRbFGxkYmRhYGprrGZjGFxgAAFH7QgM"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-WIg-yGc07wHdo6aMNAjA4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 720 Show response
p.ad.gt/api/v1/p/ 41 KB
15 KB 527ms
96ms Script
application/javascript 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://p.ad.gt/api/v1/p/720
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9c679277d6930c0935ebde6e9e465c41a60ab546d26cfd96cd656ff6f3c9af46

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 102
cf-ray: 8c5a0d0c9aec7bce-LAX
date: Thu, 19 Sep 2024 13:51:31 GMT
content-type: application/javascript
last-modified: Thu, 19 Sep 2024 13:47:02 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
144 B 712ms
280ms Image
image/gif 52.24.239.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&halo_id=060ixe7ju6a65hicigj8bhbjf8jdl7a9lieuom2wi0e0ysuiuqw4gsgwo4wk02e60
Requested by: Host: keqingmains.com
URL: https://keqingmains.com/bennett/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.24.239.47 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-24-239-47.us-west-2.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache
content-length: 43
date: Thu, 19 Sep 2024 13:51:31 GMT
content-type: image/gif
server: nginx/1.24.0

GET
H2 200 ip_match
ids.ad.gt/api/v1/ 0
192 B 710ms
279ms Image
text/html 52.24.239.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/ip_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ
Requested by: Host: keqingmains.com
URL: https://keqingmains.com/bennett/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.24.239.47 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-24-239-47.us-west-2.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-length: 0
date: Thu, 19 Sep 2024 13:51:31 GMT
content-type: text/html; charset=utf-8
server: nginx/1.24.0

GET
H2

200

match
ids.ad.gt/api/v1/
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&adnxs_id=$UID&gdpr=0
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fmatch%3Fid%3DAU1D-0100-001726753891-8JQZDW3T-E8HQ%26adnxs_id%3D%24UID%26gdpr%3D0
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&adnxs_id=4617267580394984253&gdpr=0

43 B
143 B

233ms
232ms

Image
image/gif

52.24.239.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&adnxs_id=4617267580394984253&gdpr=0
Requested by: Host: keqingmains.com
URL: https://keqingmains.com/bennett/
Protocol: H2
Server: 52.24.239.47 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-24-239-47.us-west-2.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache
content-length: 43
date: Thu, 19 Sep 2024 13:51:31 GMT
content-type: image/gif
server: nginx/1.24.0

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&adnxs_id=4617267580394984253&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.246; 162.245.206.246; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: d79734f1-16f4-492c-a31f-c6dc4ef6c4ec
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 19 Sep 2024 13:51:31 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

t_match
ids.ad.gt/api/v1/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001726753891-8JQZDW3T-E8HQ&gdpr=0
https://match.adsrvr.org/track/cmb/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001726753891-8JQZDW3T-E8HQ&gdpr=0
https://ids.ad.gt/api/v1/t_match?tdid=faef1d29-3001-4128-bb4e-24fa47627f12&id=AU1D-0100-001726753891-8JQZDW3T-E8HQ

43 B
143 B

124ms
110ms

Image
image/gif

52.24.239.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=faef1d29-3001-4128-bb4e-24fa47627f12&id=AU1D-0100-001726753891-8JQZDW3T-E8HQ
Requested by: Host: keqingmains.com
URL: https://keqingmains.com/bennett/
Protocol: H2
Server: 52.24.239.47 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-24-239-47.us-west-2.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache
content-length: 43
date: Thu, 19 Sep 2024 13:51:31 GMT
content-type: image/gif
server: nginx/1.24.0

Redirect headers

location: https://ids.ad.gt/api/v1/t_match?tdid=faef1d29-3001-4128-bb4e-24fa47627f12&id=AU1D-0100-001726753891-8JQZDW3T-E8HQ
content-length: 259
date: Thu, 19 Sep 2024 13:51:31 GMT
server: Kestrel

GET
H2

200

pbm_match
ids.ad.gt/api/v1/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001726753891-8JQZDW3T-E8HQ
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001726753891-8JQZDW3T-E8HQ
https://ids.ad.gt/api/v1/pbm_match?pbm=20210A7D-5EF3-4396-A986-E239010B967F&id=AU1D-0100-001726753891-8JQZDW3T-E8HQ

43 B
143 B

117ms
116ms

Image
image/gif

52.24.239.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/pbm_match?pbm=20210A7D-5EF3-4396-A986-E239010B967F&id=AU1D-0100-001726753891-8JQZDW3T-E8HQ
Requested by: Host: keqingmains.com
URL: https://keqingmains.com/bennett/
Protocol: H2
Server: 52.24.239.47 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-24-239-47.us-west-2.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache
content-length: 43
date: Thu, 19 Sep 2024 13:51:31 GMT
content-type: image/gif
server: nginx/1.24.0

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/pbm_match?pbm=20210A7D-5EF3-4396-A986-E239010B967F&id=AU1D-0100-001726753891-8JQZDW3T-E8HQ
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 19 Sep 2024 13:51:31 GMT
server: nginx

GET
H2

200

rub_match
ids.ad.gt/api/v1/
Redirect Chain

https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001726753891-8JQZDW3T-E8HQ&gdpr=0
https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&rub=M19COJF8-J-IFPX&gdpr=0

43 B
143 B

139ms
137ms

Image
image/gif

52.24.239.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&rub=M19COJF8-J-IFPX&gdpr=0
Requested by: Host: keqingmains.com
URL: https://keqingmains.com/bennett/
Protocol: H2
Server: 52.24.239.47 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-24-239-47.us-west-2.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache
content-length: 43
date: Thu, 19 Sep 2024 13:51:31 GMT
content-type: image/gif
server: nginx/1.24.0

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&rub=M19COJF8-J-IFPX&gdpr=0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 19c1ac3b9706c83a73951eba4d239689
Pragma: no-cache
content-length: 0

GET
H2

200

tapad_match
ids.ad.gt/api/v1/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001726753891...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001726...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=23edf488-1b8e-4b82-80fd-5fb45452619b%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fi...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=faef1d29-3001-4128-bb4e-24fa47627f12&ttd_puid=23edf488-1b8e-4b82-80fd-5fb45452619b%2Chttps%253A%252F%252Fids.ad.gt%252Fap...
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&tapad_id=23edf488-1b8e-4b82-80fd-5fb45452619b

43 B
143 B

114ms
113ms

Image
image/gif

52.24.239.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&tapad_id=23edf488-1b8e-4b82-80fd-5fb45452619b
Requested by: Host: keqingmains.com
URL: https://keqingmains.com/bennett/
Protocol: H2
Server: 52.24.239.47 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-24-239-47.us-west-2.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache
content-length: 43
date: Thu, 19 Sep 2024 13:51:32 GMT
content-type: image/gif
server: nginx/1.24.0

Redirect headers

strict-transport-security: max-age=31536000
location: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&tapad_id=23edf488-1b8e-4b82-80fd-5fb45452619b
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Thu, 19 Sep 2024 13:51:32 GMT
server: Jetty(11.0.13)

GET
H2

200

g_match
ids.ad.gt/api/v1/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001726753891-8JQZDW3T-E8HQ
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm=&google_sc=&google_ula=450542624&id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&google_tc=
https://ids.ad.gt/api/v1/g_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&google_error=15

43 B
143 B

114ms
109ms

Image
image/gif

52.24.239.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/g_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&google_error=15
Requested by: Host: keqingmains.com
URL: https://keqingmains.com/bennett/
Protocol: H2
Server: 52.24.239.47 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-24-239-47.us-west-2.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache
content-length: 43
date: Thu, 19 Sep 2024 13:51:31 GMT
content-type: image/gif
server: nginx/1.24.0

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ids.ad.gt/api/v1/g_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 289
date: Thu, 19 Sep 2024 13:51:31 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTcyNjc1Mzg5MS04SlFaRFczVC1FOEhR

170 B
243 B

204ms
187ms

Image
image/png

142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTcyNjc1Mzg5MS04SlFaRFczVC1FOEhR

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 19 Sep 2024 13:51:31 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTcyNjc1Mzg5MS04SlFaRFczVC1FOEhR
content-length: 453
date: Thu, 19 Sep 2024 13:51:31 GMT
content-type: text/html; charset=utf-8
server: nginx/1.24.0

GET
H2

200

son_match
ids.ad.gt/api/v1/
Redirect Chain

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&uid=[UID]&gdpr=0
https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&uid=9093df01-cc1f-4fb5-8dd0-325a815ec597&gdpr=0

43 B
143 B

113ms
113ms

Image
image/gif

52.24.239.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&uid=9093df01-cc1f-4fb5-8dd0-325a815ec597&gdpr=0
Requested by: Host: keqingmains.com
URL: https://keqingmains.com/bennett/
Protocol: H2
Server: 52.24.239.47 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-24-239-47.us-west-2.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache
content-length: 43
date: Thu, 19 Sep 2024 13:51:31 GMT
content-type: image/gif
server: nginx/1.24.0

Redirect headers

cache-control: no-cache, no-store, private
location: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&uid=9093df01-cc1f-4fb5-8dd0-325a815ec597&gdpr=0
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 19 Sep 2024 13:51:31 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-94
x-xss-protection: 0

GET
H3 400 ium
ssum-sec.casalemedia.com/ 0
506 B 305ms
124ms Image
text/plain 172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/ium?sourceid=15&uid=060ixe7ju6a65hicigj8bhbjf8jdl7a9lieuom2wi0e0ysuiuqw4gsgwo4wk02e60&gdpr=0
Requested by: Host: keqingmains.com
URL: https://keqingmains.com/bennett/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: max-age=0, no-cache, no-store
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I%2B6e4CefOWmrZeq5%2BEhq8vCQH2RFxG1qY0cP2mMOe%2BHc0xnz3gi2lwMjgGkg8gdZZjWEiJ93Jq2nxk3NiUbJS%2BY4xgqfw48D0RXfFHm8ownNor7KUhPeRkVzblJbt254OcaR6DFIQu%2FNLw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c5a0d0f89317ba4-LAX
expires: Thu, 19 Sep 2024 13:51:31 GMT
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Thu, 19 Sep 2024 13:51:31 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2

200

openx
ids.ad.gt/api/v1/
Redirect Chain

https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001726753891-8JQZDW3T-E8HQ%26auid%3DAU...
https://u.openx.net/w/1.0/cm?cc=1&id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001726753891-8JQZDW3T-E8HQ%26auid...
https://ids.ad.gt/api/v1/openx?openx_id=4c529cc1-ee4e-46c7-9287-6f3f19bf5391&id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&auid=AU1D-0100-001726753891-8JQZDW3T-E8HQ

43 B
143 B

124ms
124ms

Image
image/gif

52.24.239.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/openx?openx_id=4c529cc1-ee4e-46c7-9287-6f3f19bf5391&id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&auid=AU1D-0100-001726753891-8JQZDW3T-E8HQ
Requested by: Host: keqingmains.com
URL: https://keqingmains.com/bennett/
Protocol: H2
Server: 52.24.239.47 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-24-239-47.us-west-2.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache
content-length: 43
date: Thu, 19 Sep 2024 13:51:31 GMT
content-type: image/gif
server: nginx/1.24.0

Redirect headers

location: https://ids.ad.gt/api/v1/openx?openx_id=4c529cc1-ee4e-46c7-9287-6f3f19bf5391&id=AU1D-0100-001726753891-8JQZDW3T-E8HQ&auid=AU1D-0100-001726753891-8JQZDW3T-E8HQ
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="CUR ADM OUR NOR STA NID"
content-length: 0
date: Thu, 19 Sep 2024 13:51:31 GMT
content-type: image/gif
vary: Accept, Accept-Encoding
server: OXGW/0.0.0

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
533 B 589ms
171ms XHR
application/json 52.2.190.100
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.2.190.100 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-2-190-100.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 6bc9221042e80ff55ffb7c43cf4207aa35afcc9a9aec1d9675da3bd4a41dd4f8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://keqingmains.com
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 156
date: Thu, 19 Sep 2024 13:51:31 GMT
content-type: application/json;charset=utf-8
x-server: 10.40.4.67
server: Jetty(9.4.38.v20210224)

GET
H2 200 publishertag.prebid.144.js Show response
static.criteo.net/js/ld/ 96 KB
0 9ms
7ms XHR
text/javascript 2620:100:a00b::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.144.js
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.144.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 66776998b10e583a72f8fd29391a50e2c80eb3bc9a65b0dafe97e576d7d88507

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"653b5c0e-1811e"
cross-origin-resource-policy: cross-origin
expires: Fri, 20 Sep 2024 13:51:29 GMT
access-control-allow-origin: *
date: Thu, 19 Sep 2024 13:51:29 GMT
content-type: text/javascript
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx

GET
H2 200 container.html
1aad12c339679a5d9672af3b6cf77ea2.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 557D 0
0 7ms
7ms Document
text/html 2607:f8b0:4006:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1aad12c339679a5d9672af3b6cf77ea2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://keqingmains.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 19 Sep 2024 13:51:30 GMT
expires: Thu, 19 Sep 2024 13:51:30 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html
1aad12c339679a5d9672af3b6cf77ea2.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame B1E6 0
0 8ms
7ms Document
text/html 2607:f8b0:4006:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1aad12c339679a5d9672af3b6cf77ea2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://keqingmains.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 19 Sep 2024 13:51:30 GMT
expires: Thu, 19 Sep 2024 13:51:30 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 204 938
tracker.nitropay.com/i/ 0
0 137ms
135ms Fetch 35.244.144.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tracker.nitropay.com/i/938?d=eyJhdWYiOiJhbmNob3IiLCJhZFVuaXRDb2RlIjoiS1FNLWFuY2hvciIsImJpZGRlciI6ImFkeCIsImhlaWdodCI6OTAsIndpZHRoIjo3MjgsImNwbSI6MC43LCJjcmVhdGl2ZUlkIjoiIiwiaHJlZiI6Imh0dHBzOi8va2VxaW5nbWFpbnMuY29tL2Jlbm5ldHQvIiwidGltZVRvUmVzcG9uZCI6MjAwNCwiYWNjZXB0YWJsZSI6ZmFsc2UsInJlcXVlc3RJZCI6IjAxOTIwYThkLTU2YTItNzdjMS05NmZjLWM4MmMyM2ZkNjU4MCIsImMiOiJVUyIsInIiOiJDQSIsInR5cGUiOjAsImR1cmF0aW9uIjowLCJyZWZyZXNoIjpmYWxzZSwidGFyZ2V0aW5nIjp7ImNvbnRyb2wiOiJmYWxzZSJ9LCJ0aW1lc3RhbXAiOjE3MjY3NTM4OTE0MjIsImYiOiIxNm81eGN4IiwidiI6IjQxMGJhZmUifQ%3D%3D
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.144.25 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 25.144.244.35.bc.googleusercontent.com
Software: nginx/1.27.0 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:31 GMT
server: nginx/1.27.0

