voticle.com Open in urlscan Pro
2606:4700:3032::6815:235e Public Scan

Go To Rescan
Add Verdict Report

URL:
https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Submission: On September 08 via manual (September 8th 2021, 7:56:09 am UTC) from US

Summary HTTP 129 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 29 IPs in 2 countries across 20 domains to perform 129 HTTP transactions. The main IP is 2606:4700:3032::6815:235e, located in United States and belongs to CLOUDFLARENET, US. The main domain is voticle.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 11th 2021. Valid for: a year.

This is the only time voticle.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
4	2606:4700:303... 2606:4700:3032::6815:235e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
33	2606:4700:303... 2606:4700:3033::6815:3653	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
8	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
1	2.16.186.128 2.16.186.128	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	34.96.96.52 34.96.96.52	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:3::718 2a04:4e42:3::718	54113 (FASTLY) (FASTLY)
1	2606:2800:133... 2606:2800:133:206e:1315:22a5:2006:24fd	15133 (EDGECAST) (EDGECAST)
1	13.225.30.184 13.225.30.184	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
1	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
18	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:803::2002	15169 (GOOGLE) (GOOGLE)
2	2.18.235.93 2.18.235.93	16625 (AKAMAI-AS) (AKAMAI-AS)
4	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
4	2a03:2880:f12... 2a03:2880:f12d:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
6	2a00:1450:400... 2a00:1450:4001:827::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:831::2004	15169 (GOOGLE) (GOOGLE)
129	29

4 2606:4700:3032::6815:235e (United States)

ASN13335 (CLOUDFLARENET, US)

voticle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 2606:4700:3033::6815:3653 (United States)

ASN13335 (CLOUDFLARENET, US)

fonolive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.186.128 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-128.deploy.static.akamaitechnologies.com

image.slidesharecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.96.52 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 52.96.96.34.bc.googleusercontent.com

productimages.hepsiburada.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:3::718 (United States)

ASN54113 (FASTLY, US)

i.ebayimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:133:206e:1315:22a5:2006:24fd (United States)

ASN15133 (EDGECAST, US)

az31823.vo.msecnd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.30.184 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-30-184.cdg3.r.cloudfront.net

z-na.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:803::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.235.93 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-93.deploy.static.akamaitechnologies.com

contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f02d:12:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f12d:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:827::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:831::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
33	fonolive.com fonolive.com	2 MB
21	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	523 KB
14	doubleclick.net googleads.g.doubleclick.net	13 KB
10	googleapis.com fonts.googleapis.com ajax.googleapis.com	126 KB
9	google.com adservice.google.com www.google.com	2 KB
8	bootstrapcdn.com maxcdn.bootstrapcdn.com	99 KB
6	google.de adservice.google.de	927 B
4	facebook.com www.facebook.com	564 B
4	facebook.net connect.facebook.net	226 KB
4	voticle.com voticle.com	40 KB
3	googletagservices.com www.googletagservices.com	81 KB
3	gstatic.com fonts.gstatic.com	51 KB
2	media.net contextual.media.net	100 KB
2	google-analytics.com ssl.google-analytics.com	17 KB
1	googleadservices.com partner.googleadservices.com	657 B
1	amazon-adsystem.com z-na.amazon-adsystem.com	8 KB
1	msecnd.net az31823.vo.msecnd.net	67 KB
1	ebayimg.com i.ebayimg.com	10 KB
1	hepsiburada.net productimages.hepsiburada.net	47 KB
1	slidesharecdn.com image.slidesharecdn.com	15 KB
129	20

	Domain	Requested by
33	fonolive.com	voticle.com
15	pagead2.googlesyndication.com	voticle.com pagead2.googlesyndication.com fonolive.com tpc.googlesyndication.com
14	googleads.g.doubleclick.net	pagead2.googlesyndication.com
8	maxcdn.bootstrapcdn.com	voticle.com maxcdn.bootstrapcdn.com fonolive.com
6	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com
6	adservice.google.com	pagead2.googlesyndication.com
6	adservice.google.de	pagead2.googlesyndication.com
6	fonts.googleapis.com	voticle.com fonolive.com
4	www.facebook.com	fonolive.com
4	connect.facebook.net	fonolive.com connect.facebook.net
4	ajax.googleapis.com	voticle.com fonolive.com
4	voticle.com	voticle.com
3	www.google.com	tpc.googlesyndication.com
3	www.googletagservices.com	pagead2.googlesyndication.com
3	fonts.gstatic.com	fonts.googleapis.com
2	contextual.media.net	fonolive.com
2	ssl.google-analytics.com	voticle.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	z-na.amazon-adsystem.com	voticle.com
1	az31823.vo.msecnd.net	voticle.com
1	i.ebayimg.com	voticle.com
1	productimages.hepsiburada.net	voticle.com
1	image.slidesharecdn.com	voticle.com
129	23

This site contains links to these domains. Also see Links.

Domain
fonolive.com
www.facebook.com
twitter.com
reddit.com
www.linkedin.com
www.tumblr.com
anotepad.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-06-11` - `2022-06-10`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
slidesharecdn.com R3	`2021-08-09` - `2021-11-07`	3 months	crt.sh
*.hepsiburada.net Sectigo RSA Domain Validation Secure Server CA	`2021-03-08` - `2022-03-08`	a year	crt.sh
i.ebayimg.com DigiCert TLS RSA SHA256 2020 CA1	`2021-08-31` - `2022-08-31`	a year	crt.sh
*.vo.msecnd.net DigiCert SHA2 Secure Server CA	`2020-11-16` - `2021-11-10`	a year	crt.sh
z-na.amazon-adsystem.com Amazon	`2020-12-12` - `2022-01-10`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.media.net DigiCert SHA2 Secure Server CA	`2021-04-12` - `2022-04-20`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-06-18` - `2021-09-16`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh

This page contains 23 frames:

Primary Page: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Frame ID: 50EFB38C0C96E143123FA4EEC555890B
Requests: 75 HTTP requests in this frame

Frame: https://fonolive.com/promoted-ads
Frame ID: 86AFD7EEBF09DAB6A9FEFC8EA6FB9243
Requests: 19 HTTP requests in this frame

Frame: https://fonolive.com/promoted-ads
Frame ID: 05193E0DCE495DA466DD3FD5A4C1DA80
Requests: 19 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210901/r20190131/zrt_lookup.html
Frame ID: F7CD99EB5B778173D5FF9D31F665F733
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=600&slotname=8250817351&adk=2440252158&adf=1492073588&pi=t.ma~as.8250817351&w=165&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=165x600&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750682&bpp=4&bdt=284&idt=72&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&correlator=635887018840&frm=20&pv=2&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1220&ady=601&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=1&uci=a!1&fsb=1&xpc=glz1eLIm9N&p=https%3A//voticle.com&dtd=86
Frame ID: 2D311F5C8BE8A8490C9AE60320E40A16
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=600&slotname=9376916555&adk=3757388224&adf=3248948864&pi=t.ma~as.9376916555&w=165&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=165x600&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750686&bpp=1&bdt=288&idt=93&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1220&ady=1201&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=4WdTJLlOhP&p=https%3A//voticle.com&dtd=97
Frame ID: 109A171D89B49BAF18C2A499321B9D80
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=600&slotname=8250817351&adk=2440252158&adf=1531977944&pi=t.ma~as.8250817351&w=165&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=165x600&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750687&bpp=1&bdt=288&idt=99&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600%2C165x600&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1220&ady=1801&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=KuJH0tjWpL&p=https%3A//voticle.com&dtd=101
Frame ID: 745972F138C5278BDF91AF8FC0704420
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&slotname=8250817351&adk=3333677467&adf=1475420161&pi=t.ma~as.8250817351&w=443&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=443x280&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750688&bpp=1&bdt=290&idt=103&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600%2C165x600%2C165x600&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=733&ady=601&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=4&uci=a!4&fsb=1&xpc=72zbaIkAG7&p=https%3A//voticle.com&dtd=106
Frame ID: 7B655B91AF25972E58FFC577C3FF163E
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&slotname=8250817351&adk=248325190&adf=3531856095&pi=t.ma~as.8250817351&w=1140&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750689&bpp=1&bdt=290&idt=109&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600%2C165x600%2C165x600%2C443x280&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3286&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=kBvx26Tnfk&p=https%3A//voticle.com&dtd=111
Frame ID: C691F69437CBF045E149E1FB225DD851
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&slotname=9376916555&adk=3224866322&adf=2455508272&pi=t.ma~as.9376916555&w=1140&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750689&bpp=1&bdt=290&idt=114&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600%2C165x600%2C165x600%2C443x280%2C1140x280&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3566&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=tP2K7mf2E8&p=https%3A//voticle.com&dtd=115
Frame ID: DE8E21AA6331B5500C6DE56887010182
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&slotname=8250817351&adk=2688178878&adf=14637539&pi=t.ma~as.8250817351&w=360&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=360x280&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750690&bpp=1&bdt=292&idt=117&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600%2C165x600%2C165x600%2C443x280%2C1140x280%2C1140x280&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1010&ady=4219&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=D1Kq1VlUfn&p=https%3A//voticle.com&dtd=119
Frame ID: C0A7A3A489CDE5A18CED918BA0DD7C34
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&adk=1812271804&adf=3025194257&lmt=1631087750&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750864&bpp=1&bdt=466&idt=1&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600%2C165x600%2C165x600%2C443x280%2C1140x280%2C1140x280%2C360x280&nras=1&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=33792&bc=31&ifi=9&uci=a!9&fsb=1&dtd=5
Frame ID: 8017AB4BDB397E67FEAF92F4964956EE
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&adk=617080280&adf=3730911173&pi=t.aa~a.3611581317~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1631087751&rafmt=1&to=qs&pwprc=8256796650&psa=0&format=1140x280&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750993&bpp=1&bdt=594&idt=1&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9f287233d4edc8c4-2269351afcc800af%3AT%3D1631087750%3ART%3D1631087750%3AS%3DALNI_Mbn-iqNYL53ITuvI6ijpCGz0YxTHg&prev_fmts=165x600%2C165x600%2C165x600%2C443x280%2C1140x280%2C1140x280%2C360x280%2C0x0&nras=2&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=1152&bc=31&ifi=10&uci=a!a&btvi=6&fsb=1&xpc=hofl2SJeIH&p=https%3A//voticle.com&dtd=14
Frame ID: 9F7BD95C2E8F848896F52DB730966370
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&adk=1812271804&adf=3279755397&plat=1%3A1536%2C2%3A1536%2C8%3A134218240%2C9%3A134251016%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C26%3A512%2C27%3A512%2C30%3A1049088%2C32%3A32&format=0x0&url=https%3A%2F%2Fvoticle.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087753562&bpp=2&bdt=84&idt=52&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&nras=1&correlator=7216094358391&frm=24&ife=1&pv=2&ga_vid=622920125.1631087754&ga_sid=1631087754&ga_hid=877285634&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=1200&ish=295&ifk=2445910273&scr_x=-12245933&scr_y=-12245933&eid=42530672%2C44747621%2C31060033%2C31062297&oid=3&pvsid=1014470750789572&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1200%2C295&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=1&uci=1.y90ggrjtgiyo&fsb=1&dtd=66
Frame ID: 908646FA4984E5680AF4F978416E76F9
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&slotname=8250817351&adk=248325190&adf=123856640&pi=t.ma~as.8250817351&w=1140&fwrn=16&fwrnh=100&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fvoticle.com%2F&ea=0&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087753564&bpp=1&bdt=86&idt=71&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=7216094358391&frm=24&ife=1&pv=1&ga_vid=622920125.1631087754&ga_sid=1631087754&ga_hid=877285634&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=1200&ish=295&ifk=2445910273&scr_x=-12245933&scr_y=-12245933&eid=42530672%2C44747621%2C31060033%2C31062297&oid=3&pvsid=1014470750789572&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1200%2C295&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=2.mnrzxzw8jvjp&fsb=1&dtd=81
Frame ID: AC43874396A0FA546B14BC1CBD9CA705
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&adk=1812271804&adf=3279755396&plat=1%3A1536%2C2%3A1536%2C8%3A134218240%2C9%3A134251016%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C26%3A512%2C27%3A512%2C30%3A1049088%2C32%3A32&format=0x0&url=https%3A%2F%2Fvoticle.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087753773&bpp=2&bdt=89&idt=51&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&nras=1&correlator=4291511303119&frm=24&ife=1&pv=2&ga_vid=2021952632.1631087754&ga_sid=1631087754&ga_hid=1095933314&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=1200&ish=295&ifk=2445910273&scr_x=-12245933&scr_y=-12245933&eid=42530671%2C31062297&oid=3&pvsid=1416224256187787&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1200%2C295&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=1&uci=1.6twtcihz6j0b&fsb=1&dtd=69
Frame ID: CC0B096C58F0A41F2AD17A100B0E7D64
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&slotname=8250817351&adk=248325190&adf=123856643&pi=t.ma~as.8250817351&w=1140&fwrn=16&fwrnh=100&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fvoticle.com%2F&ea=0&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087753775&bpp=1&bdt=91&idt=76&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4291511303119&frm=24&ife=1&pv=1&ga_vid=2021952632.1631087754&ga_sid=1631087754&ga_hid=1095933314&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=1200&ish=295&ifk=2445910273&scr_x=-12245933&scr_y=-12245933&eid=42530671%2C31062297&oid=3&pvsid=1416224256187787&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1200%2C295&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=2.pa6qf56u657v&fsb=1&dtd=80
Frame ID: 92BE54A09598449706EF28EC67CFFE72
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 988AAF6DEA5DBE1BF59FBED434267198
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 83F45D41665ECF793A2AB5F4D22314FA
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 2EDF6281178B1954873D0BC0BF706636
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 6AB2DEC18766C2EA3BC63037982E2BDA
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 2E61366968B38973D75F0E022DACE0FA
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: E5E8AB37D7FB7A7AB3582CCEF7C5198B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Getting My TRIPLE BUY 3 x Herbalife Protein Bars (42 Bars) - Great to be To Work