GET
H3 200 n.svg
s.nitropay.com/ 1 KB
1 KB 103ms
101ms Image
image/svg+xml 104.18.2.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.nitropay.com/n.svg

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.2.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2c42391fc43043ff71e168a5b881e9ed95bd1e18480f8d2dc5dc77e9624f7797

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Type
x-goog-hash: crc32c=Tm86FQ==, md5=R85XyhysX5VF8eL7nGvZDQ==
cf-cache-status: HIT
etag: W/"47ce57ca1cac5f9545f1e2fb9c6bd90d"
age: 2211
content-encoding: gzip
x-goog-stored-content-encoding: identity
expires: Thu, 19 Sep 2024 14:04:58 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 1437
date: Thu, 19 Sep 2024 13:51:31 GMT
content-type: image/svg+xml
last-modified: Wed, 05 Oct 2022 06:19:07 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHxI1nPQTzc9mr72kggfGVzjLDGa4SFViM3Hgq6_ctwMsAWxtd1ABOHExKRTe3NpJ7-27S1sU6WoLe2JWw
strict-transport-security: max-age=2592000; includeSubDomains
cache-control: public, max-age=3600
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 8c5a0d0dc9efcba4-LAX
access-control-allow-origin: *
x-goog-generation: 1664950747723912
server: cloudflare

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 422 KB
145 KB 566ms
205ms Script
text/javascript 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54324bcceff03dbc7a1482a4589a321dc190a1419ef190553b8351d7c7648716

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: private, max-age=900, stale-while-revalidate=3600
content-encoding: gzip
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 13:51:32 GMT
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 147748
date: Thu, 19 Sep 2024 13:51:32 GMT
x-xss-protection: 0
content-type: text/javascript
vary: Accept-Encoding
server: sffe

GET
H2 200 container.html
1aad12c339679a5d9672af3b6cf77ea2.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 0A98 0
0 12ms
12ms Document
text/html 2607:f8b0:4006:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1aad12c339679a5d9672af3b6cf77ea2.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://keqingmains.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 19 Sep 2024 13:51:30 GMT
expires: Thu, 19 Sep 2024 13:51:30 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 204 938
tracker.nitropay.com/i/ 0
0 135ms
134ms Fetch 35.244.144.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tracker.nitropay.com/i/938?d=eyJhdWYiOiJkaXNwbGF5IiwiYWRVbml0Q29kZSI6InBvc3QtaGVhZGVyIiwiYmlkZGVyIjoiYWR4IiwiaGVpZ2h0Ijo5MCwid2lkdGgiOjcyOCwiY3BtIjowLjM1LCJjcmVhdGl2ZUlkIjoiIiwiaHJlZiI6Imh0dHBzOi8va2VxaW5nbWFpbnMuY29tL2Jlbm5ldHQvIiwidGltZVRvUmVzcG9uZCI6MjA4OCwiYWNjZXB0YWJsZSI6ZmFsc2UsInJlcXVlc3RJZCI6IjAxOTIwYThkLTU3MTItN2IyYS1iNjVhLWNiNjFkNGE1MGQwNyIsImMiOiJVUyIsInIiOiJDQSIsInR5cGUiOjAsImR1cmF0aW9uIjowLCJyZWZyZXNoIjpmYWxzZSwidGFyZ2V0aW5nIjp7ImNvbnRyb2wiOiJmYWxzZSJ9LCJ0aW1lc3RhbXAiOjE3MjY3NTM4OTE1MTAsImYiOiIxNm81eGN4IiwidiI6IjQxMGJhZmUifQ%3D%3D
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.144.25 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 25.144.244.35.bc.googleusercontent.com
Software: nginx/1.27.0 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:31 GMT
server: nginx/1.27.0

GET
H3 200 ecommerce.js Show response
www.google-analytics.com/plugins/ua/ 1 KB
655 B 162ms
162ms Script
text/javascript 142.250.81.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ecommerce.js

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s74-in-f14.1e100.net

Software

sffe /

Resource Hash

8e1b84265e633c043720dd0921476c16bc9f75e393e855c9116ca7c3a847b5c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: br
age: 1675
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 14:23:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:23:36 GMT
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
content-length: 630
x-xss-protection: 0
server: sffe

GET
H3 200 ec.js Show response
www.google-analytics.com/plugins/ua/ 3 KB
1 KB 162ms
162ms Script
text/javascript 142.250.81.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ec.js

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s74-in-f14.1e100.net

Software

sffe /

Resource Hash

058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: br
age: 1675
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 14:23:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:23:36 GMT
last-modified: Tue, 27 Jun 2023 17:28:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
content-length: 1129
x-xss-protection: 0
server: sffe

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 256 KB
90 KB 187ms
186ms Script
application/javascript 142.250.65.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.200 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

7d8ac8a409f34c22d8c7196a121bb9954eda8fea5a4e83c752da71a3b6d53959

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Thu, 19 Sep 2024 13:51:31 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 92187
date: Thu, 19 Sep 2024 13:51:31 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

POST
H2 204 collect Show response
a.ad.gt/api/v1/ 0
116 B 137ms
135ms XHR
text/plain 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/720
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: text/plain
Referer: https://keqingmains.com/

Response headers

cf-ray: 8c5a0d0ef93214fe-LAX
access-control-allow-origin: https://keqingmains.com
cf-cache-status: DYNAMIC
date: Thu, 19 Sep 2024 13:51:31 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ 0
88 B 341ms
134ms Script
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=0aaf5c5e811d5943dc93389f0991d2fe&url=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F&code=%27none%27
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cf-ray: 8c5a0d106bea0fc6-LAX
cf-cache-status: DYNAMIC
date: Thu, 19 Sep 2024 13:51:31 GMT
server: cloudflare

POST
H2 200 match Show response
seg.ad.gt/api/v2/ 2 KB
317 B 138ms
133ms XHR
application/json 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/720
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2af0638dacb90122dacc1de00a1229bdc109157c3bceed6aecc1ca3516668b22

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://keqingmains.com/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
cf-ray: 8c5a0d11ac20317f-LAX
access-control-allow-origin: *
date: Thu, 19 Sep 2024 13:51:32 GMT
content-type: application/json
vary: origin, access-control-request-method, access-control-request-headers, accept-encoding
server: cloudflare

GET
H2 200 segments Show response
seg.ad.gt/api/v1/ 16 B
136 B 434ms
211ms XHR
application/json 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://seg.ad.gt/api/v1/segments?url=https%253A%252F%252Fkeqingmains.com%252Fbennett%252F&partner_id=720&tagger_id=0aaf5c5e811d5943dc93389f0991d2fe&au_id=AU1D-0100-001726753891-8JQZDW3T-E8HQ
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/720
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33c70c297b1a729f965a6aca60b7b3bb7a3b06bd13efe07698516fa98ac8b9f9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cf-cache-status: DYNAMIC
access-control-allow-credentials: true
cf-ray: 8c5a0d105b0b317f-LAX
access-control-allow-origin: https://keqingmains.com
content-length: 16
date: Thu, 19 Sep 2024 13:51:31 GMT
content-type: application/json
vary: Origin
server: cloudflare

GET
H3 200 ads12._adhere. Show response
fundingchoicesmessages.google.com/f/AGSKWxUFpqbw14rjw6FpCTUZ3OOPzzqvwKfSwmFCsW5K2_jNFlIUWk25yiisFBrk5jZDe5jWOeBFGBTNvsN1S7GhM-Oz2Fbz7VDw4Ke7QiRM-Z1zSJ41kbOjQmfqfgbBpNboc1goFaL1AcK1RrWpKfGL9B4wCYvDT... 54 B
109 B 190ms
189ms Script
application/javascript 142.250.65.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUFpqbw14rjw6FpCTUZ3OOPzzqvwKfSwmFCsW5K2_jNFlIUWk25yiisFBrk5jZDe5jWOeBFGBTNvsN1S7GhM-Oz2Fbz7VDw4Ke7QiRM-Z1zSJ41kbOjQmfqfgbBpNboc1goFaL1AcK1RrWpKfGL9B4wCYvDT7wNAAFGk3CcWjTM5cNiasdTU0RDM0Kj/_/home30/ad./adv_left_/include/adsdaq/ads12._adhere.

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f14.1e100.net

Software

ESF /

Resource Hash

cdc6c80bf9b1bf05d0cf3fbfb7f5b18c960307471af6190eb1b68a76f7cdec29

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-fCuAwMJslkOqltLcJYD_iw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:31 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjKtDikmLw1ZBiOHHrNtMFID7vdIfpOhBLfH3JpAXETukzWEOAuPXmOdbpQJz07zxrCRC7a11k9QfiJREXWY8kXmQ1VLjE6gzEjkWXWD2B-P66S6zPgXjvx0usR4G4SOIKawsQC_FwPL6xYTubwIOG88-ZlDSS8gvjk_PzSooyk0pL8ovSktNSi1OLylKL4o0MjEwMLA3N9QxM4wsMAH8TRz4"
content-security-policy: script-src 'report-sample' 'nonce-fCuAwMJslkOqltLcJYD_iw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 151 KB
51 KB 589ms
264ms Script
text/javascript 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?fcd=true

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.194 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f2.1e100.net

Software

cafe /

Resource Hash

c128e825ece6acdfbca49f0d30dce72d74abe639dd4e9f27cdd213390c5a6125

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: br
etag: 3193398192911463225
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 13:51:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 19 Sep 2024 13:51:32 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 52326
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxX94GG2kPfDuIBAILok9YLqW57XiIoCNUMOuWWzEYq-5RDAw4-umeAXz2diifIdfQJSEO5lrk1l-Hmb3Qjzsb7DK-udS03ggTbt7LqnTI2DAdEzN4jD_sKIcp4h-5ptBycDUElxmA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 500ms
181ms XHR
text/html 142.250.65.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX94GG2kPfDuIBAILok9YLqW57XiIoCNUMOuWWzEYq-5RDAw4-umeAXz2diifIdfQJSEO5lrk1l-Hmb3Qjzsb7DK-udS03ggTbt7LqnTI2DAdEzN4jD_sKIcp4h-5ptBycDUElxmA==

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.2x2QaT0aZ1E.es5.O/am=KBg/d=1/rs=AJlcJMy0RcWTkxVC6x08keM0vqn9Bxyrbg/m=kernel_loader,loader_js_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-qbcs0V-BuuX5UcvXgh-VtQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://keqingmains.com/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:32 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmLw05BicEqfwRoExO5aF1n9gXhJxEXWQ4kXWfd-vMR6FIiFuDme3NiwnU3gw7FJikouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDIxMDS0FzPwCy-wAAARCwuDA"
content-security-policy: script-src 'report-sample' 'nonce-qbcs0V-BuuX5UcvXgh-VtQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://keqingmains.com
content-length: 0
x-xss-protection: 0
server: ESF

OPTIONS
H2 200 match
seg.ad.gt/api/v2/ Frame 0
0 430ms
207ms Preflight 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://keqingmains.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
allow: POST
cf-cache-status: DYNAMIC
cf-ray: 8c5a0d105b08317f-LAX
date: Thu, 19 Sep 2024 13:51:31 GMT
server: cloudflare
vary: origin, access-control-request-method, access-control-request-headers

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX94GG2kPfDuIBAILok9YLqW57XiIoCNUMOuWWzEYq-5RDAw4-umeAXz2diifIdfQJSEO5lrk1l-Hmb3Qjzsb7DK-udS03ggTbt7LqnTI2DAdEzN4jD_sKIcp4h-5ptBycDUElxmA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Ipsntn_-j_VpBeUZJ7dT2w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://keqingmains.com/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:32 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmLw0pBicEqfwRoExO5aF1n9gXhJxEXWQ4kXWfd-vMR6FIiFuDme3NiwnU3gwpbn8kouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDIxMDS0FzPwCy-wAAAS0guKQ"
content-security-policy: script-src 'report-sample' 'nonce-Ipsntn_-j_VpBeUZJ7dT2w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://keqingmains.com
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 rid Show response
match.adsrvr.org/track/ 108 B
702 B 145ms
138ms Fetch
application/json 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=aqo03op&fmt=json
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: b9a8d9e205370f19c771173e024c2eb4850d7f596d14796d6010bf9db0f792e5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://keqingmains.com/

Response headers

cache-control: private
content-encoding: gzip
access-control-allow-credentials: true
expires: Sat, 19 Oct 2024 13:51:32 GMT
access-control-allow-origin: https://keqingmains.com
date: Thu, 19 Sep 2024 13:51:32 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept

GET
H2 200 join-ad-interest-groups.html
proton.ad.gt/ Frame 6311 0
0 289ms
97ms Document
text/html 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://proton.ad.gt/join-ad-interest-groups.html
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://keqingmains.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
ad-auction-allowed: true
age: 2727
apigw-requestid: eWfiViakvHcEJUw=
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 8c5a0d13ee2d3155-LAX
content-encoding: br
content-type: text/html
date: Thu, 19 Sep 2024 13:51:32 GMT
last-modified: Thu, 19 Sep 2024 12:02:35 GMT
server: cloudflare
supports-loading-mode: fenced-frame
vary: Accept-Encoding

POST
H2 204 log
api.btloader.com/ 0
0 136ms
127ms Fetch 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/log?tid=a8MaI2Ssqf&cv=2.1.54-1-gd587dc3&sid=f25AnkZg&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=6278260873756672&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
x-ratelimit-reset: 1726753893
via: 1.1 google
x-ratelimit-remaining: 4101
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:32 GMT
x-ratelimit-limit: 5000
vary: Origin

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX94GG2kPfDuIBAILok9YLqW57XiIoCNUMOuWWzEYq-5RDAw4-umeAXz2diifIdfQJSEO5lrk1l-Hmb3Qjzsb7DK-udS03ggTbt7LqnTI2DAdEzN4jD_sKIcp4h-5ptBycDUElxmA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-4UwTgw9iykmk6Eud2f92sg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://keqingmains.com/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:32 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmLw0JBicEqfwRoExO5aF1n9gXhJxEXWQ4kXWfd-vMR6FIiFeDie3NiwnU1gRu_ri0xKLkn5hfHJ-XklqXkluokpxbogdlFmUmlJfhEKO7UMpCInPz09My893sjAyMTA0tBcz8AsvsAAAHfDLoE"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-4UwTgw9iykmk6Eud2f92sg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://keqingmains.com
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX94GG2kPfDuIBAILok9YLqW57XiIoCNUMOuWWzEYq-5RDAw4-umeAXz2diifIdfQJSEO5lrk1l-Hmb3Qjzsb7DK-udS03ggTbt7LqnTI2DAdEzN4jD_sKIcp4h-5ptBycDUElxmA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-6cRaK8Eu_K1maqyxORPSog' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://keqingmains.com/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:32 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmJw0JBicEqfwRoExO5aF1n9gXhJxEXWQ4kXWfd-vMR6FIiFeDie3NiwnU2goXffZSYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGJgaWiuZ2AWX2AAAGC2LjY"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-6cRaK8Eu_K1maqyxORPSog' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://keqingmains.com
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxUzeXwoM_l0CfJCnkFkcMO7riZy2qMfAUKv7KxvaHIWLZYqfFF_D_VVwVyXvzhuH5A8ayvqT3skCqhI-Pz6CijnwgoTg7wqpCqJh2yLR5VdAb0EEl2c81F_28JcV0sUKyAGTQcHSg== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 292ms
200ms Script
application/javascript 142.250.65.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUzeXwoM_l0CfJCnkFkcMO7riZy2qMfAUKv7KxvaHIWLZYqfFF_D_VVwVyXvzhuH5A8ayvqT3skCqhI-Pz6CijnwgoTg7wqpCqJh2yLR5VdAb0EEl2c81F_28JcV0sUKyAGTQcHSg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI2NzUzODkyLDUxOTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4tR0IiLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9rZXFpbmdtYWlucy5jb20vYmVubmV0dC8iLG51bGwsW1s4LCIyeDJRYVQwYVoxRSJdLFs5LCJlbi1VUyJdLFsyMCwiW251bGwsbnVsbCxbMzEwODQyNjldLG51bGwsMThdIl0sWzE5LCIyIl0sWzE3LCJbMF0iXV1d

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f14.1e100.net

Software

ESF /

Resource Hash

264858c82f3cb01d2a0b54831074538e1134cd3c3080fd64404d6ec6c335757e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-CGZoROqFbqxpv8VEviKSSQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:32 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjytHikmLw0pBiUAzbyXTe6Q7TdSCW-PqSSQuIndJnsIYAcevNc6zTgTjp33nWEiB217rI6g_ESyIush5JvMhqqHCJ1RmIHYsusXoC8f11l1ifA_Hej5dYjwJxkcQV1hYgFuLheHJjw3Y2gQ8Xlt5kUtJIyi-MT87PKynKTCotyS9KS05LLU4tKkstijcyMDIxsDQ01zMwjS8wAAAhDkOM"
content-security-policy: script-src 'report-sample' 'nonce-CGZoROqFbqxpv8VEviKSSQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H2 204 event Show response
p.ad.gt/api/v1/ 0
34 B 146ms
144ms XHR
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/720
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://keqingmains.com/

Response headers

cf-ray: 8c5a0d168ef82f5d-LAX
access-control-allow-origin: https://keqingmains.com
cf-cache-status: DYNAMIC
date: Thu, 19 Sep 2024 13:51:32 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

POST
H3 204 938
tracker.nitropay.com/i/ 0
10 B 232ms
139ms Ping
text/plain 35.244.144.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tracker.nitropay.com/i/938?d=eyJhdWYiOiJhbmNob3IiLCJhZFVuaXRDb2RlIjoiS1FNLWFuY2hvciIsImJpZGRlciI6ImFkeCIsImhlaWdodCI6OTAsIndpZHRoIjo3MjgsImNwbSI6MC43LCJjcmVhdGl2ZUlkIjoiIiwiaHJlZiI6Imh0dHBzOi8va2VxaW5nbWFpbnMuY29tL2Jlbm5ldHQvIiwidGltZVRvUmVzcG9uZCI6MjAwNCwiYWNjZXB0YWJsZSI6ZmFsc2UsInJlcXVlc3RJZCI6IjAxOTIwYThkLTU2YTItNzdjMS05NmZjLWM4MmMyM2ZkNjU4MCIsImMiOiJVUyIsInIiOiJDQSIsInR5cGUiOjAsImR1cmF0aW9uIjowLCJyZWZyZXNoIjpmYWxzZSwidGFyZ2V0aW5nIjp7ImNvbnRyb2wiOiJmYWxzZSJ9LCJ0aW1lc3RhbXAiOjE3MjY3NTM4OTE0MjIsImYiOiIxNm81eGN4IiwidiI6IjQxMGJhZmUifQ%3D%3D&v=true&t=1005
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.144.25 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 25.144.244.35.bc.googleusercontent.com
Software: nginx/1.27.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:32 GMT
server: nginx/1.27.0

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 303ms
129ms Preflight
text/html 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://keqingmains.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://keqingmains.com
allow: OPTIONS, POST
cf-cache-status: DYNAMIC
cf-ray: 8c5a0d15be322f5d-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 19 Sep 2024 13:51:32 GMT
server: cloudflare
vary: Origin

POST
H3 204 938
tracker.nitropay.com/i/ 0
10 B 225ms
134ms Ping
text/plain 35.244.144.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tracker.nitropay.com/i/938?d=eyJhdWYiOiJkaXNwbGF5IiwiYWRVbml0Q29kZSI6InBvc3QtaGVhZGVyIiwiYmlkZGVyIjoiYWR4IiwiaGVpZ2h0Ijo5MCwid2lkdGgiOjcyOCwiY3BtIjowLjM1LCJjcmVhdGl2ZUlkIjoiIiwiaHJlZiI6Imh0dHBzOi8va2VxaW5nbWFpbnMuY29tL2Jlbm5ldHQvIiwidGltZVRvUmVzcG9uZCI6MjA4OCwiYWNjZXB0YWJsZSI6ZmFsc2UsInJlcXVlc3RJZCI6IjAxOTIwYThkLTU3MTItN2IyYS1iNjVhLWNiNjFkNGE1MGQwNyIsImMiOiJVUyIsInIiOiJDQSIsInR5cGUiOjAsImR1cmF0aW9uIjowLCJyZWZyZXNoIjpmYWxzZSwidGFyZ2V0aW5nIjp7ImNvbnRyb2wiOiJmYWxzZSJ9LCJ0aW1lc3RhbXAiOjE3MjY3NTM4OTE1MTAsImYiOiIxNm81eGN4IiwidiI6IjQxMGJhZmUifQ%3D%3D&v=true&t=1006
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.144.25 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 25.144.244.35.bc.googleusercontent.com
Software: nginx/1.27.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:32 GMT
server: nginx/1.27.0

GET
H3 200 ima_ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 223 B
106 B 578ms
256ms XHR
application/json 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ima_ppub_config?ippd=https%3A%2F%2Fkeqingmains.com%2Fbennett%2F

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

cafe /

Resource Hash

5030f965deceff14b94eb2780b06c37783a791f92d546dc24fd4922721b8582b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 13:51:33 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 81
date: Thu, 19 Sep 2024 13:51:33 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 bridge3.667.0_en.html
imasdk.googleapis.com/js/core/ Frame 3D22 0
0 465ms
152ms Document
text/html 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.667.0_en.html

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://keqingmains.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 73072
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 258070
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Wed, 18 Sep 2024 17:33:41 GMT
expires: Thu, 18 Sep 2025 17:33:41 GMT
last-modified: Wed, 18 Sep 2024 15:31:51 GMT
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ 44 KB
17 KB 528ms
193ms Script
text/javascript 2607:f8b0:4006:823::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: private, max-age=900
content-encoding: gzip
cross-origin-resource-policy: cross-origin
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 13:51:33 GMT
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 16746
date: Thu, 19 Sep 2024 13:51:33 GMT
x-xss-protection: 0
content-type: text/javascript
vary: Accept-Encoding
server: sffe

GET
H3 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 085D 40 KB
14 KB 162ms
161ms Script
text/javascript 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.194 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f2.1e100.net

Software

sffe /

Resource Hash

5b9cfa0283d9a9f6a909df2b61c9933c11130343f08aec96cdd8f49c29972526

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
age: 2557
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 14:08:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:08:55 GMT
last-modified: Thu, 11 Apr 2024 19:10:13 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3600
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
accept-ranges: bytes
content-length: 13943
x-xss-protection: 0
server: sffe

POST
H3 204 AGSKWxU-mIzKT6R_RzYfvUor0YNWxYfyXacqPlccicsYSDtaNIj3W84ysthqUcOmb_O1FpNhGRmPOW11k7oazmaqV9-9S7xz-Su1HKo7dHGCBetYPLyS_6ONH5_keMmz-8Az1hr_CRpE-A== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 183ms
180ms XHR
text/html 142.250.65.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU-mIzKT6R_RzYfvUor0YNWxYfyXacqPlccicsYSDtaNIj3W84ysthqUcOmb_O1FpNhGRmPOW11k7oazmaqV9-9S7xz-Su1HKo7dHGCBetYPLyS_6ONH5_keMmz-8Az1hr_CRpE-A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-O-Hde0rMv-3ZElV826cyHw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://keqingmains.com/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:32 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmLw0ZBicEqfwRoExO5aF1n9gXhJxEXWQ4kXWfd-vMR6FIiFeDie3NiwnU3gxdf925mVXJLyC-OT8_NKUvNKdBNTinVB7KLMpNKS_CIUdmoZSEVOfnp6Zl56vJGBkYmBpaG5noFZfIEBAJuOLvg"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-O-Hde0rMv-3ZElV826cyHw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://keqingmains.com
content-length: 0
x-xss-protection: 0
server: ESF

POST
H2 200 init
gw.geoedge.be/api/ Frame B0A4 0
0 534ms
172ms Fetch 2600:9000:266a:400:10:43f:4340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gw.geoedge.be/api/init
Requested by: Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b0b01868-2045-4a3d-b8b0-db8e6cd0649d/grumi.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:266a:400:10:43f:4340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer
Accept-Language: gzip
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

via: 1.1 0b2df4aba1652cc7a2c7e17c670eeec8.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: JObUq-DFmAorTLI_3J3lXKZD7UKYYMQSL0E739-rFZ3WgfCxdPOhDg==
date: Thu, 19 Sep 2024 13:51:33 GMT
x-amz-cf-pop: JFK52-P5

POST
H2 200 init
gw.geoedge.be/api/ Frame B0A4 0
0 202ms
172ms Fetch 2600:9000:266a:400:10:43f:4340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gw.geoedge.be/api/init
Requested by: Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b0b01868-2045-4a3d-b8b0-db8e6cd0649d/grumi.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:266a:400:10:43f:4340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer
Accept-Language: gzip
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

via: 1.1 0b2df4aba1652cc7a2c7e17c670eeec8.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: 1oJ-9fY19oMbXTG-2zrfC5bYwinpoBE81d-oJ5CpWVidNNPVlzxjYw==
date: Thu, 19 Sep 2024 13:51:33 GMT
x-amz-cf-pop: JFK52-P5

GET
H2 200 usync.html
eus.rubiconproject.com/ Frame 274A 0
0 685ms
264ms Document
text/html 23.56.163.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?gdpr=0&us_privacy=1YNY
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.163.106 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-163-106.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Referer: https://keqingmains.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html; charset=UTF-8
date: Thu, 19 Sep 2024 13:51:34 GMT
etag: "28052a-10d-6142d69a886c0"
last-modified: Thu, 21 Mar 2024 15:32:19 GMT
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

GET
H2 200 /
sync.cootlogix.com/api/sync/iframe/ Frame 90C6 0
0 602ms
170ms Document
text/html 147.182.142.243
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=1YNY
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 147.182.142.243 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://keqingmains.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 2955
content-type: text/html
date: Thu, 19 Sep 2024 13:51:34 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 sync
eb2.3lift.com/ Frame C506 0
0 207ms
164ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?us_privacy=1YNY&
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://keqingmains.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1274
content-type: text/html; charset=utf-8
date: Thu, 19 Sep 2024 13:51:34 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 checksync.php
contextual.media.net/ Frame 325C 0
0 575ms
535ms Document
text/html 23.56.162.28
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU87559X&prvid=2034%2C2033%2C2031%2C2075%2C2030%2C590%2C2073%2C273%2C233%2C2028%2C2027%2C2104%2C2026%2C236%2C3038%2C2025%2C2069%2C237%2C556%2C117%2C97%2C55%2C99%2C2045%2C3012%2C2087%2C3011%2C3010%2C2041%2C122%2C201%2C2039%2C246%2C4%2C521%2C126%2C203%2C522%2C2113%2C446%2C523%2C326%2C404%2C9%2C407%2C2011%2C2055%2C2099%2C3022%2C3020%2C294%2C251%2C450%2C2009%2C255%2C3018%2C2126%2C3017%2C2125%2C214%2C2124%2C3014%2C338%2C459%2C77%2C38%2C2100%2C2022%2C182%2C141%2C262%2C3073%2C461%2C222%2C301%2C345%2C225%2C10000%2C80%2C108%2C229&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=1&usp_consent=1&uspstring=1YNY

Requested by

Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.28 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-28.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://keqingmains.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=93600
cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 13743
content-type: text/html; charset=UTF-8
date: Thu, 19 Sep 2024 13:51:34 GMT
expires: Thu, 19 Sep 2024 13:51:34 GMT
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 235C 0
0 555ms
177ms Document
text/html 23.223.209.209
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.223.209.209 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-223-209-209.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash

Request headers

Referer: https://keqingmains.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 19 Sep 2024 13:51:34 GMT
ETag: "623de86a-cf34"
Expires: Fri, 20 Sep 2024 13:51:36 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding

GET
H2 200 pd
ggsoftware-d.openx.net/w/1.0/ Frame 9BDA 0
0 115ms
85ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ggsoftware-d.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=&us_privacy=1YNY
Requested by: Host: s.nitropay.com
URL: https://s.nitropay.com/ads-938.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash

Request headers

Referer: https://keqingmains.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 548
content-type: text/html
date: Thu, 19 Sep 2024 13:51:34 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2

200

us.gif
sync.go.sonobi.com/
Redirect Chain

https://sync.mathtag.com/sync/img?cs_wd_sy=1&dp=43&redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dif%26nuid%3D[MM_UUID]
https://sync.go.sonobi.com/us.gif?nw=if&nuid=b7dc66ec-2c66-4900-a876-a0be7d800006