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

129
Requests

100 %
HTTPS

82 %
IPv6

20
Domains

23
Subdomains

29
IPs

2
Countries

3352 kB
Transfer

5907 kB
Size

8
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://fonolive.com/online-users
Title: Meet new

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Title: //<![CDATA[ (function(){for(var g="function"==typeof Object.defineProperties?Object.defineProperty:function(b,c,a){if(a.get||a.set)throw new TypeError("ES3 does not support getters and setters.");b!=Array.prototype&&b!=Object.prototype&&(b[c]=a.value)},h="undefined"!=typeof window&&window===this?this:"undefined"!=typeof global&&null!=global?global:this,k=["String","prototype","repeat"],l=0;l<k.length-1;l++){var m=k[l];m in h||(h[m]={});h=h[m]}var n=k[k.length-1],p=h[n],q=p?p:function(b){var c;if(null==this)throw new TypeError("The 'this' value for String.prototype.repeat must not be null or undefined");c=this+"";if(0>b||1342177279<b)throw new RangeError("Invalid count value");b|=0;for(var a="";b;)if(b&1&&(a+=c),b>>>=1)c+=c;return a};q!=p&&null!=q&&g(h,n,{configurable:!0,writable:!0,value:q});var t=this;function u(b,c){var a=b.split("."),d=t;a[0]in d||!d.execScript||d.execScript("var "+a[0]);for(var e;a.length&&(e=a.shift());)a.length||void 0===c?d[e]?d=d[e]:d=d[e]={}:d[e]=c};function v(b){var c=b.length;if(0<c){for(var a=Array(c),d=0;d<c;d++)a[d]=b[d];return a}return[]};function w(b){var c=window;if(c.addEventListener)c.addEventListener("load",b,!1);else if(c.attachEvent)c.attachEvent("onload",b);else{var a=c.onload;c.onload=function(){b.call(this);a&&a.call(this)}}};var x;function y(b,c,a,d,e){this.h=b;this.j=c;this.l=a;this.f=e;this.g={height:window.innerHeight||document.documentElement.clientHeight||document.body.clientHeight,width:window.innerWidth||document.documentElement.clientWidth||document.body.clientWidth};this.i=d;this.b={};this.a=[];this.c={}}function z(b,c){var a,d,e=c.getAttribute("data-pagespeed-url-hash");if(a=e&&!(e in b.c))if(0>=c.offsetWidth&&0>=c.offsetHeight)a=!1;else{d=c.getBoundingClientRect();var f=document.body;a=d.top+("pageYOffset"in window?window.pageYOffset:(document.documentElement||f.parentNode||f).scrollTop);d=d.left+("pageXOffset"in window?window.pageXOffset:(document.documentElement||f.parentNode||f).scrollLeft);f=a.toString()+","+d;b.b.hasOwnProperty(f)?a=!1:(b.b[f]=!0,a=a<=b.g.height&&d<=b.g.width)}a&&(b.a.push(e),b.c[e]=!0)}y.prototype.checkImageForCriticality=function(b){b.getBoundingClientRect&&z(this,b)};u("pagespeed.CriticalImages.checkImageForCriticality",function(b){x.checkImageForCriticality(b)});u("pagespeed.CriticalImages.checkCriticalImages",function(){A(x)});function A(b){b.b={};for(var c=["IMG","INPUT"],a=[],d=0;d<c.length;++d)a=a.concat(v(document.getElementsByTagName(c[d])));if(a.length&&a[0].getBoundingClientRect){for(d=0;c=a[d];++d)z(b,c);a="oh="+b.l;b.f&&(a+="&n="+b.f);if(c=!!b.a.length)for(a+="&ci="+encodeURIComponent(b.a[0]),d=1;d<b.a.length;++d){var e=","+encodeURIComponent(b.a[d]);131072>=a.length+e.length&&(a+=e)}b.i&&(e="&rd="+encodeURIComponent(JSON.stringify(B())),131072>=a.length+e.length&&(a+=e),c=!0);C=a;if(c){d=b.h;b=b.j;var f;if(window.XMLHttpRequest)f=new XMLHttpRequest;else if(window.ActiveXObject)try{f=new ActiveXObject("Msxml2.XMLHTTP")}catch(r){try{f=new ActiveXObject("Microsoft.XMLHTTP")}catch(D){}}f&&(f.open("POST",d+(-1==d.indexOf("?")?"?":"&")+"url="+encodeURIComponent(b)),f.setRequestHeader("Content-Type","application/x-www-form-urlencoded"),f.send(a))}}}function B(){var b={},c;c=document.getElementsByTagName("IMG");if(!c.length)return{};var a=c[0];if(!("naturalWidth"in a&&"naturalHeight"in a))return{};for(var d=0;a=c[d];++d){var e=a.getAttribute("data-pagespeed-url-hash");e&&(!(e in b)&&0<a.width&&0<a.height&&0<a.naturalWidth&&0<a.naturalHeight||e in b&&a.width>=b[e].o&&a.height>=b[e].m)&&(b[e]={rw:a.width,rh:a.height,ow:a.naturalWidth,oh:a.naturalHeight})}return b}var C="";u("pagespeed.CriticalImages.getBeaconData",function(){return C});u("pagespeed.CriticalImages.Run",function(b,c,a,d,e,f){var r=new y(b,c,a,e,f);x=r;d&&w(function(){window.setTimeout(function(){A(r)},0)})});})();pagespeed.CriticalImages.Run('/mod_pagespeed_beacon','https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work','nXzXivl0t7',true,false,'8HgIdBsURuE'); //]]>

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&text=Getting+My+TRIPLE+BUY+3+x+Herbalife+Protein+Bars+%2842+Bars%29+-+Great+to+be+To+Work%0A;hashtags=voticle
Title:

Search URL Search Domain Scan URL

URL: https://reddit.com/submit?url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&title=Getting+My+TRIPLE+BUY+3+x+Herbalife+Protein+Bars+%2842+Bars%29+-+Great+to+be+To+Work%0A
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Title:

Search URL Search Domain Scan URL

URL: https://www.tumblr.com/share/link?url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&title=Getting+My+TRIPLE+BUY+3+x+Herbalife+Protein+Bars+%2842+Bars%29+-+Great+to+be+To+Work%0A
Title:

Search URL Search Domain Scan URL

URL: https://fonolive.com/
Title: Fonolive.com, Fastest Growing Social Classifieds Marketplace

Search URL Search Domain Scan URL

URL: https://anotepad.com/notes/6kq9mtf5
Title: Check Here For More

Search URL Search Domain Scan URL

URL: https://fonolive.com/adults-escorts-erotics
Title: Backpage Escorts

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

129 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work Show response
voticle.com/a/articles/163591/ 139 KB
37 KB 7248ms
7222ms Document
text/html 2606:4700:3032::6815:235e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::6815:235e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89be7b88d2278768de9590c4041d98ce65df81ad0b659a6399e23afb54533e26

Request headers

:method: GET
:authority: voticle.com
:scheme: https
:path: /a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:50 GMT
content-type: text/html; charset=UTF-8
set-cookie: PHPSESSID=8u4cv57pnq46d1k5o26l95en74; path=/
cache-control: max-age=0, no-cache, no-store, must-revalidate
pragma: no-cache
vary: Accept-Encoding
x-mod-pagespeed: 1.13.35.2-0
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EtcAVMwy9RRUuRQBHyce%2FnInHmJoXe%2Fgp9lQLjobz6Q1MuOE0WSBpI6zAu%2BFMxihUfg%2FSAaMgQu8AIxpPwlN52lqeOJWFBqXLnLOUo%2FHzCf%2BepdXhfve3FyraqrRgrBpzYKaaJEkW4mjkg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 68b69dbadd26c2f9-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 responsive.css
fonolive.com/css/ 803 B
994 B 133ms
95ms Stylesheet
text/css 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fonolive.com/css/responsive.css