49 B
843 B

156ms
152ms

Image
image/gif

2607:f350:3:2569:0:10:0:d
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=if&nuid=b7dc66ec-2c66-4900-a876-a0be7d800006

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Server

2607:f350:3:2569:0:10:0:d , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, private
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 49
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 19 Sep 2024 13:51:34 GMT
tcn: Choice
content-type: image/gif
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-94
x-xss-protection: 0

Redirect headers

X-Permitted-Cross-Domain-Policies: all
X-Content-Type-Options: nosniff
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Date: Thu, 19 Sep 2024 13:51:34 GMT
Content-Type: image/gif
Strict-Transport-Security: 31536000
Cache-Control: no-cache,no-store,must-revalidate
location: https://sync.go.sonobi.com/us.gif?nw=if&nuid=b7dc66ec-2c66-4900-a876-a0be7d800006
Pragma: no-cache
Connection: keep-alive
Cross-Origin-Resource-Policy: cross-origin
Referrer-Policy: strict-origin
Access-Control-Allow-Origin: *
Content-Length: 0
X-XSS-Protection: 0
Server: MT3 1668 f41eadd master ord ord-pixel-x49 config_version:"2217"

GET
H2

200

us.gif
sync.go.sonobi.com/
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=140&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us.gif?nw=bs&nuid=db0f47e3-604a-4a32-9d70-0cc84673795b-66ec2c63-5553&gdpr=0&gdpr_consent=

49 B
857 B

241ms
153ms

Image
image/gif

2607:f350:3:2569:0:10:0:d
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=bs&nuid=db0f47e3-604a-4a32-9d70-0cc84673795b-66ec2c63-5553&gdpr=0&gdpr_consent=

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Server

2607:f350:3:2569:0:10:0:d , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, private
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 49
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 19 Sep 2024 13:51:34 GMT
tcn: Choice
content-type: image/gif
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-94
x-xss-protection: 0

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://sync.go.sonobi.com/us.gif?nw=bs&nuid=db0f47e3-604a-4a32-9d70-0cc84673795b-66ec2c63-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Thu, 19 Sep 2024 13:51:34 GMT
server: A

GET
H2

200

us.gif
sync.go.sonobi.com/
Redirect Chain

https://p.rfihub.com/cm?pub=35683&in=1
https://sync.go.sonobi.com/us.gif?nw=zt&nuid=969470228759202582

49 B
824 B

153ms
143ms

Image
image/gif

2607:f350:3:2569:0:10:0:d
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=zt&nuid=969470228759202582

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Server

2607:f350:3:2569:0:10:0:d , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, private
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 49
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 19 Sep 2024 13:51:34 GMT
tcn: Choice
content-type: image/gif
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-94
x-xss-protection: 0

Redirect headers

Location: https://sync.go.sonobi.com/us.gif?nw=zt&nuid=969470228759202582
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Date: Thu, 19 Sep 2024 13:51:34 GMT
Server: Jetty(9.4.51.v20230217)

GET 7318ffc0e8fa1d771446
s.amazon-adsystem.com/x/ 0
0

GET
H3 200 pixel
capi.connatix.com/us/ 82 B
82 B 387ms
129ms Image
image/gif 104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/us/pixel?puid=c9ec44c1-1437-4562-9409-485ef353c003&pId=43&gdpr_consent=&callback=&us_privacy=
Requested by: Host: keqingmains.com
URL: https://keqingmains.com/bennett/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

surrogate-control: no-cache, no-store, must-revalidate, max-age=0
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: gzip
cf-cache-status: DYNAMIC
cf-ray: 8c5a0d20bf95cb94-LAX
alt-svc: h3=":443"; ma=86400
content-length: 95
date: Thu, 19 Sep 2024 13:51:34 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

GET
H2

200

usg.gif
sync.go.sonobi.com/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_cm&google_hm=YzllYzQ0YzEtMTQzNy00NTYyLTk0MDktNDg1ZWYzNTNjMDAz
https://sync.go.sonobi.com/usg.gif?google_error=15

49 B
443 B

473ms
153ms

Image
image/gif

2607:f350:3:2569:0:10:0:d
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/usg.gif?google_error=15

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Server

2607:f350:3:2569:0:10:0:d , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, private
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 49
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 19 Sep 2024 13:51:34 GMT
tcn: Choice
content-type: image/gif
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-94
x-xss-protection: 0

Redirect headers

cache-control: no-cache, must-revalidate
location: https://sync.go.sonobi.com/usg.gif?google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 247
date: Thu, 19 Sep 2024 13:51:34 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

us.gif
sync.go.sonobi.com/
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=286
https://sync.go.sonobi.com/us.gif?nw=st&nuid=aaJNYqyYU2x3YdaV4St9XqL1zvY

49 B
759 B

145ms
144ms

Image
image/gif

2607:f350:3:2569:0:10:0:d
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=st&nuid=aaJNYqyYU2x3YdaV4St9XqL1zvY

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Server

2607:f350:3:2569:0:10:0:d , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, private
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 49
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 19 Sep 2024 13:51:35 GMT
tcn: Choice
content-type: image/gif
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-94
x-xss-protection: 0

Redirect headers

Location: https://sync.go.sonobi.com/us.gif?nw=st&nuid=aaJNYqyYU2x3YdaV4St9XqL1zvY
Content-Length: 99
Date: Thu, 19 Sep 2024 13:51:34 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

us.gif
sync.go.sonobi.com/
Redirect Chain

https://creativecdn.com/cm-notify?pi=sonobi
https://creativecdn.com/cm-notify?pi=sonobi&tc=1
https://sync.go.sonobi.com/us.gif?nw=rh&nuid=uCA8BrXFuqFCbJMcIkTBjNlfwg43T8N7zwGygqAuagY&pi=sonobi&tc=1

49 B
775 B

145ms
144ms

Image
image/gif

2607:f350:3:2569:0:10:0:d
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=rh&nuid=uCA8BrXFuqFCbJMcIkTBjNlfwg43T8N7zwGygqAuagY&pi=sonobi&tc=1

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Server

2607:f350:3:2569:0:10:0:d , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, private
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 49
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 19 Sep 2024 13:51:35 GMT
tcn: Choice
content-type: image/gif
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-94
x-xss-protection: 0

Redirect headers

expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
location: https://sync.go.sonobi.com/us.gif?nw=rh&nuid=uCA8BrXFuqFCbJMcIkTBjNlfwg43T8N7zwGygqAuagY&pi=sonobi&tc=1
content-length: 0
date: Thu, 19 Sep 2024 13:51:35 GMT, Thu, 19 Sep 2024 13:51:35 GMT
pragma: no-cache
vary: Accept-Encoding

GET
H2

200

us.gif
sync.go.sonobi.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=97d6fcd501&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us.gif?nw=td&nuid=faef1d29-3001-4128-bb4e-24fa47627f12&pubid=97d6fcd501

49 B
843 B

455ms
154ms

Image
image/gif

2607:f350:3:2569:0:10:0:d
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=td&nuid=faef1d29-3001-4128-bb4e-24fa47627f12&pubid=97d6fcd501

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Server

2607:f350:3:2569:0:10:0:d , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, private
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 49
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 19 Sep 2024 13:51:34 GMT
tcn: Choice
content-type: image/gif
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-94
x-xss-protection: 0

Redirect headers

location: https://sync.go.sonobi.com/us.gif?nw=td&nuid=faef1d29-3001-4128-bb4e-24fa47627f12&pubid=97d6fcd501
content-length: 227
date: Thu, 19 Sep 2024 13:51:34 GMT
server: Kestrel

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://idsync.rlcdn.com/711892.gif?partner_uid=c9ec44c1-1437-4562-9409-485ef353c003
https://idsync.rlcdn.com/1000.gif?memo=CNS5KxIwCiwIARDAlQEaJGM5ZWM0NGMxLTE0MzctNDU2Mi05NDA5LTQ4NWVmMzUzYzAwMxAAGg0I5tiwtwYSBQjoBxAAQgBKAA
https://pippio.com/api/sync?pid=5324&it=1&iv=31f5f2c3fba88020be7402dda4847de5ba1214788aa941ca9d3aceb4e07736e3791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=31f5f2c3fba88020be7402dda4847de5ba1214788aa941ca9d3aceb4e07736e3791426b5417dce21&rand=02456420

0
249 B

348ms
162ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=31f5f2c3fba88020be7402dda4847de5ba1214788aa941ca9d3aceb4e07736e3791426b5417dce21&rand=02456420
Requested by: Host: keqingmains.com
URL: https://keqingmains.com/bennett/
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: A64C3A8F79A5434BB58E830F159ED01B Ref B: LAX311000109033 Ref C: 2024-09-19T13:51:35Z
x-li-fabric: prod-lva1
x-li-uuid: AAYieTiNVEAYvNzFC7+TIw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 19 Sep 2024 13:51:35 GMT

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=31f5f2c3fba88020be7402dda4847de5ba1214788aa941ca9d3aceb4e07736e3791426b5417dce21&rand=02456420
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Thu, 19 Sep 2024 13:51:35 GMT

GET
H2

200

us.gif
sync.go.sonobi.com/
Redirect Chain

https://x.bidswitch.net/sync?ssp=sonobi&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=sonobi&gdpr=0&gdpr_consent=
https://pr-bh.ybp.yahoo.com/sync/iponweb?bidswitch_ssp_id=sonobi&ssp_user_id=d4483e65-826f-423d-913d-2374bccd1343&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=74&&user_id=y-m30jTlJE2plphDcnnnzIlgthYW2HNvTyLS6EPw--~A&expires=5&ssp=sonobi
https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=d4483e65-826f-423d-913d-2374bccd1343&gdpr=&gdpr_consent=&us_privacy=

49 B
768 B

144ms
144ms

Image
image/gif

2607:f350:3:2569:0:10:0:d
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=d4483e65-826f-423d-913d-2374bccd1343&gdpr=&gdpr_consent=&us_privacy=

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Server

2607:f350:3:2569:0:10:0:d , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

cache-control: no-cache, no-store, private
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 49
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 19 Sep 2024 13:51:35 GMT
tcn: Choice
content-type: image/gif
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-94
x-xss-protection: 0

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=d4483e65-826f-423d-913d-2374bccd1343&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:51:35 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3061&partner_device_id=c9ec44c1-1437-4562-9409-485ef353c003
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D23edf488-1b8e-4b82-80fd-5fb45452619b%252C%252C
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=4617267580394984253&pt=23edf488-1b8e-4b82-80fd-5fb45452619b%2C%2C

95 B
124 B

118ms
114ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=4617267580394984253&pt=23edf488-1b8e-4b82-80fd-5fb45452619b%2C%2C

Requested by

Host: keqingmains.com
URL: https://keqingmains.com/bennett/

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://keqingmains.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Thu, 19 Sep 2024 13:51:34 GMT
content-type: image/png
server: Jetty(11.0.13)

Redirect headers

cache-control: no-store, no-cache, private
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=4617267580394984253&pt=23edf488-1b8e-4b82-80fd-5fb45452619b%2C%2C
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.246; 162.245.206.246; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: ceef593a-4c9e-48d6-bed3-89c90a2577d4
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 19 Sep 2024 13:51:34 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

POST
H2 200 init
gw.geoedge.be/api/ Frame B0A4 0
0 198ms
170ms Fetch 2600:9000:266a:400:10:43f:4340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gw.geoedge.be/api/init
Requested by: Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b0b01868-2045-4a3d-b8b0-db8e6cd0649d/grumi.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:266a:400:10:43f:4340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer
Accept-Language: gzip
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

via: 1.1 0b2df4aba1652cc7a2c7e17c670eeec8.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: yvc1hTLpTWG6gEa2QcH4iB6tQ91QcnDUAnYkRO07dYNl4YUiuZhPVg==
date: Thu, 19 Sep 2024 13:51:34 GMT
x-amz-cf-pop: JFK52-P5

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/x/7318ffc0e8fa1d771446

Verdicts & Comments Add Verdict or Comment

277 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

219 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
ad-cdn.technoratimedia.com/html	1970-01-20 23:59:23	Name: tads_tbla_bidi Value: 1726753893775
.3lift.com/sync	1970-01-21 01:48:49	Name: sync Value: CgoIgAIQn-C11KAyCgoIoQEQmdy11KAyCgoIgQIQn-C11KAyCgoI4gEQmdy11KAyCgoI5gEQmdy11KAyCgoIhwIQmdy11KAyCgoI5wEQn-C11KAyCgkISRCf4LXUoDIKCQgLEJ_gtdSgMgoKCIwCEJnctdSgMgoKCKwCEJnctdSgMgoKCK0CEJnctdSgMgoKCM4BEJ_gtdSgMgoKCLQCEJ_gtdSgMgoKCJQCEJ_gtdSgMgoJCDoQmdy11KAyCgkIGxCZ3LXUoDIKCgidAhCf4LXUoDIKCgjeARCf4LXUoDIKCQhfEJnctdSgMg==
.nitropay.com/	1970-01-20 23:39:15	Name: __cf_bm Value: V7AU8vpic7mjZBu97KH492fSucokjLkptJ2I_ubo14o-1726753886-1.0.1.1-5V_Nq1ZrVU5D6xQR_8MBKLX.WHPqFeKL7ym5Cu84uZCwZjr_gbpH.0VouL3oLgdtSST_qYp0V0p6Anop4bu9qw
.openx.net/	1970-01-21 08:24:49	Name: receive-cookie-deprecation Value: 1
.keqingmains.com/	1970-01-21 09:15:13	Name: _ga_VBESH40ETT Value: GS1.1.1726753888.1.0.1726753888.0.0.0
.keqingmains.com/	1970-01-21 08:24:49	Name: ncmp.domain Value: keqingmains.com
keqingmains.com/	1969-12-31 23:59:59	Name: wp-wpml_current_language Value: en
prebid.media.net/	1970-01-21 03:58:25	Name: receive-cookie-deprecation Value: 1
.go.sonobi.com/	1970-01-20 23:40:40	Name: _usd_keqingmains.com Value: 440b7c73-fdb8-4150-b4e1-1620c955ae80
apex.go.sonobi.com/	1969-12-31 23:59:59	Name: Value: receive-cookie-deprecation: 1
.go.sonobi.com/	1970-01-20 23:39:14	Name: __uih Value: 1
.go.sonobi.com/	1970-01-21 00:26:01	Name: __uin_lr Value: 1
.go.sonobi.com/	1970-01-20 23:57:57	Name: __uir_lr Value: 54219087
.go.sonobi.com/	1970-01-21 00:26:01	Name: __uin_cx Value: 1
.go.sonobi.com/	1970-01-20 23:57:57	Name: __uir_cx Value: 54219087
.go.sonobi.com/	1970-01-20 23:40:40	Name: __uin_z1 Value: 1
.go.sonobi.com/	1970-01-20 23:39:48	Name: __uir_z1 Value: 54219087
.go.sonobi.com/	1970-01-20 23:39:17	Name: __uin_tp Value: 1
.go.sonobi.com/	1970-01-20 23:39:15	Name: __uir_tp Value: 54219087
.go.sonobi.com/	1970-01-21 08:24:49	Name: __uis Value: 9093df01-cc1f-4fb5-8dd0-325a815ec597
.adnxs.com/	1970-01-21 09:15:13	Name: receive-cookie-deprecation Value: 1
.rubiconproject.com/	1970-01-21 08:24:49	Name: khaos Value: M19COJF8-J-IFPX
.3lift.com/	1970-01-21 01:48:49	Name: receive-cookie-deprecation Value: 1
.sharethrough.com/	1970-01-21 00:22:25	Name: stx_user_id Value: 2a16fa8a-cc3e-4962-8c83-cf6336de3d49
.3lift.com/	1970-01-21 01:48:49	Name: tluid Value: 3983459606600795162929
.keqingmains.com/	1970-01-21 08:24:49	Name: cf_clearance Value: i.sIxk76S7_OHIpTa9L5NLSmCIOPD89JuVR0GB3G7LE-1726753888-1.2.1.1-hVjmYNfdvmQdrf4yJm7.fFBZ5GY5EuX1ehs.VbQtLOec0GlLEdGVd8ElW1_10WuDZ4rrM88JWI9bEQKh0GWAQKJ0ZavuQNuO2d6uoT5wxEmD_8sk9RTnNOvbHYXPc3iJ7EJmwrl4rbKfOMr2g0J1JIVFchGbD9Fl_atjPKrZ7EUOfNiMIAz1CM216yTMFWm24JUgWEbLepCuoNiGx4MBO15sCMhQnkZK0KtdCkiV5Uv4jYbhdS4q0MmtBMK78uX94Teq4zZn655AbZHB2RPMHRCOMUwHuxJDLkYiG_0Dzx6wF1o6N0wetV.ZgQcNuZsWnn471gQemICYQWjhWaSvGIQpiIQ_5ZyVL_SnVUGS_aTLQGBpUTzsexKytgzRHV8a
.cootlogix.com/	1970-01-21 00:22:25	Name: vdz_sync Value: a17b9892-f421-63bd-71c3-e2b0d46ccffb
.keqingmains.com/	1970-01-21 09:15:13	Name: _ga Value: GA1.2.626411807.1726753888
.keqingmains.com/	1970-01-20 23:40:40	Name: _gid Value: GA1.2.685154630.1726753889
.keqingmains.com/	1970-01-20 23:39:13	Name: _gat_gtag_UA_117136430_6 Value: 1
.amazon-adsystem.com/	1970-01-21 04:18:35	Name: ad-id Value: A18E2gd1D0fAuJ1KsUXnHVU
.amazon-adsystem.com/	1970-01-21 09:15:13	Name: ad-privacy Value: 0
.ad.gt/	1969-12-31 23:59:59	Name: au_3p_check Value: 1
.keqingmains.com/	1970-01-21 08:24:49	Name: _au_1d Value: AU1D-0100-001726753891-8JQZDW3T-E8HQ
.adnxs.com/	1970-01-21 01:48:49	Name: XANDR_PANID Value: cziUGWHa55SdlOpMyZjB5bbGRWtjxCbdotDNzAjULg8YezCaSysCIq7vrFqWnghGhYuK4oCHYrn57A0iqXWHqzOc99hUGjSIsiSGxmVRyE0.
.adnxs.com/	1970-01-21 01:48:49	Name: uuid2 Value: 4617267580394984253
.adsrvr.org/	1970-01-21 08:24:49	Name: TDID Value: faef1d29-3001-4128-bb4e-24fa47627f12
.keqingmains.com/	1970-01-21 09:00:49	Name: __gads Value: ID=eaccef6a82fa1c6b:T=1726753890:RT=1726753890:S=ALNI_MZBg7UHfpbLQlfajUgQhLd46kdeXA
.keqingmains.com/	1970-01-21 09:00:49	Name: __gpi Value: UID=00000a518c85d55a:T=1726753890:RT=1726753890:S=ALNI_MZX5OTDaaxUPuttz-CdQFrDEN9Epw
.zemanta.com/	1970-01-21 08:24:49	Name: zuid Value: 1PswNA2zn74xY3fCF2sL
.keqingmains.com/	1970-01-21 03:58:25	Name: __eoi Value: ID=f9e4147e7658251f:T=1726753890:RT=1726753890:S=AA-AfjZp8uBH4XphC52LZZrT_eSl
.mediago.io/	1970-01-21 08:24:49	Name: __mguid_ Value: 4acc62918a49004126qive00m19colti
.go.sonobi.com/	1970-01-20 23:40:40	Name: __uin_a9 Value: 1
.go.sonobi.com/	1970-01-20 23:39:48	Name: __uir_a9 Value: 54219090
.ad.gt/	1970-01-21 08:24:49	Name: au_id Value: AU1D-0100-001726753891-8JQZDW3T-E8HQ
.simpli.fi/	1970-01-21 08:26:16	Name: suid Value: 6EE3D687BFE0414BAC15D0C4E31EFF36
.3lift.com/	1970-01-21 01:48:49	Name: tluidp Value: 3983459606600795162929
.s3xified.com/	1970-01-21 09:15:13	Name: admRtbUidCkey34334Ssp245 Value: 4be91aaef05e90d07d78d09070ad541f
.crwdcntrl.net/	1970-01-21 06:07:59	Name: _cc_id Value: eea194b8ecff3b2a3f938b7ba1930124
.media.net/	1970-01-21 08:24:49	Name: visitor-id Value: 3697554911829477000V10
.media.net/	1970-01-21 04:05:37	Name: usp_status Value: 1
.pubmatic.com/	1970-01-21 08:24:49	Name: KADUSERCOOKIE Value: 20210A7D-5EF3-4396-A986-E239010B967F
.keqingmains.com/	1970-01-21 06:08:01	Name: _cc_id Value: eea194b8ecff3b2a3f938b7ba1930124
.keqingmains.com/	1970-01-20 23:40:40	Name: panoramaId_expiry Value: 1726840291477
.tapad.com/	1970-01-21 01:05:37	Name: TapAd_TS Value: 1726753891310
.tapad.com/	1970-01-21 01:05:37	Name: TapAd_DID Value: 23edf488-1b8e-4b82-80fd-5fb45452619b
.contextweb.com/	1970-01-21 08:17:37	Name: V Value: o8GoRjF6GmnJ
.contextweb.com/	1970-01-21 08:17:37	Name: VP Value: part_o8GoRjF6GmnJ
bh.contextweb.com/	1969-12-31 23:59:59	Name: INGRESSCOOKIE Value: 6fe1e1caa77b4b1a
.csync.loopme.me/	1970-01-21 01:50:16	Name: viewer_token Value: 888abb63-f39c-44b0-a0c8-6c8ea38c23f3
.openx.net/	1970-01-21 08:24:49	Name: i Value: b6bebafd-ce45-46cc-9baa-b3876ae7af68\|1726753891
.sitescout.com/	1970-01-21 08:24:49	Name: ssi Value: db0f47e3-604a-4a32-9d70-0cc84673795b#1726753891832
.bidr.io/	1970-01-21 09:07:47	Name: bito Value: AAB1V07N2FkAABWfLL4Okw
.bidr.io/	1970-01-21 09:07:47	Name: bitoIsSecure Value: ok
.technoratimedia.com/	1970-01-20 23:39:17	Name: tads_ipv6 Value: 2a04:c604:615:1::3
.admanmedia.com/	1970-01-20 23:59:21	Name: admtr Value: 14dfbd03-d25e-4135-8fef-c9efab288a8a
.admanmedia.com/	1970-01-20 23:59:21	Name: ac_r Value: CS63
.go.sonobi.com/	1970-01-21 08:24:49	Name: __uin_td Value: faef1d29-3001-4128-bb4e-24fa47627f12
.doubleclick.net/	1970-01-21 09:15:13	Name: IDE Value: AHWqTUmyAqxqnGZ3CdK2tjEFgQ7FvoDPvlu4eTzKt7mcjb3hTn-K2G7GByS64SzYLno
sync.srv.stackadapt.com/	1970-01-21 08:24:49	Name: sa-user-id Value: s%3A0-69a24d62-ac98-536c-7761-d695e12b7d5e.A7N8SJWemWdMEcoGiKj7PZE0zDaF2EgF%2F5IEzujY4N4
.srv.stackadapt.com/	1970-01-21 08:24:49	Name: sa-user-id Value: s%3A0-69a24d62-ac98-536c-7761-d695e12b7d5e.A7N8SJWemWdMEcoGiKj7PZE0zDaF2EgF%2F5IEzujY4N4
sync.srv.stackadapt.com/	1970-01-21 08:24:49	Name: sa-user-id-v2 Value: s%3AaaJNYqyYU2x3YdaV4St9XqL1zvY.VyqQQJLn2gw5hQinVKknGXK99Dxa7SAM%2B5kpnSmlhz8
.srv.stackadapt.com/	1970-01-21 08:24:49	Name: sa-user-id-v2 Value: s%3AaaJNYqyYU2x3YdaV4St9XqL1zvY.VyqQQJLn2gw5hQinVKknGXK99Dxa7SAM%2B5kpnSmlhz8
sync.srv.stackadapt.com/	1970-01-21 08:24:49	Name: sa-user-id-v3 Value: s%3AAQAKIMr_KRexSqurK7Sx0Y_ecL2DkNjJ3o78qTkCIx0e8_b-EGcYBCDk2LC3BjABOgS9RxseQgQLQHRX.Rt1AlZfHjBKmlLOiOjXj4MaQ3hXW5%2B7LAgAFjGzf3IA
.srv.stackadapt.com/	1970-01-21 08:24:49	Name: sa-user-id-v3 Value: s%3AAQAKIMr_KRexSqurK7Sx0Y_ecL2DkNjJ3o78qTkCIx0e8_b-EGcYBCDk2LC3BjABOgS9RxseQgQLQHRX.Rt1AlZfHjBKmlLOiOjXj4MaQ3hXW5%2B7LAgAFjGzf3IA
keqingmains.com/	1970-01-21 01:05:37	Name: na-unifiedid Value: %7B%22TDID%22%3A%22faef1d29-3001-4128-bb4e-24fa47627f12%22%2C%22TDID_LOOKUP%22%3A%22TRUE%22%2C%22TDID_CREATED_AT%22%3A%222024-08-19T13%3A51%3A32%22%7D