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

df322e5f44fa38089812b1fdacb72cf620030743cc997a37b43842b66f769646

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-original-content-length: 810
cf-polished: origSize=807
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cf-bgj: minify
server: cloudflare
etag: W/"PSA-aj-8Yp1rC9TTW"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=acDTPZM7GeW%2FmcoiLjFQRGQvqWZw67v4OZIU4r6M2FBU%2FBLifoa2PMEnxwPq7PI5yxw6zkI%2FayYO1MOSEgKioyXQzDWamtBpN5ktZ%2FP8MbloFkyW4sdRaRua5teI2Htzqe53zBz7lREaDIs%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 68b69de85f97dfa9-FRA
expires: Wed, 08 Sep 2021 07:48:19 GMT

GET
H3-29 200 css
fonts.googleapis.com/ 376 B
299 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Engagement

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a58ca0e14e9b06ff94afa9d0d13ea965f64ad7c2c716b0ecc502da670d406cee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 08 Sep 2021 07:50:48 GMT
server: ESF
date: Wed, 08 Sep 2021 07:55:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 08 Sep 2021 07:55:50 GMT

GET
H3-29 200 css
fonts.googleapis.com/ 2 KB
546 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3a57826dd4437403ec9dffe3d8a907466926d7123e4a765ec724d79ae24e1d54

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 08 Sep 2021 07:46:32 GMT
server: ESF
date: Wed, 08 Sep 2021 07:55:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 08 Sep 2021 07:55:50 GMT

GET
H2 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 118 KB
20 KB 21ms
20ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 632, 617, 617, 617
age: 1318968
cdn-cachedat: 2021-06-08 21:21:23
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:03:59 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 203451c6c050184245ebe231729b4b5c
cf-ray: 68b69de80871c29f-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 bootstrap-theme.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 23 KB
3 KB 19ms
18ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap-theme.min.css

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

653e073e97423adda5bc3917a241ee8497dd38a48f14bcde0098a4e54fd0fa5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 601, 617
age: 14609052
cdn-cachedat: 2021-03-11 11:57:57
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:03:59 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 4af8c755c17c8550f5f53c6d6b83f353
cf-ray: 68b69de80875c29f-FRA
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H3-29 200 linkedin.png
voticle.com/sharebuttons/ 676 B
1 KB 355ms
344ms Image
image/png 2606:4700:3032::6815:235e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://voticle.com/sharebuttons/linkedin.png
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:235e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e857e52f3825038a21bb1fd8a89a150038f6d6418f994abb2b315380e0bc36f

Request headers

:path: /sharebuttons/linkedin.png
pragma: no-cache
cookie: PHPSESSID=8u4cv57pnq46d1k5o26l95en74
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: voticle.com
referer: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:50 GMT
cf-cache-status: MISS
last-modified: Wed, 28 Nov 2018 17:32:58 GMT
server: cloudflare
etag: "2a4-57bbcf5065909"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XR5qiiPPzOu05g692vsUuDmRBJFy2gnEPdfnY4xY2RF4jY%2B4cyzrIeI6MrP8rQYubHAqDxqlCBREHXyKjAcRwRBVWES%2FqNJmvlQzseyhm1RbxBizDLK1%2B8O%2FJA6laVKt5TwKZphNlS2smg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68b69de8fd9b1e47-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 676

GET
H3-29 200 email-decode.min.js Show response
voticle.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 32ms
9ms Script
application/javascript 2606:4700:3032::6815:235e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://voticle.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3032::6815:235e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

:path: /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
pragma: no-cache
cookie: PHPSESSID=8u4cv57pnq46d1k5o26l95en74
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: voticle.com
referer: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 01 Sep 2021 15:49:24 GMT
server: cloudflare
etag: W/"612fa104-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=owBUrH%2FfwM6B29CvwP8Mr9GbwbHGUypVeg8cmYyf5HA6FK5ipDhi%2FxJlIDhlJQb%2F8gVZM9wAD%2FoEqFvk0G495axexStehs47k%2BiURvp3xzhoAS10pC8Y%2B9z7C9gcArypPJV6n4%2FzJfwwYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800 public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 68b69de85cb81e47-FRA
vary: Accept-Encoding
expires: Fri, 10 Sep 2021 07:55:50 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 138 KB
49 KB 71ms
35ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d9e83e3e3d08f9a8d567753deae5b2de7e51709a25adba8cb4525db28a22f4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49516
x-xss-protection: 0
server: cafe
etag: 11734312164484278086
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 07:55:50 GMT

GET
H2 200 herbalife-presentation-ingles-aza-23-638.jpg
image.slidesharecdn.com/herbalifepresentationinglesaza-101130195553-phpapp01/95/ 15 KB
15 KB 487ms
387ms Image
image/webp 2.16.186.128
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.slidesharecdn.com/herbalifepresentationinglesaza-101130195553-phpapp01/95/herbalife-presentation-ingles-aza-23-638.jpg?cb=1422640799
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.186.128 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-128.deploy.static.akamaitechnologies.com
Software: Akamai Image Manager /
Resource Hash: d47a5942450438e6bd94b4351f7ec4fedddaaaa1bfaf1a87283b482fdc731b0e

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:51 GMT
last-modified: Wed, 08 Sep 2021 07:25:01 GMT
server: Akamai Image Manager
etag: "5d1b8beef01fb58334e8ab0be9500b9d"
content-type: image/webp
cache-control: private, no-transform, max-age=604800
content-length: 15156
x-cdn: AKAM
expires: Wed, 15 Sep 2021 07:55:51 GMT

GET
H2 200 9808758931506.jpg
productimages.hepsiburada.net/s/18/600/ 47 KB
47 KB 148ms
82ms Image
image/jpeg 34.96.96.52
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://productimages.hepsiburada.net/s/18/600/9808758931506.jpg

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.96.52 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

52.96.96.34.bc.googleusercontent.com

Software

hepsiburada / Express

Resource Hash

4340e7fc096551699f0188b26cf77e264dda5868ea083f44066ea847772866e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
via: 1.1 google
etag: W/"ba07-wOf5xSZIY7OVqdARG+ers9w/KfU"
server: hepsiburada
x-powered-by: Express
content-type: image/jpeg
x-varnish-forward: dali-as
cache-control: max-age=3600,public
date: Wed, 08 Sep 2021 07:55:50 GMT
image-size: 47623
accept-ranges: bytes
timing-allow-origin: *
alt-svc: clear
content-length: 47623

GET
H2 200 s-l300.jpg
i.ebayimg.com/images/g/YRIAAOSwme9ej4t6/ 10 KB
10 KB 51ms
23ms Image
image/jpeg 2a04:4e42:3::718
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ebayimg.com/images/g/YRIAAOSwme9ej4t6/s-l300.jpg
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:3::718 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: b67e8d4fedba254ce8ddb8ebd9c0816494c08ff0872bc0028484ceb76f9aa482

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:50 GMT
last-modified: Thu, 09 Apr 2020 08:54:17 GMT
x-cdn: Fastly
x-ebay-pop-id: UFES2-FRA-zoe-anycast
age: 43181880
x-ebay-c-version: 1.0.0
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
x-envoy-upstream-service-time: 16
rlogid: t6yhccjd%3C%3Dpie%7Dn%60bnb%2850%3A54%3F%3A-171b690bba9-0x13e
x-ebay-request-id: 171b690b-ba90-a9cc-4377-cb3dff63cf3f![
accept-ranges: bytes
content-length: 10301
expires: Mon, 26 Apr 2021 12:57:50 GMT

GET
H2 200 1154_21dayherbalcleansingprogram_us.jpg
az31823.vo.msecnd.net/content/en-us/img/catalog/products/ 67 KB
67 KB 542ms
496ms Image
image/jpeg 2606:2800:133:206e:1315:22a5:2006:24fd
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://az31823.vo.msecnd.net/content/en-us/img/catalog/products/1154_21dayherbalcleansingprogram_us.jpg
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:133:206e:1315:22a5:2006:24fd , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 334c965e8ed9376ee61c736418c90e32c1fefa3a0293e0bdad248412eadddd82

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Wed, 08 Sep 2021 07:55:50 GMT
last-modified: Thu, 24 Jul 2014 00:37:45 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-meta-localdatemodified: 7/23/2014 10:59:20 PM
etag: 0x8D174EE9F4484F8
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
x-ms-request-id: 7d85b71c-901e-0125-6f86-a487e5000000
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
content-length: 68398

GET
H3-29 200 2344.jpeg
fonolive.com/profiles/7ef78f61bd1c0a719a9116e9361dc3ac/44260/ 12 KB
13 KB 653ms
620ms Image
image/jpeg 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fonolive.com/profiles/7ef78f61bd1c0a719a9116e9361dc3ac/44260/2344.jpeg

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b380544bfad0e92f48a20ab007b593061cc9b49e0fd86e8465a8c2b0378cd913

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:51 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 12725
last-modified: Tue, 28 Jan 2020 10:08:33 GMT
server: cloudflare
etag: "31b5-59d30680fa249"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rTc6dvmy2aO2RMVO%2BlXm%2FaIPIOOyJr8he99sxHeege10YRTntwSqiergPN6hsBA36bkaQLDywYq1%2Bwnddz92gHzncu7vKtMDP226d6xuFen5TH8kmbpUKOk4yZHwdzDZuOaaSZxuURPArfs%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400, s-maxage=10
accept-ranges: bytes
cf-ray: 68b69de91add0742-FRA
expires: Wed, 08 Sep 2021 07:58:27 GMT

GET
H3-29 200 7013.png
fonolive.com/profiles/2dad2f5a0187ac9ad75f0172495707a1/297583/ 5 KB
5 KB 654ms
620ms Image
image/png 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fonolive.com/profiles/2dad2f5a0187ac9ad75f0172495707a1/297583/7013.png

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a59f0759eff219dce25d028afa33e42dcba2e9cc9295b1480784c130aded54e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:51 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 4688
last-modified: Tue, 28 Jan 2020 10:33:36 GMT
server: cloudflare
etag: "1250-59d30c1acb132"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4bknh5EcGsiq2ZWXDev%2FdlZAKl0Sbdn2je%2F2rTF%2FfP50Ry5MJ6pFGLgCa0yoCPfObho%2Fg%2BZxvkj6aTxMXDacjI1aHaqn%2Fr3eEaDCzQ0n6A5HCgz0n2iCtXmS8JCSvSwTMn6mHQAWiqkEc2Q%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400, s-maxage=10
accept-ranges: bytes
cf-ray: 68b69de91ae80742-FRA
expires: Wed, 08 Sep 2021 07:58:11 GMT

GET
H3-29 200 3793.png
fonolive.com/profiles/95625bb5f5b1efb623bd5c11b0dc0eb1/105128/ 17 KB
18 KB 664ms
631ms Image
image/png 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fonolive.com/profiles/95625bb5f5b1efb623bd5c11b0dc0eb1/105128/3793.png
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b986ae793df3ae7aa417202e71ad60d7fee560e12ccdd011b31913e7b61a51e

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:51 GMT
cf-cache-status: MISS
last-modified: Tue, 28 Jan 2020 10:26:56 GMT
server: cloudflare
etag: "4561-59d30a9cb5de6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DQiNNlPoCYLC9qwRm5n7O8eY8NFGDYwiVOwGnYd7uW4DB37rIf%2FajSFDuyBHhZTA6FxbXKP%2Bk0kGVTglPU1LjPJ2VO96VqXxWM1T1gT56GCndT2K6DZO4WIxUo2%2FdgYZz40%2F8SkaYSSy2x0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400, s-maxage=10
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68b69de91ae70742-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 17761

GET
H3-29 200 20254.jpg
fonolive.com/profiles/b25069f93d0b219ef7e66f61cec010da/1563386/ 14 KB
15 KB 331ms
301ms Image
image/jpeg 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fonolive.com/profiles/b25069f93d0b219ef7e66f61cec010da/1563386/20254.jpg

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

289f84ebadd42804fee945f1cbd0c928732b8b99b4312a368d9e6ae116ae186f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:50 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 14281
last-modified: Thu, 29 Apr 2021 03:22:27 GMT
server: cloudflare
etag: "37c9-5c114013c5d09"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BX47TAuDa3yPeP8CuLTXUb8Zg0EvP8CDNZIi4RilrR0xb94QuqcGH8bsBMB4pFVpscEEB0LPQ6vCqilif86Cflk9Ft8umaOLTmYiVFdluaFewo%2Bk3FPDyEtDqBOqad2pNoPbgRCFhqXyQek%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400, s-maxage=10
accept-ranges: bytes
cf-ray: 68b69de91ab60742-FRA
expires: Wed, 08 Sep 2021 08:00:42 GMT

GET
H3-29 200 14978.jpg
fonolive.com/profiles/1f88a7e996db8249ed07cb773eb4bd6e/420756/ 22 KB
23 KB 664ms
632ms Image
image/jpeg 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fonolive.com/profiles/1f88a7e996db8249ed07cb773eb4bd6e/420756/14978.jpg
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4bd403f69280495e9c89dc9d9de8355b2327c1f36789829fb40c8f64f97447b0

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:51 GMT
cf-cache-status: MISS
last-modified: Tue, 19 May 2020 05:44:35 GMT
server: cloudflare
etag: "585a-5a5f9c6466cd9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1VqlaIOlhgN%2FthrmT%2BXvLnpHyxYS%2FV48zd5CYioUpnRGEJxWeJwef4oAY6Zv4SJWBDExK6EiLuNahY96F32PbYPHF%2Fov2HepQ5n1NVEDKZVmoajKR5MDiYMT%2F7BLsx0ztaxoHgHBOZ97%2BoE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400, s-maxage=10
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68b69de91adb0742-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 22618

GET
H3-29 200 7034.jpeg
fonolive.com/profiles/bbcc1f63655e33523ee01dd17b6ad2a9/297819/ 19 KB
20 KB 3075ms
3043ms Image
image/jpeg 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fonolive.com/profiles/bbcc1f63655e33523ee01dd17b6ad2a9/297819/7034.jpeg

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

48bbd884822292041027d2269e8345482bd1afb6f613ff81935024177acaabdb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 19563
last-modified: Tue, 28 Jan 2020 10:33:40 GMT
server: cloudflare
etag: "4c6b-59d30c1e84351"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x3UQNbpfE%2FjPkCWoxvDgNnKAF516UOs2dX1Nhmu6cNkC6WyZC%2BQfC41bYAtr8bBdtMVGC9OTBVdHMU1ADi7Iiw5UvqeMNmDhoU091QXQxXu1rRBFNaGjNo1vT80KABwKciHDUC2NXasyREE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400, s-maxage=10
accept-ranges: bytes
cf-ray: 68b69de91ada0742-FRA
expires: Wed, 08 Sep 2021 06:25:36 GMT

GET
H3-29 200 9751.jpeg
fonolive.com/profiles/d40a8b58c7a215a71332c238e43025ac/330819/ 111 KB
111 KB 2353ms
2322ms Image
image/jpeg 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fonolive.com/profiles/d40a8b58c7a215a71332c238e43025ac/330819/9751.jpeg

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

35f2dd7647ccaaca06fff2c995b8205086fde540d9d9d446f75c40a7efc34d87

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:52 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 113392
last-modified: Tue, 28 Jan 2020 10:43:49 GMT
server: cloudflare
etag: "1baf0-59d30e62ea812"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5Eiev1DB8k4OfzDSmQiLCiNhhPW%2BlwD7JkWM76bXZkFIUKWfK0O%2FgsjjrYsDZA1qmgiI4Ni6Jl3Mgp%2FJQD7R%2FxQUiky4KaMhJAampgFjdnr10Fu303YyH6tWOb2pWVGS%2FZvFxYR1XWSU254%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400, s-maxage=10
accept-ranges: bytes
cf-ray: 68b69de91ad90742-FRA
expires: Wed, 08 Sep 2021 08:00:07 GMT

GET
H3-29 200 5892.jpeg
fonolive.com/profiles/129d666ee49824bc8b788a36bef60dd0/255260/ 10 KB
11 KB 119ms
89ms Image
image/jpeg 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fonolive.com/profiles/129d666ee49824bc8b788a36bef60dd0/255260/5892.jpeg

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

25944e4eb8ef497fa11ead9ca6c4dcd06863becda140dc93cd7bc5541fb81280

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:50 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 10282
last-modified: Tue, 28 Jan 2020 10:31:17 GMT
server: cloudflare
etag: "282a-59d30b95740c2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lVFeI%2BS9NVHtpReZ4aOpuNHOYR6MJkqOy43v0xX2Ocu25wZtVYHZkL5gJAQSENrnh2FRixEm5qVDhtam5jKREfYuEzVYqvwjbHWSSG0gO31pj82xloh09dKYKxaIG4G01lKYt5SUD%2FckiVo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400, s-maxage=10
accept-ranges: bytes
cf-ray: 68b69de91ad70742-FRA
expires: Wed, 08 Sep 2021 07:56:02 GMT

GET
H3-29 200 5444.jpeg
fonolive.com/profiles/25af8f52955d7141a7e2f204ef9b5403/230914/ 13 KB
14 KB 904ms
874ms Image
image/jpeg 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fonolive.com/profiles/25af8f52955d7141a7e2f204ef9b5403/230914/5444.jpeg

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d88ece7e3dfe2e78ad23e830aa611335e06503f53325eedf5e8641c25e9e27ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:51 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 13708
last-modified: Tue, 28 Jan 2020 10:30:35 GMT
server: cloudflare
etag: "358c-59d30b6e45b32"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=krX8ZX3B9HqI4b4C6O%2B5GBQcNWqZWmcHnlwsqzxKLAhdtRceCzYG%2FPE3yaf7M3LPdSJTkVHPuFWFus3nGsRTnxn2XeBayOUuPI%2BJDhGPy3AFvYqaKFtaCpyNv%2BwAhRgHArix77yEwFyFs1k%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400, s-maxage=10
accept-ranges: bytes
cf-ray: 68b69de91ad50742-FRA
expires: Wed, 08 Sep 2021 07:59:31 GMT

GET
H3-29 200 9636.png
fonolive.com/profiles/7f905efeb9cdf9036d877e7104cb0975/352240/ 7 KB
8 KB 932ms
900ms Image
image/png 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fonolive.com/profiles/7f905efeb9cdf9036d877e7104cb0975/352240/9636.png
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0626c6ed859b6954ac1fc149e261574282f1f2b8defe35e41976fde9b6460ceb

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:51 GMT
cf-cache-status: MISS
last-modified: Tue, 28 Jan 2020 10:43:38 GMT
server: cloudflare
etag: "1c49-59d30e581ae70"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Whs4h3OE6vkiJQ%2FJQNERFEkoDzWjCgDzZBB7e8X%2BNWUbq8goRKyjtiH5aO24zXyAkCWpM60B4xrMigajgAQPkngtUCpy2DTf6pLf5Upw5FYONdvJnrMTmm%2F2RLqPX2aJF2eONvQJJvaZCkU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400, s-maxage=10
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68b69de91ae50742-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 7241

GET
H3-29 200 11154.png
fonolive.com/profiles/d261ffc4a1e37a4b767a72a91dd3ae27/391492/ 14 KB
14 KB 323ms
292ms Image
image/png 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fonolive.com/profiles/d261ffc4a1e37a4b767a72a91dd3ae27/391492/11154.png

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e6a8f4a13e0431032ee1b06321c014b13d652a681db80c64d8c2d584c4ce4e53

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:50 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 14165
last-modified: Tue, 28 Jan 2020 10:47:11 GMT
server: cloudflare
etag: "3755-59d30f23d3b40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dc%2FwBaScWDbULUuOEqtvQ8t3zcvb4iN%2BANB94g3YbDjVPmZhqn7aiITjUlvcQR0hVQT8u62KVJDGVwmkHGFtRkbpEdwBiwEDIX2N2EAm5LOJ3PmvAzHGu9GUbnIxGpNnJZTQgOKBYqeBX8A%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400, s-maxage=10
accept-ranges: bytes
cf-ray: 68b69de91ae40742-FRA
expires: Wed, 08 Sep 2021 07:57:28 GMT

GET
H3-29 200 11879.jpeg
fonolive.com/profiles/e2c350dc2420d02fd368215bf515875e/402880/ 187 KB
187 KB 2869ms
2841ms Image
image/jpeg 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fonolive.com/profiles/e2c350dc2420d02fd368215bf515875e/402880/11879.jpeg

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6639e1fccdac710583a8435193a1aa9761954ca9bf78b7c14c729523bb8dd98f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 191337
last-modified: Tue, 28 Jan 2020 10:49:11 GMT
server: cloudflare
etag: "2eb69-59d30f95f2ce3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=POPl72fz4LLm5e6YF5E%2FD6Tz7AH8a9PsbXuILIO864yla0EtIpxISwU%2F6GmC8RHqbzeDEiWfKwnz0QkI388YxMyKe9fogyMaKtTjxg%2BjLLFGyrwB8LZxYD8zOdcmnNLzjdfftuedG%2BP0lK8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400, s-maxage=10
accept-ranges: bytes
cf-ray: 68b69de91ac90742-FRA
expires: Wed, 08 Sep 2021 07:18:27 GMT

GET
H3-29 200 14084.png
fonolive.com/profiles/3b35864eb7c42fbb37b0c8e65e5323fd/475078/ 10 KB
10 KB 636ms
608ms Image
image/png 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fonolive.com/profiles/3b35864eb7c42fbb37b0c8e65e5323fd/475078/14084.png
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13ff721bb26c3c9569bba3aca324d975f95c504856ac87d78d4bead58d092f70