keqingmains.com/	1970-01-21 01:05:37	Name: na-unifiedid_cst Value: bCwtLCQsqQ%3D%3D
.go.sonobi.com/	1970-01-21 08:24:49	Name: __uin_st Value: aaJNYqyYU2x3YdaV4St9XqL1zvY
.technoratimedia.com/	1970-01-21 09:15:13	Name: tads_uidp_16 Value: 1549172725125
.technoratimedia.com/	1970-01-21 09:15:13	Name: tads_uidp_44 Value: M19C5YML-N-7738
.technoratimedia.com/	1970-01-21 09:15:13	Name: tads_uidp_45 Value: 87E5DB58-8DE7-4051-832D-E713C19D4F1C
.technoratimedia.com/	1970-01-21 09:15:13	Name: tads_uidp_46 Value: 5700273623533264782
.technoratimedia.com/	1970-01-21 09:15:13	Name: tads_uidp_48 Value: 0889f687-151e-4014-8ccf-56022e082f2f
.technoratimedia.com/	1970-01-21 09:15:13	Name: tads_uidp_64 Value: RGHx51jeg7TBhAUIKUoljZyAtxIDMXPo
.technoratimedia.com/	1970-01-21 09:15:13	Name: tads_uidp_70 Value: 1670646038087-955011302607-007242-002-000574
.technoratimedia.com/	1970-01-21 09:15:13	Name: tads_uidp_73 Value: AADAME7NxqYAABVLEw9LFw
.technoratimedia.com/	1970-01-21 09:15:13	Name: tads_uidp_76 Value: RX-50dc5801-a14c-4e15-9405-30e0612fe292-004
.technoratimedia.com/	1970-01-20 23:43:33	Name: tads_uidp_77 Value: wj58gNCF1wu7X9vEtaZjsWVbahgCJ_nHLeZDJzHsgJc
.technoratimedia.com/	1970-01-20 23:43:33	Name: tads_uidp_83 Value: selLuQkEz1d8
.technoratimedia.com/	1970-01-21 09:15:13	Name: tads_uidp_90 Value: 4ceb69ec-600e-47a9-9b1e-3a4adb6cfe84
.technoratimedia.com/	1970-01-20 23:43:33	Name: tads_uidp_91 Value: 2238247929118836949brt54341665178665280338b5
.technoratimedia.com/	1970-01-21 09:15:13	Name: tads_uid Value: A86D4DA215FB40F8BBC0EC13D800DDA9
.technoratimedia.com/	1970-01-21 09:15:13	Name: tads_uid_cd Value: 20231007011547+0000
.technoratimedia.com/	1970-01-21 09:15:13	Name: tads_zora Value: 2
.technoratimedia.com/	1970-01-20 23:40:40	Name: envelope_liveramp.com Value: 1693142250488
.keqingmains.com/	1970-01-21 08:24:49	Name: FCNEC Value: %5B%5B%22AKsRol80j3IfxVf9Co9HoNc5f1JG2O8Xv6oWJTGyJh4ONmKJwF3yPmHj4o5gPVvrRSUirqBQC62aFe1PYL_urn7aq4FMHx-WjxuXstdap6mwpzjPpLXKAhXkQxYhwY0wMa8fle09wseHVJcuTdVTSn9lpiNonlxkmg%3D%3D%22%5D%5D
.go.sonobi.com/	1970-01-21 08:24:49	Name: __uin_bs Value: db0f47e3-604a-4a32-9d70-0cc84673795b-66ec2c63-5553
.pubmatic.com/	1970-01-21 01:48:49	Name: KRTBCOOKIE_377 Value: 6810-faef1d29-3001-4128-bb4e-24fa47627f12&KRTB&22918-faef1d29-3001-4128-bb4e-24fa47627f12&KRTB&22926-faef1d29-3001-4128-bb4e-24fa47627f12&KRTB&23031-faef1d29-3001-4128-bb4e-24fa47627f12
.pubmatic.com/	1970-01-21 00:22:25	Name: KRTBCOOKIE_148 Value: 19421-uid:6EE3D687BFE0414BAC15D0C4E31EFF36&KRTB&23486-uid:6EE3D687BFE0414BAC15D0C4E31EFF36&KRTB&23489-uid:6EE3D687BFE0414BAC15D0C4E31EFF36&KRTB&23539-uid:6EE3D687BFE0414BAC15D0C4E31EFF36
.yahoo.com/	1970-01-21 08:25:11	Name: A3 Value: d=AQABBGQs7GYCEJJ1UmWHQdskGve2qdeBxPkFEgEBAQF97Wb2Ztwr0iMA_eMAAA&S=AQAAAv2KKpl6-RLzery1Xe6eypU
.contextweb.com/	1970-01-21 08:24:49	Name: pb_rtb_ev Value: 3-1tq8\|2N.0.AQAHxAuQi8tDWwJCi8P_AQEBAQEBAQCTC4xo5QEBAJMLjGjl\|3oy.0.db0f47e3-604a-4a32-9d70-0cc84673795b-66ec2c63-5553\|4is.0\|7TY.0
.contextweb.com/	1970-01-21 08:24:49	Name: pb_rtb_ev_part Value: 3-1tq8\|2N.0.AQAHxAuQi8tDWwJCi8P_AQEBAQEBAQCTC4xo5QEBAJMLjGjl\|3oy.0.db0f47e3-604a-4a32-9d70-0cc84673795b-66ec2c63-5553\|4is.0\|7TY.0
.s3xified.com/	1970-01-21 09:15:13	Name: rtbDspUserSyncIDs231123sd3r32 Value: {"1642":"A86D4DA215FB40F8BBC0EC13D800DDA9"}
.casalemedia.com/	1970-01-21 01:48:49	Name: CMPS Value: 2277
.casalemedia.com/	1970-01-21 01:48:49	Name: CMPRO Value: 2277
.doubleclick.net/	1970-01-21 03:58:25	Name: receive-cookie-deprecation Value: 1
.casalemedia.com/	1970-01-21 08:24:49	Name: CMID Value: ZuwsZcAoI6kAAEMFACQUIwAA
.doubleclick.net/	1970-01-21 03:58:25	Name: APC Value: AfxxVi7n0ji6majNvzjkT7l3VJaRZak1kEYJcXPFj8yRZv4N7BMYTg
.technoratimedia.com/	1970-01-20 23:43:33	Name: tads_uidp_82 Value: ZuwsZcAoI6kAAEMFACQUIwAA&2277
.technoratimedia.com/	1970-01-21 09:15:13	Name: tads_uidp_50 Value: 587eca1a-0095-4108-abbc-650f3a20a273
.teads.tv/	1970-01-21 08:23:23	Name: tt_viewer Value: 840feac6-e07b-4025-a221-b2867ed11089
.doubleclick.net/	1970-01-21 00:22:25	Name: ar_debug Value: 1
.technoratimedia.com/	1970-01-21 09:15:13	Name: tads_uidp_7 Value: faef1d29-3001-4128-bb4e-24fa47627f12
.technoratimedia.com/	1970-01-20 23:43:33	Name: tads_uidp_80 Value: y-chE_Ct1E2uHG59Bne_gpz_DgmQRGJQWE~A
.technoratimedia.com/	1970-01-20 23:43:33	Name: tads_uidp_88 Value: 3983459606600795162929
.agkn.com/	1970-01-21 08:24:49	Name: ab Value: 0001%3ADwG75npXKROn7NMBvwYJG5EbP%2F0ygbm%2B
.agkn.com/	1970-01-21 08:24:49	Name: u Value: C\|0EAAufujmLn7o5gAAAAAAAQAHAAAAAAHI3OX__x4AAAAAAIUkAwAAAAAWM9khAAAAAAvmn_oAAAAAIUZkjwA
.33across.com/	1970-01-21 08:24:49	Name: 33x_ps Value: u%3D212570395896317%3As1%3D1726753894176%3Ats%3D1726753894176
.360yield.com/	1970-01-21 01:48:49	Name: tuuid Value: 71c05781-2d00-4e0c-b162-8575b9da09e9
.360yield.com/	1970-01-21 01:48:49	Name: tuuid_lu Value: 1726753894
.openx.net/	1970-01-21 00:00:49	Name: pd Value: v2\|1726753894\|vMgavPkWgyiK
.pubmatic.com/	1970-01-21 00:22:25	Name: SPugT Value: 1726753894
.aralego.com/	1970-01-21 08:24:49	Name: sspid Value: 29dbf078-a6e1-38ea-8b72-2df5100ae8d9
.bing.com/	1970-01-21 09:00:49	Name: MUID Value: 01F4F0B73AC36C4F375FE4483B476D81
.c.bing.com/	1970-01-20 23:49:18	Name: MR Value: 0
.linkedin.com/	1970-01-21 01:48:49	Name: li_sugr Value: 1c4a8130-edd4-4754-b689-0b54bd82dd1c
.linkedin.com/	1970-01-21 08:24:49	Name: bcookie Value: "v=2&5b4b59e1-657f-4c8e-8dea-f0a17441c7e8"
.linkedin.com/	1970-01-20 23:40:40	Name: lidc Value: "b=VGST08:s=V:r=V:a=V:p=V:g=3023:u=1:x=1:i=1726753894:t=1726840294:v=2:sig=AQGtobvaWH7HtfAi8Vh97AD6EUfxZE1s"
.rlcdn.com/	1970-01-21 01:05:37	Name: pxrc Value: CObYsLcGEgUI6AcQABIFCOhHEAA=
.turn.com/	1970-01-21 03:58:25	Name: uid Value: 8401832241166098543
.technoratimedia.com/	1970-01-21 09:15:13	Name: tads_uidp_49 Value: AQANsfr0PWhx0QI-Z5I_AQEBAQEBAQCTC4Er3wEBAJMLgSvf
.technoratimedia.com/	1970-01-21 09:15:13	Name: tads_uidp_37 Value: 29dbf078-a6e1-38ea-8b72-2df5100ae8d9
.mathtag.com/	1970-01-21 09:05:09	Name: uuid Value: b7dc66ec-2c66-4900-a876-a0be7d800006
.tynt.com/	1970-01-21 08:24:49	Name: uid Value: k3eNWWbsLGYHOLzCM0hi3g==
.technoratimedia.com/	1970-01-21 09:15:13	Name: tads_uidp_62 Value: 3697554911829477000V10
.rfihub.com/	1970-01-21 09:00:49	Name: rud Value: H4sIAAAAAAAA_-MSsjSzNDE3MDKyMDe1NDIwMrUwEuIz1M0qLKjQjTDISHetMAYAwVPATyQAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSsjSzNDE3MDKyMDe1NDIwMrUwEuIz1M0qLKjQjTDISHetMAYAwVPATyQAAAA
.rlcdn.com/	1970-01-21 08:24:49	Name: rlas3 Value: q8r8wsobmJ+Acij9uUlidE4kGlS62Rp7s7DHYUyfak8=
.cootlogix.com/	1970-01-20 23:39:14	Name: vdzj1_bbc0fb5f Value: nVe15lGKN0MaoXYYxHcJF2U7L0I5DwoqKntCE0F8XSN%2FewB8VVxra21LKVN6XXB7K1Z6Bwx6dXtOe1cvVX97elIvUgw8bzodLFF6D3R8e1JvTU1tP2pNewYsWiN8egR8Al9oaG4cKwZ9DyNpYhJ7V1xoOGtMLVt%2BCXMveQksWFdgPTxMfFdoQGV9egd7UVdobDsefVJ4DXAoKAl7V19rbGhaZEF%2FCnQuegB1WAw6bm4ZflN6XXAoLQR4BVt6dXtOe1F7DndyeAd8UFdsbGEbeVp7WCZ%2BewVvTU1ubzhPcVZ4WnV%2FKlUuVlc8YWFNewcvD3JpYhJ7Uwk9bG4bKgcsW3UvegV%2BWV5rbWxJeAJoMWtpLV84Dxt6Y2lUagQuHDVpdEtvCBwdDHtCLgImHyJnbFcpER16Y3tIak9oCyM7PHMiDxw9Ny1ackFoQGU%2BPWA%2FCBk5OiBackF7NQkSbE1hQxw9KioRJw1oVmVye1F9Alc5OHRNcFouQSUpK1FgUV9uPXRBcFosDiR%2FKgYpBw56dXsbJw0kCSQ%2FJ18jKAt6Y3tOfAIuXH98dgEvVF9sPT1PLFN8DiJyKAdvTU0xKhAeOgInCWVxOkI4BBI%3D
.bidswitch.net/	1970-01-21 08:24:49	Name: tuuid Value: d4483e65-826f-423d-913d-2374bccd1343
.bidswitch.net/	1970-01-21 08:24:49	Name: c Value: 1726753894
.go.sonobi.com/	1970-01-21 00:26:01	Name: __uir_bs Value: 232869222718067030
.go.sonobi.com/	1969-12-31 23:59:59	Name: HAPLB8G Value: s8594\|Zuwsa
.go.sonobi.com/	1970-01-21 01:48:49	Name: __uir_td Value: 232869222718067030
.go.sonobi.com/	1970-01-21 00:26:01	Name: __uir_if Value: 232869235602968918
.go.sonobi.com/	1970-01-21 08:24:49	Name: __uin_if Value: b7dc66ec-2c66-4900-a876-a0be7d800006
.go.sonobi.com/	1970-01-21 00:26:01	Name: __uir_zt Value: 232869235602968918
.go.sonobi.com/	1970-01-21 08:24:49	Name: __uin_zt Value: 969470228759202582