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:51 GMT
cf-cache-status: MISS
last-modified: Wed, 04 Mar 2020 05:44:59 GMT
server: cloudflare
etag: "26a1-5a000ebc93ab2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fz6Q5kFinmHNSyDHg%2FF0Z98QUG223znELhpXnDhxnZlaNDOBuU%2Fmp5ORM%2BUefkiI%2FLXD4JFsZINubOWxMaRVVagOoZBO56En1q0%2BILbCs4EvtBZ%2BQxTbx1xWPuuknW2FWxC5gX%2FS%2FNs6TOE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400, s-maxage=10
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68b69de91ac80742-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 9889

GET
H3-29 200 11430.png
fonolive.com/profiles/9b9cce68b2da9215a05548e77aab3cb2/346008/ 5 KB
6 KB 2887ms
2860ms Image
image/png 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fonolive.com/profiles/9b9cce68b2da9215a05548e77aab3cb2/346008/11430.png
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 443bd5b2d289f44cc3b91029bbf7ae2dce66f74ec32358c6a5e432b30b2dfaf2

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
cf-cache-status: MISS
last-modified: Tue, 28 Jan 2020 10:48:03 GMT
server: cloudflare
etag: "144e-59d30f55bd28e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cp2ENWvnYASP6djA1iWBMMShxc20CtlhoROdW0wysgV3KWkQMbQEmveN%2B9Ddo6D2Vj1IhFc972ghMJZbNre5XRi%2Fd0j1%2F7rj00bvQ6DghjK2%2BPV27vx8NJwT2sjDLAIMfPkKcirmoeeitns%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400, s-maxage=10
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68b69de91ac50742-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 5198

GET
H3-29 200 932.jpeg
fonolive.com/profiles/65f565ee192a12aa28bd229126f56545/4513/ 33 KB
34 KB 2748ms
2721ms Image
image/jpeg 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fonolive.com/profiles/65f565ee192a12aa28bd229126f56545/4513/932.jpeg

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3bc87889d5783ac71dcc39d28eb4b0207db7f96b12c2ed61b139c7550a2d3abb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 34045
last-modified: Tue, 28 Jan 2020 10:05:01 GMT
server: cloudflare
etag: "84fd-59d305b717060"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xsdgBldoxPXyelWmQIdyDPLu4gcwn6oOqHgF2YYhk%2BD5ma0VQBwQNRMgDmw20Ndcvcn1n%2FagRI3UE4hyu7jz5K%2FQQZL1Y63tYThjysxDBAzlV5mlhcZUs9SkOgQ8H7blu7e5VOD%2BMY74en0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400, s-maxage=10
accept-ranges: bytes
cf-ray: 68b69de91ac10742-FRA
expires: Wed, 08 Sep 2021 07:56:46 GMT

GET
H3-29 200 11006.png
fonolive.com/profiles/bd0b8f2ee094b3554b4831ea50c0cbfd/388597/ 684 KB
685 KB 932ms
904ms Image
image/png 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fonolive.com/profiles/bd0b8f2ee094b3554b4831ea50c0cbfd/388597/11006.png
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 748f242e0d18f8cb6441c6af5dd0c55ec4753943c6bdd67ee4cb67424d972b4c

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:51 GMT
cf-cache-status: MISS
last-modified: Tue, 28 Jan 2020 10:46:37 GMT
server: cloudflare
etag: "ab17b-59d30f02f9790"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PJtKZR1s55GTdkth7uEnFXH3xoamPqhi3ie5opQ%2FUQyTQdZCojxfyVJue9yoA1yncvARaNe%2Bti5G4wqhU%2BXyZbtPEgCdpa%2FUOawuWvy2PsCQzVNARJMq2cZ%2FloGyJ9zOo2R2v2XGOuMr04I%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400, s-maxage=10
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68b69de91ad10742-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 700795

GET
H3-29 200 14859.png
fonolive.com/profiles/7384223b806964eaf763c1690229bce2/399457/ 26 KB
27 KB 944ms
917ms Image
image/png 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fonolive.com/profiles/7384223b806964eaf763c1690229bce2/399457/14859.png
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed4962b03c17bb244a7560e381779e8c970af9cac72756fa764a88821f450db9

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:51 GMT
cf-cache-status: MISS
last-modified: Mon, 11 May 2020 05:46:27 GMT
server: cloudflare
etag: "69d8-5a558de342cd6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xuPiwUuZbkuk8W%2Fle2xBy6ZzAVhWyfCYpjlKC8%2F28uctqqguy2kwezA%2FPsxUcile6c%2BRHk8%2FdUPjvb5z%2F9h2n9M1Pvj2S7gG46H2zeZW836aKSnXvC28%2BHHn9xPLsM5pDYfsw6Rk%2B9BEovY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400, s-maxage=10
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68b69de91ad00742-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 27096

GET
H3-29 200 13098.jpg
fonolive.com/profiles/f0a1e5017ddfdcf4e2a3859289652096/434919/ 148 KB
148 KB 1955ms
1928ms Image
image/jpeg 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fonolive.com/profiles/f0a1e5017ddfdcf4e2a3859289652096/434919/13098.jpg
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6056652beb1a991c89c3d70989fb23145da49036f35e6cb524ed1f3e239bb757

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:52 GMT
cf-cache-status: REVALIDATED
last-modified: Thu, 26 Dec 2019 10:02:38 GMT
server: cloudflare
etag: "24e03-59a987a22c79b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NK8ciHlRIyd7A0zD7RCZk2G5esqJ3p%2FxFxFEdEuIZUX2q03AwNCx1WZyNdSc7P0OiUUe%2FyNeCAUI98wdx2XsqE%2FSuvTfRp4I4KBujfZEMANK%2BUMs%2BRR06UV3oTYUJlj2F8PQBCv%2B6UCwu%2Bc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400, s-maxage=10
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68b69de91acf0742-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 151043

GET
H3-29 200 11142.jpeg
fonolive.com/profiles/3adeb679cfe52fa89ec0c248f36400e5/391028/ 29 KB
29 KB 2750ms
2723ms Image
image/jpeg 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fonolive.com/profiles/3adeb679cfe52fa89ec0c248f36400e5/391028/11142.jpeg

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e355e2e4ca53d98c4228c02e6856f0312fcddb1a464f6f6c46ea8016b45f9f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 29460
last-modified: Tue, 28 Jan 2020 10:47:10 GMT
server: cloudflare
etag: "7314-59d30f225bb92"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o0%2BivGQxhY8KTtZZbb5SwIGsiHtVKhR5zAeMkQPSgbxvsiKu8ntDsr%2Fl13Fxcu8tBdZ0vKEXukxwNn6LG3y46p1lvHec86lXY04TYPo1gycsbHjujUHDqxdL7uXFhbYFCK2uqTdS19b4tXs%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400, s-maxage=10
accept-ranges: bytes
cf-ray: 68b69de91acd0742-FRA
expires: Wed, 08 Sep 2021 08:00:15 GMT

GET
H3-29 200 11287.jpeg
fonolive.com/profiles/76a86deeb143b7d0fc4c511b5d228a9f/393938/ 32 KB
33 KB 642ms
616ms Image
image/jpeg 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fonolive.com/profiles/76a86deeb143b7d0fc4c511b5d228a9f/393938/11287.jpeg
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a8a4495f63f6bf0c33648e12b57d358d29f495ec8db73f6794fc713838e45faa

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:51 GMT
cf-cache-status: MISS
last-modified: Tue, 28 Jan 2020 10:47:51 GMT
server: cloudflare
etag: "8117-59d30f4971abc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cHtTrCPsvhJwobqBXvOjy7DRkrB5HKRYT0Pf%2BPb1jkArPsP%2Ba4F2w3b94tgvr4eMhNxFzEs3zSwpWbZuBck84l0gutIVjbpsxf402Nyu2Kdp0Y0hiB%2FN5TYjOGD5tm%2Fha%2BvOeqVuzdkSN%2Fc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400, s-maxage=10
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68b69de91acc0742-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 33047

GET
H3-29 200 1238.jpeg
fonolive.com/profiles/d50a0b2c37e24154cb3461b573dde641/6851/ 35 KB
36 KB 351ms
325ms Image
image/jpeg 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fonolive.com/profiles/d50a0b2c37e24154cb3461b573dde641/6851/1238.jpeg

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

709e892a3304d6fb0ec23f6b92a985db77badcdf2ef17a43d768cd77a57cb389

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:50 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 36075
last-modified: Tue, 28 Jan 2020 10:05:57 GMT
server: cloudflare
etag: "8ceb-59d305ec204de"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C2Mv19zavMpBCBMehic3zWEUSk1bY15jdpABX0weHHYDDwX%2Bl%2FBEGZHPNMIeGEASe5r1uYNIzSlSL5pSy9OLXTHp%2F8%2F%2FdPYGN1JS70Oafv%2BVSrEJCdnPTlguAYPolgJ4IkvJizZlLYsOEXc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400, s-maxage=10
accept-ranges: bytes
cf-ray: 68b69de91abf0742-FRA
expires: Wed, 08 Sep 2021 07:58:04 GMT

GET
H3-29 200 13389.png
fonolive.com/profiles/7764a24b92391c8df1b9fb9554a92682/187060/ 99 KB
100 KB 931ms
906ms Image
image/png 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fonolive.com/profiles/7764a24b92391c8df1b9fb9554a92682/187060/13389.png
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6e0b14ada918e9d7f9af06d12e7ecf2c5dc5690a3ef957a0657323d60f6a8e45

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:51 GMT
cf-cache-status: MISS
last-modified: Wed, 15 Jan 2020 03:34:06 GMT
server: cloudflare
etag: "18c08-59c256174a46d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qS1J53mfHxDxjOP6nBJa9KJytkmyAjm7TRtaKClrEEhA240TwjcY%2BLQH%2B%2F8KjPV17YYRigr55nJl4sPyDWN1EDjGL0DmELJbe8RZnb15GlOigDGP9A4FS%2F75mDOJdwvP9KXaHSy%2FTmFnlXM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400, s-maxage=10
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68b69de91abd0742-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 101384

GET
H3-29 200 5141.jpeg
fonolive.com/profiles/d244778efc8f6e7534febe323fbc2651/181982/ 20 KB
21 KB 2021ms
1996ms Image
image/jpeg 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fonolive.com/profiles/d244778efc8f6e7534febe323fbc2651/181982/5141.jpeg
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13088125e10e9423be1410f4c68bed5d85781b3cf424e9b4b83effbe2d15000b

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:52 GMT
cf-cache-status: MISS
last-modified: Tue, 28 Jan 2020 10:29:44 GMT
server: cloudflare
etag: "5015-59d30b3d1f93d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KwLcJB9SSneMllptes2Lg5x97A3QSNSLuodojva%2F2w2FrYFHfPpbkWYU%2BNuyuidYvHW4IqVuvUPDyG0%2FKSb6caL8WnjeaYaWLTxQBPmFM3up6UV7kX9Gx7RqzYS71hS%2FHswWUr0AT6WNJHQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400, s-maxage=10
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68b69de91ab90742-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 20501

GET
H3-29 200 6640.jpeg
fonolive.com/profiles/98c5052a24f04e38b7e3b58fae978595/204956/ 21 KB
21 KB 658ms
630ms Image
image/jpeg 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fonolive.com/profiles/98c5052a24f04e38b7e3b58fae978595/204956/6640.jpeg