.creativecdn.com/	1970-01-21 08:24:49	Name: g Value: xurZ2MBKRsG01y40MwSy_1726753894940
.creativecdn.com/	1970-01-21 08:24:49	Name: ts Value: 1726753894
.pippio.com/	1970-01-21 08:24:49	Name: didts Value: 1726753895
.pippio.com/	1970-01-21 01:05:37	Name: nnls Value:
.pippio.com/	1970-01-21 01:05:37	Name: pxrc Value: COfYsLcGEgYIgr0rEAA=
.bidswitch.net/	1970-01-21 08:24:49	Name: tuuid_lu Value: 1726753895
.go.sonobi.com/	1970-01-21 00:26:01	Name: __uir_st Value: 232869222718067030
.pippio.com/	1970-01-21 08:24:49	Name: did Value: okuYtoL7ZK-YY-Vp
.tynt.com/	1970-01-21 01:48:49	Name: pids Value: %5B%7B%22p%22%3A%22797f54a72d%22%2C%22f%22%3A1%2C%22ts%22%3A1726753895145%7D%2C%7B%22p%22%3A%224ef5c9a86a%22%2C%22f%22%3A1%2C%22ts%22%3A1726753895145%7D%2C%7B%22p%22%3A%2224c05c7b76%22%2C%22f%22%3A1%2C%22ts%22%3A1726753895145%7D%2C%7B%22p%22%3A%22d26852f088%22%2C%22f%22%3A1%2C%22ts%22%3A1726753895145%7D%2C%7B%22p%22%3A%22cf4d6e49b5%22%2C%22f%22%3A1%2C%22ts%22%3A1726753895145%7D%2C%7B%22p%22%3A%22f9a4a8fd15%22%2C%22f%22%3A1%2C%22ts%22%3A1726753895145%7D%5D
.ipredictive.com/	1970-01-21 08:24:49	Name: cu Value: 143c7942-4a80-450d-8434-dbbc50546ac1\|1726753895160
.media.net/	1970-01-20 23:49:18	Name: data-exp Value: setstatuscode~~1
.media.net/	1970-01-21 08:03:13	Name: data-p Value: o8GoRjF6GmnJ~~8
.media.net/	1970-01-21 08:23:23	Name: data-r1 Value: OPTOUT~~8
.media.net/	1970-01-21 00:22:25	Name: data-c Value: df9cf504-5aed-4295-a3d6-0ecf9e8192d7~~1
.media.net/	1970-01-21 00:22:25	Name: data-c-ts Value: 1726753895
.media.net/	1970-01-21 08:23:23	Name: data-o Value: ad3eec3b-ccc2-43db-a233-0501bc2f0e49~~8
.media.net/	1970-01-21 08:24:49	Name: data-ze Value: 1PswNA2zn74xY3fCF2sL~~1
.analytics.yahoo.com/	1970-01-21 08:24:49	Name: IDSYNC Value: "18z8~2ksd:18za~2ksd:190u~2ksd"
.go.sonobi.com/	1970-01-21 00:26:01	Name: __uir_rh Value: 232869235602968918
.go.sonobi.com/	1970-01-21 08:24:49	Name: __uin_rh Value: uCA8BrXFuqFCbJMcIkTBjNlfwg43T8N7zwGygqAuagY
.w55c.net/	1970-01-21 00:22:25	Name: matchtriplelift Value: 5
.media.net/	1970-01-20 23:59:23	Name: data-ttd Value: faef1d29-3001-4128-bb4e-24fa47627f12~~1
.w55c.net/	1970-01-21 09:08:01	Name: wfivefivec Value: YFr8cWwJ1SRhzh5
.w55c.net/	1970-01-21 00:22:25	Name: matchmedianet Value: 5
.technoratimedia.com/	1970-01-21 09:15:13	Name: tads_uidp_61 Value: 212570395896317
.technoratimedia.com/	1970-01-20 23:43:33	Name: tads_uidp_79 Value: 021785aa-df7d-410d-845d-a9a518edb66e
.media.net/	1970-01-21 08:23:23	Name: data-co Value: AQAGm44ySSLGKQIxRu5mAQEBAQEBAQCTC4xyhAEBAJMLjHKE~~8
.media.net/	1970-01-21 00:19:33	Name: data-so Value: 9093df01-cc1f-4fb5-8dd0-325a815ec597~~8
.mfadsrvr.com/	1970-01-21 08:24:49	Name: tuuid Value: 8e533ee2-350a-429c-887b-e424f2907ffe
.mfadsrvr.com/	1970-01-21 08:24:49	Name: c Value: 1726753895
.mfadsrvr.com/	1970-01-21 08:24:49	Name: tuuid_lu Value: 1726753895
.ads.pubmatic.com/	1970-01-20 23:40:40	Name: KCCH Value: YES
.media.net/	1970-01-21 08:23:23	Name: data-rk Value: 969470228759202582~~8
.krushmedia.com/	1970-01-20 23:59:23	Name: krm_usr Value: f20ce548-60a1-5b40-af38-cd345a098af6
.krushmedia.com/	1970-01-20 23:59:23	Name: krm_r Value: 615
.mfadsrvr.com/	1970-01-21 08:24:49	Name: ssh Value: !bidswitch=1726753895
.demdex.net/	1970-01-21 03:58:25	Name: demdex Value: 72025148953742735851722849271575198496
.rubiconproject.com/	1970-01-21 08:24:49	Name: khaos_p Value: M19COJF8-J-IFPX
.pubmatic.com/	1970-01-21 01:48:49	Name: DPSync4 Value: 1726790400%3A248%7C1727308800%3A265%7C1727913600%3A262_261_260_259_263_201
.media.net/	1970-01-21 08:23:23	Name: data-xu Value: YFr8cWwJ1SRhzh5~~8
.go.sonobi.com/	1970-01-21 01:48:49	Name: __uir_bw Value: 232869239897936215
.go.sonobi.com/	1970-01-21 08:24:49	Name: __uin_bw Value: d4483e65-826f-423d-913d-2374bccd1343
.quantserve.com/	1970-01-21 09:09:28	Name: mc Value: 66ec2c67-db25b-7f003-7720e
.sitescout.com/	1970-01-21 00:22:25	Name: _ssuma Value: eyI0NSI6MTcyNjc1Mzg5NjA0MiwiMjciOjE3MjY3NTM4OTE5OTQsIjM5IjoxNzI2NzUzODkxOTk0LCI3IjoxNzI2NzUzODkxOTk0fQ
.dpm.demdex.net/	1970-01-21 03:58:25	Name: dpm Value: 72025148953742735851722849271575198496
.w55c.net/	1970-01-21 00:22:25	Name: matchpubmatic Value: 5
.adsrvr.org/	1970-01-21 08:24:49	Name: TDCPM Value: CAESFAoFdGFwYWQSCwjO1OG2hq-sPRAFEhcKCHB1Ym1hdGljEgsIsNenu4avrD0QBRIWCgdzdng5dDUwEgsIkp-yy4avrD0QBRIWCgdydWJpY29uEgsIuqPl3oavrD0QBRgBIAIoAjILCJCJ2oGdr6w9EAU4AVoHOG0zM3prNGAC
.dotomi.com/	1970-01-20 23:39:13	Name: DotomiTest Value: 391b17250de01264
.tapad.com/	1970-01-21 01:05:37	Name: TapAd_3WAY_SYNCS Value: 1!6325-2!6325-3!6325
.pubmatic.com/	1970-01-21 00:22:25	Name: KRTBCOOKIE_279 Value: 22890-143c7942-4a80-450d-8434-dbbc50546ac1&KRTB&23011-143c7942-4a80-450d-8434-dbbc50546ac1&KRTB&23355-143c7942-4a80-450d-8434-dbbc50546ac1
.pubmatic.com/	1970-01-21 00:22:25	Name: PugT Value: 1726753896
.pubmatic.com/	1970-01-21 01:48:49	Name: KRTBCOOKIE_188 Value: 3189-db0f47e3-604a-4a32-9d70-0cc84673795b-66ec2c63-5553&KRTB&23418-db0f47e3-604a-4a32-9d70-0cc84673795b-66ec2c63-5553
.quantserve.com/	1970-01-21 01:48:49	Name: sp Value: CggIiQ0SAxC6DQoJCLmKAxIDELoN
.pubmatic.com/	1970-01-21 01:48:49	Name: KRTBCOOKIE_107 Value: 1471-uid:YFr8cWwJ1SRhzh5&KRTB&23421-uid:YFr8cWwJ1SRhzh5
.pubmatic.com/	1970-01-21 00:22:25	Name: KRTBCOOKIE_22 Value: 14911-8401832241166098543&KRTB&23150-8401832241166098543&KRTB&23527-8401832241166098543&KRTB&23629-8401832241166098543
.pubmatic.com/	1970-01-21 01:48:49	Name: KRTBCOOKIE_860 Value: 16335-aaJNYqyYU2x3YdaV4St9XqL1zvY&KRTB&23334-aaJNYqyYU2x3YdaV4St9XqL1zvY&KRTB&23417-aaJNYqyYU2x3YdaV4St9XqL1zvY&KRTB&23426-aaJNYqyYU2x3YdaV4St9XqL1zvY
.rfihub.com/	1970-01-21 09:00:49	Name: eud Value: H4sIAAAAAAAA_1vFwmtobmRmbmpsYWlmbGS2ShTBNzE3MwYAbuvyxSAAAAA
.adx.opera.com/	1970-01-21 08:24:49	Name: UID Value: OPUfdfdf84df4ad4166937ca3a0e15f2f8d
.media.net/	1970-01-21 08:23:23	Name: data-bs Value: d4483e65-826f-423d-913d-2374bccd1343~~1
.pubmatic.com/	1970-01-20 23:39:13	Name: ipc Value: 159988^https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fuser%3FpartnerId%3Dpubmatics2s%26userId%3D%23PMUID%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YNY^1^0
.pubmatic.com/	1970-01-20 23:40:40	Name: pi Value: 159988:3
.pubmatic.com/	1970-01-21 01:48:49	Name: chkChromeAb67Sec Value: 3
.pubmatic.com/	1970-01-21 01:48:49	Name: KRTBCOOKIE_18 Value: 22947-969470228759202582&KRTB&23628-969470228759202582
.pubmatic.com/	1970-01-21 01:48:49	Name: KRTBCOOKIE_153 Value: 19420-puF1N6K0JmO9s3JmpbU9Y_bnIGe94CdmoLIsQElg&KRTB&22979-puF1N6K0JmO9s3JmpbU9Y_bnIGe94CdmoLIsQElg&KRTB&23462-puF1N6K0JmO9s3JmpbU9Y_bnIGe94CdmoLIsQElg
.pubmatic.com/	1970-01-21 01:48:49	Name: KRTBCOOKIE_32 Value: 11175-AQAHYJG2fyr1GgJ1uK3IAQEBAQEBAQCTC4x2XQEBAJMLjHZd&KRTB&22715-AQAHYJG2fyr1GgJ1uK3IAQEBAQEBAQCTC4x2XQEBAJMLjHZd&KRTB&23519-AQAHYJG2fyr1GgJ1uK3IAQEBAQEBAQCTC4x2XQEBAJMLjHZd&KRTB&23632-AQAHYJG2fyr1GgJ1uK3IAQEBAQEBAQCTC4x2XQEBAJMLjHZd
.pubmatic.com/	1970-01-20 23:59:23	Name: KRTBCOOKIE_1323 Value: 23480-OPU77689bd1ba684c739816c49f3921fdd7&KRTB&23485-OPU77689bd1ba684c739816c49f3921fdd7&KRTB&23524-OPU77689bd1ba684c739816c49f3921fdd7&KRTB&23575-OPU77689bd1ba684c739816c49f3921fdd7
.pubmatic.com/	1970-01-21 01:48:49	Name: KRTBCOOKIE_594 Value: 17105-OPTOUT&KRTB&17107-OPTOUT
.rubiconproject.com/	1970-01-21 08:24:49	Name: audit_p Value: 1\|tcR/wBEzWcLjHbWodQ7EIrzog4PqosM003vrOGo/zJs5n50bh0W8AtjPLJSL3Ma0R4miH1vk77SmZ9b2RnTl1uCAnekPgJibXqyhQ6r4UPGIz8YKHaPrAI0xJh6eyTs0
.rubiconproject.com/	1970-01-21 08:24:49	Name: audit Value: 1\|tcR/wBEzWcLjHbWodQ7EIrzog4PqosM003vrOGo/zJs5n50bh0W8AtjPLJSL3Ma0R4miH1vk77SmZ9b2RnTl1uCAnekPgJibXqyhQ6r4UPGIz8YKHaPrAI0xJh6eyTs0
.tribalfusion.com/	1970-01-21 01:48:49	Name: ANON_ID Value: aanoeUx2eNOSE0UdcqRljPmV371pyGHtNqTGA4O2
.pubmatic.com/	1970-01-21 01:48:49	Name: SyncRTB4 Value: 1727308800%3A2_15_223%7C1727913600%3A176_22_165_266_249_267_8_21_240_104_48_178_3_233_264_7_99_13_250_71_55_46_81_5_54_231_234_166_220_56%7C1729296000%3A224%7C1727568000%3A63%7C1728000000%3A35%7C1727136000%3A216