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

563023f267d554ae8cfe37f2e1178a8966b73cef644391399a6d1a3541092c15

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:51 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 21094
last-modified: Tue, 28 Jan 2020 10:32:46 GMT
server: cloudflare
etag: "5266-59d30bea57a86"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qbqPrsanih2ha4WLEat4iVCt0objbhG2ffTsEhcj8g71QRBexvf4pCaow9aBStChEwn29eSb%2Fvxzuq3dH73bDoFt6srK2DGLyTcEDg2CRseFkXDBfhR6fE%2FYf4bt4EPhcTpM595X7A7eg%2Bg%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400, s-maxage=10
accept-ranges: bytes
cf-ray: 68b69de91ae20742-FRA
expires: Wed, 08 Sep 2021 07:58:27 GMT

GET
H3-29 200 20982.png
fonolive.com/profiles/2ab03232ff35c080ef7b039606bc0c32/2681608/ 10 KB
10 KB 1952ms
1924ms Image
image/png 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fonolive.com/profiles/2ab03232ff35c080ef7b039606bc0c32/2681608/20982.png
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db18f576555681b146299bdb961f88c1ef224ea7ad37fa69d17c851816211adc

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:52 GMT
cf-cache-status: MISS
last-modified: Tue, 29 Jun 2021 09:07:26 GMT
server: cloudflare
etag: "2759-5c5e3ef4f198e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mf290%2FzxCMHwiewCd3FoWBBNf3rvCBnc9ivuTUZxkrOhcx%2FV0zU7zS6r1Y3szrenpAA4TNGRF0M4jZ2LNzd4FENtM9NaER6hx6BzFLjKkStFeAwb%2FbHh35dgmiNap5UkWDMYFPFvut3M0gY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400, s-maxage=10
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68b69de91ae00742-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 10073

GET
H3-29 200 15500.png
fonolive.com/profiles/da75a4bb3abfce9e0c85a4a5d3ccf37f/536960/ 8 KB
9 KB 2249ms
2221ms Image
image/png 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fonolive.com/profiles/da75a4bb3abfce9e0c85a4a5d3ccf37f/536960/15500.png
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1870c5c47a57786303f059bd2a33e57b3098a73bfab05c0cd460b65217c52bb4

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:52 GMT
cf-cache-status: MISS
last-modified: Thu, 25 Jun 2020 13:19:38 GMT
server: cloudflare
etag: "20cb-5a8e871d06ed9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6pGOIdm8L3UlVdhFotecj%2BCqtNeQaDiCaqx%2BpD%2FxNmq3FkFJlWe1CLhDo6DMYp7EvHxSGJkJkKonWaZHvdjzH8UjZ%2BLX00h%2BlJwnd4JgFTL5qyasy4W5VJqvk6wK%2B9oOjaSIqXLzBl%2BiH7E%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400, s-maxage=10
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68b69de91adf0742-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 8395

GET
H3-29 200 18043.jpg
fonolive.com/profiles/695333199857720991b7beebaabba1f9/624259/ 151 KB
152 KB 2016ms
1989ms Image
image/jpeg 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fonolive.com/profiles/695333199857720991b7beebaabba1f9/624259/18043.jpg
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85f97dc62641c13e65d09726fddc93036598addc9fe2a3f68f98e66d62d718e1

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:52 GMT
cf-cache-status: MISS
last-modified: Fri, 20 Nov 2020 04:49:00 GMT
server: cloudflare
etag: "25cf4-5b4829026075c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yg0qu3UVJAE5PpBcl3yAR%2BnKkxqUU1%2BEcS5NsiA8YTdpwOdyLWfQcuRBL%2Fvf6r2Jvvxv1Q%2FOApW%2BaRMUqTTeWD%2Fl1eW1g5NOcjY94iO1y1PJvL0m2PD%2FPnWKk7b1yUsJVNmlB4iygKv4jts%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400, s-maxage=10
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68b69de91ade0742-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 154868

GET
H3-29 200 13714.png
fonolive.com/profiles/03ee5f54c0a679e418ce6b3b4a141451/458413/ 146 KB
147 KB 941ms
915ms Image
image/png 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fonolive.com/profiles/03ee5f54c0a679e418ce6b3b4a141451/458413/13714.png
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eecd9dde12fc559bbc8ab7a64b5ed5b756f1efe030b82a39430bf252172f27ef

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:51 GMT
cf-cache-status: MISS
last-modified: Mon, 10 Feb 2020 09:58:41 GMT
server: cloudflare
etag: "2478a-59e35c8bcac09"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x84Qo8u8%2Fx1w9UtdSghMRsWKjkIxGyrPbtapQ0j58PA0h0z7JVdt3X89Zdujf3%2B5JnS7Lpe9RWAjrXQeGa%2BgBWNj0Y4DQ6TLOsns1508IpzY7eLk%2BDW%2BU2M5lpnas8%2FvAegnTZru9AJK8NM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400, s-maxage=10
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68b69de91ad40742-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 149386

GET
H3-29 200 2073.jpeg
fonolive.com/profiles/a5f1d261fe565ff4bd3d1b34ab14ff3c/37254/ 7 KB
8 KB 665ms
639ms Image
image/jpeg 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fonolive.com/profiles/a5f1d261fe565ff4bd3d1b34ab14ff3c/37254/2073.jpeg

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7de6a4be826e6cce23fc514bdd9c2a11b1fa5fa3b87c647d19354a9a16990a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:51 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 7337
last-modified: Tue, 28 Jan 2020 10:07:41 GMT
server: cloudflare
etag: "1ca9-59d3064f8ea73"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N31FM6Yq2UaTFc3F9NhByyNMxMBZNOpEH%2B84ViQsPfkIbbKK8GUuDbuoO%2B%2BwMCyagxLMlz1KBp6qVFeWUsfeERhk41C7yhr%2BeBP8m2UbN%2FRYgkU7pGu7lC1mIMgt77rp2wUzOrzEH07d48E%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400, s-maxage=10
accept-ranges: bytes
cf-ray: 68b69de91ad30742-FRA
expires: Wed, 08 Sep 2021 08:00:08 GMT

GET
H3-29 200 8485.png
fonolive.com/profiles/6641e074fde0edcacbce087645b49d4c/327142/ 5 KB
6 KB 2001ms
1975ms Image
image/png 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fonolive.com/profiles/6641e074fde0edcacbce087645b49d4c/327142/8485.png
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11c351a339eaaaafdf7843ca553caa112a08ccb5905059be4bbbd7e6c8dec2ab

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:52 GMT
cf-cache-status: MISS
last-modified: Tue, 28 Jan 2020 10:41:07 GMT
server: cloudflare
etag: "13d7-59d30dc8a30bd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k4qdyNdxzjweDYuaGfGKhANC%2FMXecHgV69pb5aqHiGhH81O5JyenzIAfEeLKUoLqm7ZUCdVll0%2F0fkgBmdLheKMe9WtNGNpyTNepSxqI6MSz4BkmMScFHqyjYm5FqeJi1O%2FfLH2ynaSAIAA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400, s-maxage=10
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68b69de91ad20742-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 5079

GET
H2 200 onejs Show response
z-na.amazon-adsystem.com/widgets/ 22 KB
8 KB 385ms
325ms Script
application/javascript 13.225.30.184
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://z-na.amazon-adsystem.com/widgets/onejs?MarketPlace=US&adInstanceId=6f38a3a8-4804-4981-ae71-349ed7411527
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.30.184 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-30-184.cdg3.r.cloudfront.net
Software: Server /
Resource Hash: 668d3cf3b7f44fee5eb3433e2cba0643c37bf428ab2b97b2e8ba7207963f03d1

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: Public
date: Wed, 08 Sep 2021 07:55:50 GMT
content-encoding: gzip
server: Server
x-amz-cf-pop: CDG3-C2
x-cache: Miss from cloudfront
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
charset: UTF-8
cache-control: public,max-age=300,s-maxage=300,no-transform
content-length: 7333
via: 1.1 d62d0235c86cff9cbc14eb8c55f7a9fa.cloudfront.net (CloudFront)
x-amz-cf-id: I7OQqcXyg7p8M1K1RoT6UGLTr_GPe65FUVcByx_wwEMA2mgkmK0Ljg==
expires: Wed, 08 Sep 2021 08:00:50 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.11.3/ 94 KB
33 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:10:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2740
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33507
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 08 Sep 2022 07:10:10 GMT

GET
H3-29 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ 36 KB
11 KB 46ms
27ms Script
application/javascript 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 722, 617
age: 14640980
cdn-cachedat: 2021-03-11 11:57:50
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 3033c5b7ea34684b20a8f4234fea378f
cf-ray: 68b69de90ff0bedd-FRA
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H3-29 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.4.1/ 86 KB
30 KB 36ms
8ms Script
text/javascript 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 18:29:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48402
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30774
x-xss-protection: 0
last-modified: Mon, 13 May 2019 14:37:17 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 07 Sep 2022 18:29:08 GMT

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 13ms
7ms Script
text/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 4497
date: Wed, 08 Sep 2021 06:40:53 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17168
expires: Wed, 08 Sep 2021 08:40:53 GMT

GET
H3-29 200 promoted-ads Show response
fonolive.com/ Frame 86AF 5 KB
3 KB 2927ms
2901ms Document
text/html 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonolive.com/promoted-ads
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 03795c398f883a5c2189eb0cfefa6e2779ca38e1e71a719243073e4927666e67

Request headers

:method: GET
:authority: fonolive.com
:scheme: https
:path: /promoted-ads
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://voticle.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://voticle.com/

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
content-type: text/html; charset=UTF-8
set-cookie: PHPSESSID=qp2copi214urog0dqdr6md8dn1; path=/
cache-control: max-age=0, no-cache, no-store, must-revalidate
pragma: no-cache
vary: Accept-Encoding
x-mod-pagespeed: 1.13.35.2-0
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=00HE38%2FrKKeaYjRP6n0S3dVwKRTs0NnVQXM6QV3WBUvv8VegKHRrxUkMCclvPzA4G9fUHTYo5DIt7e3W6h%2BUUUjg6v0sbaerVaLHfzCKZCiYZgZvlvDte%2BPxNVDDB7sVCz7KVWBactIVUFQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 68b69de91ae60742-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 x3dlckLDZbqa7RUs9MFVbN0msg.woff2
fonts.gstatic.com/s/engagement/v12/ 25 KB
25 KB 12ms
7ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/engagement/v12/x3dlckLDZbqa7RUs9MFVbN0msg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Engagement

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

218086d4079f261aadbdef5797b020f5126924b866870672ba78436dd52f2707

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://voticle.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 03 Sep 2021 11:11:38 GMT
x-content-type-options: nosniff
age: 420252
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25788
x-xss-protection: 0
last-modified: Fri, 19 Mar 2021 03:47:53 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Sep 2022 11:11:38 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v23/ 14 KB
14 KB 11ms
6ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v23/mem8YaGs126MiZpBA-UFVZ0b.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://voticle.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 05 Sep 2021 14:18:31 GMT
x-content-type-options: nosniff
age: 236239
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14440
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:23:25 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Sep 2022 14:18:31 GMT