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://keqingmains.com/bennett/(Line 998) Message: Unrecognized feature: 'web-share'.
rendering	warning	URL: https://keqingmains.com/bennett/(Line 1424) Message: [.WebGL-0x22e401689400]GL Driver Message (OpenGL, Performance, GL_CLOSE_PATH_NV, High): GPU stall due to ReadPixels
network	error	URL: https://ssum-sec.casalemedia.com/ium?sourceid=15&uid=060ixe7ju6a65hicigj8bhbjf8jdl7a9lieuom2wi0e0ysuiuqw4gsgwo4wk02e60&gdpr=0 Message: Failed to load resource: the server responded with a status of 400 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1aad12c339679a5d9672af3b6cf77ea2.safeframe.googlesyndication.com
a.ad.gt
aax.amazon-adsystem.com
acdn.adnxs.com
ad-delivery.net
ad.doubleclick.net
ajax.googleapis.com
apex.go.sonobi.com
api.btloader.com
bcp.crwdcntrl.net
bidder.criteo.com
btloader.com
btlr.sharethrough.com
c.amazon-adsystem.com
capi.connatix.com
cdn-ima.33across.com
cdn.hadronid.net
cdn.id5-sync.com
cdn.jsdelivr.net
cm.g.doubleclick.net
config.aps.amazon-adsystem.com
consent.nitrocnct.com
contextual.media.net
creativecdn.com
eb2.3lift.com
eus.rubiconproject.com
fastlane.rubiconproject.com
fundingchoicesmessages.google.com
ggsoftware-d.openx.net
gw.geoedge.be
hsr.keqingmains.com
ib.adnxs.com
id.hadron.ad.gt
ids.ad.gt
idsync.rlcdn.com
image2.pubmatic.com
imasdk.googleapis.com
keqingmains.com
match.adsrvr.org
oa.openxcdn.net
p.ad.gt
p.rfihub.com
pagead2.googlesyndication.com
pippio.com
pixel-sync.sitescout.com
pixel.tapad.com
pixels.ad.gt
pr-bh.ybp.yahoo.com
prebid.cootlogix.com
prebid.media.net
proton.ad.gt
px.ads.linkedin.com
rtb.openx.net
rumcdn.geoedge.be
s.amazon-adsystem.com
s.nitropay.com
s0.2mdn.net
secure.adnxs.com
secure.cdn.fastclick.net
securepubads.g.doubleclick.net
seg.ad.gt
ssum-sec.casalemedia.com
static.cloudflareinsights.com
static.criteo.net
sync.cootlogix.com
sync.go.sonobi.com
sync.mathtag.com
sync.srv.stackadapt.com
tags.crwdcntrl.net
targeting.unrulymedia.com
tlx.3lift.com
token.rubiconproject.com
tracker.nitropay.com
u.openx.net
webnovelsai.com
wrappers.geoedge.be
www.google-analytics.com
www.googletagmanager.com
www.keqingmains.com
x.bidswitch.net
s.amazon-adsystem.com
104.18.2.78
104.18.41.104
107.178.254.65
108.138.106.108
108.138.115.149
108.138.128.28
108.139.48.9
130.211.23.194
142.250.65.162
142.250.65.194
142.250.65.200
142.250.65.238
142.250.81.238
142.251.32.102
142.251.40.130
147.182.142.243
147.182.176.100
172.64.151.101
172.64.152.89
172.67.172.77
172.67.185.95
172.67.193.156
185.184.8.90
199.38.167.130
207.65.37.184
216.200.232.253
23.203.179.38
23.223.209.209
23.56.162.28
23.56.163.106
2600:1f18:4e9:5a07:f379:24db:109a:de72
2600:9000:247b:e200:2:d490:4d80:93a1
2600:9000:2511:6e00:4:b37b:9440:93a1
2600:9000:266a:400:10:43f:4340:93a1
2602:803:c002:200::32
2606:4700:10::6816:3456
2606:4700:10::6816:35ad
2606:4700:10::6816:545
2606:4700:10::ac43:17ea
2606:4700:10::ac43:293c
2606:4700:20::ac43:4513
2606:4700::6810:5049
2606:4700::6812:ba1f
2607:f350:3:2569:0:10:0:a
2607:f350:3:2569:0:10:0:d
2607:f8b0:4006:80c::200a
2607:f8b0:4006:80e::200e
2607:f8b0:4006:80f::2001
2607:f8b0:4006:816::2008
2607:f8b0:4006:817::200e
2607:f8b0:4006:821::200a
2607:f8b0:4006:823::2006
2620:100:a00b::4
2620:1ec:21::14
3.218.122.15
3.236.57.101
34.102.146.192
34.111.113.62
34.120.63.153
34.36.216.150
34.98.64.218
35.211.202.130
35.227.252.103
35.244.144.25
35.244.154.8
35.244.159.8
35.71.131.137
35.71.139.29
52.2.190.100
52.24.239.47
52.46.143.56
54.159.145.75
68.67.160.186
69.173.151.100
69.194.240.11
74.119.117.6
006b6d64d07be11c46ecbbff71b2a1a7ed3d408a26687241849ff1bc0d177015
0252600ecbed609ad12306983a27067828685d3fa1552113d3d21c817dec9d90
02f368e3e00cd0895bdd319438b927d3ff463bfb538bb5ba29d376e863cc7a16
04deb78d309b904f08c3edf766e6fcdb92a63002e4f04e522a1e67d678ef777a
0562a13430ea6507a81a32a76c0ecf28ba5279a56448cb24d47123334fbaa766
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
0691d3c3e5f0c0a22b1c7de123b1c0868112538d17023b842a75829e238a8c03
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06e38460a0bf0f44161d62a6464695b44fb3f4adedc3b2807c511bb68ff89878
07005bb65e83788fa03e1aea148ca8e22ce8789f1e73f5d83150315382ccc7ca
07dd1c3d2d338804448058545cf553151e2b63b099047067c7a7cc31b7b6b821
0a364be4b6af0c1f3f5a8396cd9e35563e488aa820d02b17655b11f94dc37c95
0a720bc83f72d17849bd213570ed808ae6b430fa5f3d50dc7fdb32413f7ade01
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bdbc152035040cd1ea9e54cb34fe3c648438db0637c7fcb35109a8ac049a574
0d9db0bc787491b0bef26558aa356cb9a980c74a7417c5278cad4c0497b1a2ba
10499271384b842b53a4c882e1d86fb2bea33e97430928a0f9bcffcd5b7f17af
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
131e71a1bfc433990f6a43a5fa4da6a269a5faabd7c310db4356dd3be639d1ad
1a9e851d1650a43f06e367984a24f4cb9cce7b2a13c039d6173f2cd12394fe6c
20be9b3c63a01d921697a0ef1c1596f647678498eefe6dc508e2363be25277f8
219aa860d0d8f8173da0ccdb5c385c4171ec91481764dd32fbc67e6c8ebe3f17
264858c82f3cb01d2a0b54831074538e1134cd3c3080fd64404d6ec6c335757e
264a7a3f6b4cd2c915c1ecf881f9f1db575d999646eb68985d355bb53a215fdf
27fa38db3d75c78ebcf4fde1e00421653b6550612d8be86ec461bb0893cfabca
2aa5749e39fd54de253a61f0601bf9b75425b485ad33dcd47b9f42f69e51ec22
2ad138fffd1ef33e101aeb01bf6962787e069d7367f4bba45cd1eba4231a89ed
2af0638dacb90122dacc1de00a1229bdc109157c3bceed6aecc1ca3516668b22
2c2dfe6e5ac215728c72b90926e35a22da1e6a5424094bb20d80bc78c5280f03
2c42391fc43043ff71e168a5b881e9ed95bd1e18480f8d2dc5dc77e9624f7797
30b32e97f2e3e06deb742bf2e19daeb4f4657a956e836c2a25a7df2bc72f7500
33a3b2b4bb13ccc6ea24e09ac28cf3934212a8191289ff8e032b8a25d84997f8
33c70c297b1a729f965a6aca60b7b3bb7a3b06bd13efe07698516fa98ac8b9f9
353084a56f108105c69f98b94e44f851f61aca314d465d5591a7698f1ea00461
3b6ddc84f1a652048a754eb3ce26fa0513e8015c85b6ff00223fd9b7433c782e
3db99837ccd549701c0167668ca20bd8f849e749982563b4a84d6dd9fe365f58
3e44ad339a57ea4e2911a92a7dbe6fff4b9867da387563b4997701bf70858467
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3fc4fb491c573ab23eededc46f4ba9fe909a93b88f1ffd9218869ab413056c3e
40d3155aba7594ec43e3a0fb10f6b0c922815701b09861664150bdd5d4311f95
414878d5f95d09d4b5e65cdcdda185c7be3c775ba366add3b36d31479707b926
41fd18521ddf546cfeff37ae285c1a0dd24fe20f6d71f5b36e32a0124a40f99f
42b886f2077269e007ca68cf3ea0fb734e35b0da5ddf403560e4cdc32ba282bb
436bac3de075756eccfcc48cca98f864eaf0a5f7d46be45c3ee820efd4adfc3b
43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff
44991c668c6dd957d7721311365b087e17448385c2511d4e7525c6fc48f84815
492db2ca577f4d221e3e28239c19e7db05f1701b298bf278fc4d1fcb92563586
49fffc8e4a933146d9811902f403f64d91e5d0f0e444e3eacee7a4938ddb4dc4
4e6f36cc1ee2825124f5231e5f32182d4e0f045cd9b60bbd05f6482976c5d9d6
5030f965deceff14b94eb2780b06c37783a791f92d546dc24fd4922721b8582b
54324bcceff03dbc7a1482a4589a321dc190a1419ef190553b8351d7c7648716
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9
54f88341f4c5cef033edf9ac0484a99ac2095ccfd1c56314218f471af7c81c16
58c855e7eb9b917e71e6b733e73c542c25bacb986f3ba7df2be1570200312135
5b9cfa0283d9a9f6a909df2b61c9933c11130343f08aec96cdd8f49c29972526
5ce5f6f6af82674cd3c8f7f8640556d21112deb2718812dcace5ad1eb0cfcc7e
5cee8d8b9d467a474abbfb821bf59a4d8e2b2c98ede8870234d676c837569e1e
5d39f5ed48e498c81253ee9aad52fd996a814257489afabe5166dbe572088ee9
5d6e63f307669cd8b20434020de5747fd61a8e481c266dc6891c6b86a75aad14
5da26dfdbd824c88ae390fb9b8390f4a29242275434d79c644e39e1e0f85532c
5dd3cece395882a5141f104ebe5e1a7f56d9f6520a93661902c3efdf8e729d91
5e8020e3d61bfee03a48ca66498521053b0bdcc1a3d8791250ac9bf0f768cbf2
6219c6d2c7ab41596c47189ba137821caebeb0dbdcbbe8889c4ee24994084faf
62f74b1cf824a89f03554c638e719594c309b4d8a627a758928c0516fa7890ab
63aec577e18e7dee271b7bf5e09a95e0e162e3981b4738fbe54e6b8c8cd35089
643dd30ac55596b07a4817ae0b058d496b5d5fee5efff3532533d9072bbeef38
66776998b10e583a72f8fd29391a50e2c80eb3bc9a65b0dafe97e576d7d88507
68de9947c014ba26a1d48132dc5a94697f4c575972d2944da8e496f5780fd7b2
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6bac6349351916700c5ee69dfb78c175d71f026ead3b334f2477376e5f52db2a
6bc9221042e80ff55ffb7c43cf4207aa35afcc9a9aec1d9675da3bd4a41dd4f8
6cee8a9b84cca3205cc6eccaa32c65de20b972efe7a06731ca020ccb8f16c237
6cf2c7c16287156d8fee8aced6a750cdc7f73d02fca99d10992dc5d73a275bf2
6ec59cebcb824176265d0d4f97417e9e3d5b7f96c5252ce6f788126a8861e747
6fdb7c12792ebd6e785128456249178e9b508c9677a300df8fbc6e7520147baa
704fd3569872b88068057bb5852f593dcade58ebcbd4aee0e303accae696056f
7098528b458dc31ac4a8ffa6166be0309fd2f36ad7ebec28ab2c60f222edb80b
70d791d587d64a5694f37ce7927a71f38d4b8d7b0c643a51d6ceeb3d26201e30
712369aef7db8ee613780ed94892762890345add2113c7749b2f03b819c0a4fc
775a02c37772954d38fe41b802b94a0ee37dccb98a03827cdef3eddd2abc13d1
784d4b038004a104c0243dbb9f8ddeb90e3d25be1865577a8aaaf4ed972b7417
797a9741ccc17299503578674e6e98c46fc60246337d1511b26b28b5f03af0bc
79efcdb1426bb34dbca8312341780d42c7022a92ddac01e620c8d04e381f5914
7d8ac8a409f34c22d8c7196a121bb9954eda8fea5a4e83c752da71a3b6d53959
7d9eb239afd91fca6d3602571e40d9e5dfc16edc9fe2e8074651e0b228fd1919
7df15191038a38f830e855233cab604891635f74541dd3680ab4abcf8442ad6e
82792dd2bb6b493c2aa5000dcbb067b18f06121d03f454e16a188a3e6e67276c
827eba33ff7f627627e79285ae329f7269998b7ca965f96f2c1ee59ce7116406
83e8554cb19f8fb449a742ddc017568b0a74e08d771498ff4088b0f4fb41c313
846846e7240f09047df2221ac35216258f9afce46c5043cf7e1975df389c79bd
846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b
85128143a6ae724da3e9d71d3d276c3a3e79c347a5ee4745142faaaad35a6024
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4
8a024dd7820e2cbc97d9acea0b1aeb555a529c924ac65e615bbcdb3f3146a54f
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
8a2ab36c83d5d55e311fbf787dbc7de0a17b89eb0b30b1772f518a79db334001
8aa9a6ff115fb15b144cdfc76be8ae14cb49439daf9ddc1a7caf29bfa387910f
8ba19a20a0168f0d770864fecc18010cdadd87daba010bb37caed2d182c2946b
8e1b84265e633c043720dd0921476c16bc9f75e393e855c9116ca7c3a847b5c7
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
9006171bbbacaf04ad7f3c0d047c7183ac693dcdca6c70fa2c180f90079b1c41
91d5e898e7717945e369fa992ef4ed50d2697c102d26bd8c0b0d5ccc6743923f
920b790d251ec18c573d8966f2699475b3ecf848fde4bb331d95d5be255b72f6
93f5340be787ad57c98fdcbc4f8a1aaf3b67a4ffa62e1c8e0abb5e98fe88a673
9934ab1e56240576ee15734643323fdb2f92ba6c9b1fe9aaf435078faaed38cf
9956e5379e21e76783759961d879892394c4d45f30074cb03415b5b67ca42f47
9c679277d6930c0935ebde6e9e465c41a60ab546d26cfd96cd656ff6f3c9af46
9f5500d17042bda82d8edb2a270d4181506a8d2c0fc9906bf42f57a9882a64fa
a092bcc80c5e3c0a5dcae2ae6733af0381a926049ea39633c075f31075530f33
a0f0fa7f333e1e2e4510bef36e8a4b3f4be5f284d1bee62bf66e1740194a05fc
a3c684655428e5082088953a6cadc6b3815f52094cd9bc1e43389c8320fb7fba
a655f0540cff07142a61f6aac327592d767f2e70a11cf7c9d031eb62d88aa7ac
aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4
ad3782846773d9fd85e679f239814c72e43c994e6a521ddc516ac6aa859075f6
af9747cbe0f1d8d87ea0347804376d6e3140c733d2e29ae08f11298d8b1d28ae
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
afe1a55f7dc63bacfa1253a5a88233c62dc4d40965ca7f7835b827d1fe83c818
b023af9d9a9bde7e7f6136b1ba2fbcc5807af1c5f6dac17b383c29a8692f851c
b3549d45fa65a3f7d3911d58c6493d9884e782eaf3bacc8e2d4e501229661031
b5fd639beacbe103ab8112ed843e493a92d40188bf126b497df761802c0f1406
b7f6896554e5d137a0c1a3fcd424b4f7c3ef36c3cf642700f847c3204553c27c
b88fca268e1352a0922f301c6b88f0499606c01faa8d0718de11a8153a5edc3a
b8f0ca68362cf245f891fc09ddfa50806d195e78e196cf96ac5d9cf72be2577a
b9a8d9e205370f19c771173e024c2eb4850d7f596d14796d6010bf9db0f792e5
b9bb7345d06a9b8f756628804f59742eaa0bf760aca8581345f96f03d293d286
ba1502a803f8732ec8af88147f79b0c1c0c0d095207c8eb174f183d8c9c5b8d1
ba6fc7291382afd4db70cf3f7864e3fdc4433e31d9603fa3865e0344c8741efa
bdece35135342a5afc1ec79832e95d4be85141acdca0630d25b39ad82824e185
c128e825ece6acdfbca49f0d30dce72d74abe639dd4e9f27cdd213390c5a6125
c312f4359cd34b67c15308e9c5e80f61d4c42eedc6985936da168eb60a3cb6d4
c3f6c6207bb7c29ac03c61c81b9774dbe42c3754ae4d5b14a3abdad8f8eec3eb
c4f5f4f49c1e5c5797093a90bb5abec9594429c8b1f0d69ede9e381ab9cdf9c2
c54826e05a2f28188da1dc3f4c5d4e656246906e7e43c43f45632ba0d467c4e7
c6bfc83a5b0a4516d0356fd463bb9da45655d025378bb581049f85bc8fccf87e
ca1334ac75220a7273fa1feecac99be82876950c1a54056d4f19c2fe7ef8cf14
cb3f2fc5b6c442153535679f667a0e7b39f3ce5954f665b878899eda3f89504e
cb95a582de73802e636457f750ccc00545d657ed918d385cd95d32c60ee1ae56
cdc6c80bf9b1bf05d0cf3fbfb7f5b18c960307471af6190eb1b68a76f7cdec29
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54
d1d52fe6d9363ed21c47c5f6c44a7ca75c59dada42492bc87398fe85df669033
d7c256e7cafa896a90a65bbfb10d3e02d302d4ef02bfd4c0ab15397a1fadf3af
d8688fe233ca17120e18097051f989d40756e35fc6b930efbd6da6dc0811526d
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de5efccfe2ee17b8c8b60f9c6aeb6345dce664faf30087618a7bdcab3d0f5bc1
deaf98ef17a0c1ade86e0bb1d5cc78a56f72ae827d8d5e3cef4edfbd4fe01a57
e21a8a9bf0dc931e42935bf06fcf6c104cc05d015375c23a8be779dedeb35429
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e44f89d8336281696075a1c36377e3949617f53f113c0cef667e5625671c4d87
e47021acbbf7c80d41c292e5e45782a63244ebe1284cb76738b7536777c40626
e70ca8adaf2a3332da66ebfade75f960e19897b45fad5a93e5215bbe436b575c
e73a9ebbfc1d2394c13d8a38721d66ae2ef42b6c5ad2206af949498809602bf1
e8669d8011a8f4aacae9efbde86820503d379cfd80be7d62215e95e5b8f84fe9
ea8df23700e799287216855b0cbf8210647757725ce6464b113d1945f8202670
eb9bda901746b11d31201634e958852c9fa6051e73b779ced39a4d291c10dc6e
ec2abddda17d263f847005252ec4184763f00415ff0472c58be8508f39f05031
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f05f6135a8445097c3aceff10a0195461582292b97c189919eb6905bacaa207a
f82459f8fe4be4d767220367b0ff2463eba2d4dc9ab6dbc523a5c76367de2b37
fc91b779307ff79ddb447185bea7033ac4a6fe49ee48ec73ae3e40a578faf9a1
fe6f601ea540a8ae0e4a32395893fec25b4e8168f282f608c342515ecb6e0317

keqingmains.com Open in urlscan Pro 172.67.185.95 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

235 Requests

91 %HTTPS

32 %IPv6

50 Domains

80 Subdomains

65 IPs

3 Countries

4935 kBTransfer

9542 kBSize

219 Cookies

37 Outgoing links

Page URL History

Redirected requests

235 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

keqingmains.com Open in urlscan Pro
172.67.185.95 Public Scan

Screenshot
Live screenshot

Full Image

235
Requests

91 %
HTTPS

32 %
IPv6

50
Domains

80
Subdomains

65
IPs

3
Countries

4935 kB
Transfer

9542 kB
Size

219
Cookies

235 HTTP transactions
0 data transactions