GET
H3-29 200 glyphicons-halflings-regular.woff2
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/fonts/ 18 KB
18 KB 26ms
22ms Font
font/woff2 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/fonts/glyphicons-halflings-regular.woff2

Requested by

Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://voticle.com
Referer: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 601, 617, 617, 617
age: 11916511
cdn-cachedat: 2021-04-23 11:38:05
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 18028
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: font/woff2
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 3998f9e725106bd6f453644c28c9e547
accept-ranges: bytes
cf-ray: 68b69de8fd70dfc7-FRA
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
DATA 200
OK truncated
/ 514 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2bae9fc3e57c860103d1e03360ba3246e3b6c5bcaa6f3183ce8066cc69843a5d

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/webp

GET
DATA 200
OK truncated
/ 654 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7560081f09d7c7cc914628f0d6f9bd2f91a1c33ccd0403e130c441c607d06f33

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/webp

GET
DATA 200
OK truncated
/ 888 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6c462a751af6aeec10856860e6a0887193f98e3fe500686141d3cb0bdcdc042a

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/webp

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2ae11b8d7458ea7d87d6889e190ad6b5701aaf6072f54df327f745c997c3a0d0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/webp

GET
DATA 200
OK truncated
/ 564 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fd9607fb490da15bcad08a1091da8b5b62069d578624da8711e2e59a1d72de49

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/webp

GET
DATA 200
OK truncated
/ 568 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aa300a570cc50f33f0dbe6fa43169017bb99a2518e002f72b5a445ae07f7edc7

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/webp

GET
DATA 200
OK truncated
/ 550 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3ff0a9b4b8ab001e88e276ee8eccb5c3ca12ac572d894de2732616cfeb7212b

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/webp

GET
H3-29 200 mem8YaGs126MiZpBA-UFW50bbck.woff2
fonts.gstatic.com/s/opensans/v23/ 11 KB
11 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v23/mem8YaGs126MiZpBA-UFW50bbck.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

28e9420a6d03a70b837b51c9fbe1bb1f819a3d4aa71bffa07f7c3e79d7dcf878

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://voticle.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 05 Sep 2021 14:13:25 GMT
x-content-type-options: nosniff
age: 236545
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11316
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:23:19 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Sep 2022 14:13:25 GMT

GET
H3-29 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
54 B 28ms
14ms Image
image/gif 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=566237630&utmhn=voticle.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Getting%20My%20TRIPLE%20BUY%203%20x%20Herbalife%20Protein%20Bars%20(42%20Bars)%20-%20Great%20to%20be%20To%20Work&utmhid=1084396719&utmr=-&utmp=%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&utmht=1631087750643&utmac=UA-38085162-3&utmcc=__utma%3D229138075.279172295.1631087751.1631087751.1631087751.1%3B%2B__utmz%3D229138075.1631087751.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1044040653&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~

Requested by

Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Sep 2021 07:55:50 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 promoted-ads Show response
fonolive.com/ Frame 0519 5 KB
3 KB 3032ms
3032ms Document
text/html 2606:4700:3033::6815:3653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonolive.com/promoted-ads
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 03795c398f883a5c2189eb0cfefa6e2779ca38e1e71a719243073e4927666e67

Request headers

:method: GET
:authority: fonolive.com
:scheme: https
:path: /promoted-ads
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://voticle.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://voticle.com/

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
content-type: text/html; charset=UTF-8
set-cookie: PHPSESSID=9hmqe5360ch60i4mo3bjeq8o13; path=/
cache-control: max-age=0, no-cache, no-store, must-revalidate
pragma: no-cache
vary: Accept-Encoding
x-mod-pagespeed: 1.13.35.2-0
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tSXe0RLARVl%2B6mbh8jFRlFZCwHWzBE89GLIZCDir%2B0vwuEmr3hB0ev7C4UYWWzOm3F01F2WPQBn0bVmYjPtqxpyeOCDuWePjU5KMdTp7Qpo3BL672F5YeqXq1CbjrwSAloK287kGuFHe2hA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 68b69de99bc40742-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3-29 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109010101/ 250 KB
93 KB 43ms
30ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109010101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-5121538459968588&plah=voticle.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d739f4e9502d3c672029d4580ddff6e52872660508cc4b3f5c2eb2735c66a466

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95175
x-xss-protection: 0
server: cafe
etag: 18091442808060632251
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 07:55:50 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210901/r20190131/ Frame F7CD 10 KB
5 KB 6ms
5ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210901/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bf5230ffb8745d28c11ae8b743868364f9be8379300bd59d235f402a53ea96ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210901/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://voticle.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://voticle.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 08 Sep 2021 04:03:18 GMT
expires: Wed, 22 Sep 2021 04:03:18 GMT
content-type: text/html; charset=UTF-8
etag: 13836150016441684253
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4591
x-xss-protection: 0
age: 13952
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 201 B
657 B 113ms
41ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=voticle.com&callback=_gfp_s_&client=ca-pub-5121538459968588

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109010101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-5121538459968588&plah=voticle.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

7cb8fe64a8e975bae17e815549eb6f4d63656e5c5e975a9e4da77321d7e7c7c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 192
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
317 B 15ms
15ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=voticle.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Sep 2021 07:55:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
317 B 16ms
15ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=voticle.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Sep 2021 07:55:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2D31 436 B
235 B 164ms
162ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=600&slotname=8250817351&adk=2440252158&adf=1492073588&pi=t.ma~as.8250817351&w=165&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=165x600&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750682&bpp=4&bdt=284&idt=72&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&correlator=635887018840&frm=20&pv=2&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1220&ady=601&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=1&uci=a!1&fsb=1&xpc=glz1eLIm9N&p=https%3A//voticle.com&dtd=86

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0765137ee8b4f6689ae7a4c5dfe4abd408735e95f7d7d117dd6409789d04d5b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5121538459968588&output=html&h=600&slotname=8250817351&adk=2440252158&adf=1492073588&pi=t.ma~as.8250817351&w=165&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=165x600&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750682&bpp=4&bdt=284&idt=72&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&correlator=635887018840&frm=20&pv=2&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1220&ady=601&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=1&uci=a!1&fsb=1&xpc=glz1eLIm9N&p=https%3A//voticle.com&dtd=86
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://voticle.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://voticle.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 08 Sep 2021 07:55:50 GMT
server: cafe
content-length: 212
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 08-Sep-2021 08:10:50 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 08 Sep 2021 07:55:50 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 39ms
20ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fecb5df18e8faa43dc3aa3f49ffd7224c84e378eb7514326a9ca3757a42daf35

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:50 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1630694577084272"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27575
x-xss-protection: 0
expires: Wed, 08 Sep 2021 07:55:50 GMT

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 109A 436 B
236 B 141ms
140ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=600&slotname=9376916555&adk=3757388224&adf=3248948864&pi=t.ma~as.9376916555&w=165&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=165x600&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750686&bpp=1&bdt=288&idt=93&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1220&ady=1201&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=4WdTJLlOhP&p=https%3A//voticle.com&dtd=97

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

62bea161ad9776e426a3b9319eb49f4e8908f4f3ce8d18400e44e51a68330719

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5121538459968588&output=html&h=600&slotname=9376916555&adk=3757388224&adf=3248948864&pi=t.ma~as.9376916555&w=165&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=165x600&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750686&bpp=1&bdt=288&idt=93&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1220&ady=1201&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=4WdTJLlOhP&p=https%3A//voticle.com&dtd=97
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://voticle.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://voticle.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 08 Sep 2021 07:55:50 GMT
server: cafe
content-length: 213
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 08-Sep-2021 08:10:50 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 08 Sep 2021 07:55:50 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7459 436 B
234 B 121ms
120ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=600&slotname=8250817351&adk=2440252158&adf=1531977944&pi=t.ma~as.8250817351&w=165&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=165x600&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750687&bpp=1&bdt=288&idt=99&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600%2C165x600&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1220&ady=1801&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=KuJH0tjWpL&p=https%3A//voticle.com&dtd=101

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e97014099db9cdff06e2f704f8ed2bf6680ba6e91ef7647a0a1028d655a4f779

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5121538459968588&output=html&h=600&slotname=8250817351&adk=2440252158&adf=1531977944&pi=t.ma~as.8250817351&w=165&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=165x600&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750687&bpp=1&bdt=288&idt=99&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600%2C165x600&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1220&ady=1801&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=KuJH0tjWpL&p=https%3A//voticle.com&dtd=101
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://voticle.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://voticle.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 08 Sep 2021 07:55:50 GMT
server: cafe
content-length: 211
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 08-Sep-2021 08:10:50 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 08 Sep 2021 07:55:50 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7B65 436 B
235 B 128ms
128ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&slotname=8250817351&adk=3333677467&adf=1475420161&pi=t.ma~as.8250817351&w=443&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=443x280&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750688&bpp=1&bdt=290&idt=103&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600%2C165x600%2C165x600&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=733&ady=601&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=4&uci=a!4&fsb=1&xpc=72zbaIkAG7&p=https%3A//voticle.com&dtd=106

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ee63724ca4074beba4fb0e1df477fbcb813e937302323b5f1e6c9e6ccfad3e3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&slotname=8250817351&adk=3333677467&adf=1475420161&pi=t.ma~as.8250817351&w=443&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=443x280&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750688&bpp=1&bdt=290&idt=103&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600%2C165x600%2C165x600&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=733&ady=601&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=4&uci=a!4&fsb=1&xpc=72zbaIkAG7&p=https%3A//voticle.com&dtd=106
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://voticle.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://voticle.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 08 Sep 2021 07:55:50 GMT
server: cafe
content-length: 212
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 08-Sep-2021 08:10:50 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 08 Sep 2021 07:55:50 GMT
cache-control: private

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 30ms
16ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=voticle.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Sep 2021 07:55:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 31ms
15ms Script
application/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=voticle.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Sep 2021 07:55:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C691 436 B
236 B 123ms
123ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&slotname=8250817351&adk=248325190&adf=3531856095&pi=t.ma~as.8250817351&w=1140&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750689&bpp=1&bdt=290&idt=109&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600%2C165x600%2C165x600%2C443x280&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3286&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=kBvx26Tnfk&p=https%3A//voticle.com&dtd=111

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a6d5cae9278cfcb4b7c9bef2806cbb7bbc62842cd2f241031a213e3f3ac701a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&slotname=8250817351&adk=248325190&adf=3531856095&pi=t.ma~as.8250817351&w=1140&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750689&bpp=1&bdt=290&idt=109&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600%2C165x600%2C165x600%2C443x280&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3286&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=kBvx26Tnfk&p=https%3A//voticle.com&dtd=111
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://voticle.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://voticle.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 08 Sep 2021 07:55:50 GMT
server: cafe
content-length: 213
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 08-Sep-2021 08:10:50 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 08 Sep 2021 07:55:50 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DE8E 436 B
234 B 120ms
120ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&slotname=9376916555&adk=3224866322&adf=2455508272&pi=t.ma~as.9376916555&w=1140&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750689&bpp=1&bdt=290&idt=114&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600%2C165x600%2C165x600%2C443x280%2C1140x280&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3566&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=tP2K7mf2E8&p=https%3A//voticle.com&dtd=115

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a7b494753236a3d0468db23fff9a17447c2953a1f2bd70e046e70afe252fd4cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&slotname=9376916555&adk=3224866322&adf=2455508272&pi=t.ma~as.9376916555&w=1140&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750689&bpp=1&bdt=290&idt=114&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600%2C165x600%2C165x600%2C443x280%2C1140x280&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3566&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=tP2K7mf2E8&p=https%3A//voticle.com&dtd=115
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://voticle.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://voticle.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 08 Sep 2021 07:55:50 GMT
server: cafe
content-length: 211
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 08-Sep-2021 08:10:50 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 08 Sep 2021 07:55:50 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C0A7 436 B
233 B 123ms
122ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&slotname=8250817351&adk=2688178878&adf=14637539&pi=t.ma~as.8250817351&w=360&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=360x280&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750690&bpp=1&bdt=292&idt=117&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600%2C165x600%2C165x600%2C443x280%2C1140x280%2C1140x280&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1010&ady=4219&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=D1Kq1VlUfn&p=https%3A//voticle.com&dtd=119

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1db238cccd64f02c294de98f556dc6d84086700b08f8ff91ccca37118165c145

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&slotname=8250817351&adk=2688178878&adf=14637539&pi=t.ma~as.8250817351&w=360&fwrn=4&fwrnh=100&lmt=1631087750&rafmt=1&psa=0&format=360x280&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750690&bpp=1&bdt=292&idt=117&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600%2C165x600%2C165x600%2C443x280%2C1140x280%2C1140x280&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1010&ady=4219&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=D1Kq1VlUfn&p=https%3A//voticle.com&dtd=119
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://voticle.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://voticle.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 08 Sep 2021 07:55:50 GMT
server: cafe
content-length: 210
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 08-Sep-2021 08:10:50 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 08 Sep 2021 07:55:50 GMT
cache-control: private

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=voticle.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Sep 2021 07:55:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 17ms
16ms Script
application/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=voticle.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Sep 2021 07:55:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 8017 16 KB
5 KB 99ms
99ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&adk=1812271804&adf=3025194257&lmt=1631087750&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750864&bpp=1&bdt=466&idt=1&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600%2C165x600%2C165x600%2C443x280%2C1140x280%2C1140x280%2C360x280&nras=1&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=33792&bc=31&ifi=9&uci=a!9&fsb=1&dtd=5

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1799b6a54bf67a2e0c52436fca5a318b67e7825040e6f66e76bf32db8e9bb4ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5121538459968588&output=html&adk=1812271804&adf=3025194257&lmt=1631087750&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750864&bpp=1&bdt=466&idt=1&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&prev_fmts=165x600%2C165x600%2C165x600%2C443x280%2C1140x280%2C1140x280%2C360x280&nras=1&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=33792&bc=31&ifi=9&uci=a!9&fsb=1&dtd=5
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://voticle.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://voticle.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 08 Sep 2021 07:55:50 GMT
server: cafe
content-length: 4706
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 08-Sep-2021 08:10:50 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 08 Sep 2021 07:55:50 GMT
cache-control: private

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=voticle.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Sep 2021 07:55:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=voticle.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Sep 2021 07:55:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9F7B 436 B
236 B 191ms
191ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&adk=617080280&adf=3730911173&pi=t.aa~a.3611581317~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1631087751&rafmt=1&to=qs&pwprc=8256796650&psa=0&format=1140x280&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750993&bpp=1&bdt=594&idt=1&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9f287233d4edc8c4-2269351afcc800af%3AT%3D1631087750%3ART%3D1631087750%3AS%3DALNI_Mbn-iqNYL53ITuvI6ijpCGz0YxTHg&prev_fmts=165x600%2C165x600%2C165x600%2C443x280%2C1140x280%2C1140x280%2C360x280%2C0x0&nras=2&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=1152&bc=31&ifi=10&uci=a!a&btvi=6&fsb=1&xpc=hofl2SJeIH&p=https%3A//voticle.com&dtd=14

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d253693bd317f848731b27fe6346d0edaccbaae32f30d63c1d89f346998ecff5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&adk=617080280&adf=3730911173&pi=t.aa~a.3611581317~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1631087751&rafmt=1&to=qs&pwprc=8256796650&psa=0&format=1140x280&url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087750993&bpp=1&bdt=594&idt=1&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9f287233d4edc8c4-2269351afcc800af%3AT%3D1631087750%3ART%3D1631087750%3AS%3DALNI_Mbn-iqNYL53ITuvI6ijpCGz0YxTHg&prev_fmts=165x600%2C165x600%2C165x600%2C443x280%2C1140x280%2C1140x280%2C360x280%2C0x0&nras=2&correlator=635887018840&frm=20&pv=1&ga_vid=279172295.1631087751&ga_sid=1631087751&ga_hid=1084396719&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062297&oid=3&pvsid=3446732076693805&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=1152&bc=31&ifi=10&uci=a!a&btvi=6&fsb=1&xpc=hofl2SJeIH&p=https%3A//voticle.com&dtd=14
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://voticle.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://voticle.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 08 Sep 2021 07:55:51 GMT
server: cafe
content-length: 212
x-xss-protection: 0
set-cookie: IDE=AHWqTUkye3ceLN6JHXNNDb0lJhJIS5skXu2kNRpYtOVsGo2yy3gPt2bBHMRODvpSz-A; expires=Mon, 03-Oct-2022 07:55:51 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 08 Sep 2021 07:55:51 GMT
cache-control: private

GET
H3-29 200 css
fonts.googleapis.com/ Frame 86AF 376 B
299 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Engagement

Requested by

Host: fonolive.com
URL: https://fonolive.com/promoted-ads

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a58ca0e14e9b06ff94afa9d0d13ea965f64ad7c2c716b0ecc502da670d406cee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 08 Sep 2021 07:55:53 GMT
server: ESF
date: Wed, 08 Sep 2021 07:55:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 08 Sep 2021 07:55:53 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 86AF 2 KB
546 B 18ms
17ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans

Requested by

Host: fonolive.com
URL: https://fonolive.com/promoted-ads

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3a57826dd4437403ec9dffe3d8a907466926d7123e4a765ec724d79ae24e1d54

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 08 Sep 2021 07:50:22 GMT
server: ESF
date: Wed, 08 Sep 2021 07:55:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 08 Sep 2021 07:55:53 GMT

GET
H3-29 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ Frame 86AF 118 KB
20 KB 17ms
16ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css

Requested by

Host: fonolive.com
URL: https://fonolive.com/promoted-ads

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 632, 617, 617, 617
age: 1318971
cdn-cachedat: 2021-06-08 21:21:23
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:03:59 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 203451c6c050184245ebe231729b4b5c
cf-ray: 68b69dfb4dbbbedd-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H3-29 200 bootstrap-theme.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ Frame 86AF 23 KB
3 KB 16ms
16ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap-theme.min.css

Requested by

Host: fonolive.com
URL: https://fonolive.com/promoted-ads

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

653e073e97423adda5bc3917a241ee8497dd38a48f14bcde0098a4e54fd0fa5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 601, 617
age: 14609055
cdn-cachedat: 2021-03-11 11:57:57
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:03:59 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 4af8c755c17c8550f5f53c6d6b83f353
cf-ray: 68b69dfb4dbcbedd-FRA
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H3-29 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 86AF 138 KB
48 KB 45ms
44ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: fonolive.com
URL: https://fonolive.com/promoted-ads

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d9e83e3e3d08f9a8d567753deae5b2de7e51709a25adba8cb4525db28a22f4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49516
x-xss-protection: 0
server: cafe
etag: 11734312164484278086
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 07:55:53 GMT

GET
H2 200 dmedianet.js Show response
contextual.media.net/ Frame 86AF 148 KB
50 KB 147ms
65ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/dmedianet.js?cid=8CU24V3HJ

Requested by

Host: fonolive.com
URL: https://fonolive.com/promoted-ads

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

662a65a85a54b8491ea015d1b1682d14f62495dbceb997f84cef3e2c1152f034

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-mnt-h: 10-4
content-encoding: gzip
server: Apache
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
etag: "f835f6836450da5fe97cf9801017e66d"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
date: Wed, 08 Sep 2021 07:55:53 GMT
strict-transport-security: max-age=604800
x-mnt-w: 8-31
expires: Wed, 08 Sep 2021 08:00:53 GMT

GET
H3-29 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.4.1/ Frame 86AF 86 KB
30 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js

Requested by

Host: fonolive.com
URL: https://fonolive.com/promoted-ads

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 18:29:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48405
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30774
x-xss-protection: 0
last-modified: Mon, 13 May 2019 14:37:17 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 07 Sep 2022 18:29:08 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 86AF 99 KB
26 KB 20ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: fonolive.com
URL: https://fonolive.com/promoted-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

335b59e615135313a66319e641cdad6ac3489a600e04d4181c859699bed4babe

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 25999
x-xss-protection: 0
pragma: public
x-fb-debug: QIcApKarcGIFxnF0JJd0QmlYl8hWdNlwuXY8ckhs89GppCYngul6lQ3sAoDHNh08jwNjOmW6fO0mG3eOuy1HaA==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Wed, 08 Sep 2021 07:55:53 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-29 200 599283737456594 Show response
connect.facebook.net/signals/config/ Frame 86AF 306 KB
87 KB 193ms
192ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/599283737456594?v=2.9.45&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d7987faa6b5a2695914ebd197d709371b723a07945e82f9dbc47fd9948632428

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: 5Gs7PkaAQ7cdL1IwqSDGwzYTvg5n39SpXsFgzB1BAt3i6KHGzRxvbyjFR6aYwlfI7TsUdo21uAg24P1XCuHalQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 08 Sep 2021 07:55:53 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-29 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109010101/ Frame 86AF 250 KB
93 KB 32ms
32ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109010101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-5121538459968588&plah=fonolive.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d739f4e9502d3c672029d4580ddff6e52872660508cc4b3f5c2eb2735c66a466

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95175
x-xss-protection: 0
server: cafe
etag: 18091442808060632251
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 07:55:53 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ Frame 86AF 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=fonolive.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ Frame 86AF 107 B
122 B 16ms
16ms Script
application/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=fonolive.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 403 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9086 7 KB
685 B 137ms
136ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&adk=1812271804&adf=3279755397&plat=1%3A1536%2C2%3A1536%2C8%3A134218240%2C9%3A134251016%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C26%3A512%2C27%3A512%2C30%3A1049088%2C32%3A32&format=0x0&url=https%3A%2F%2Fvoticle.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087753562&bpp=2&bdt=84&idt=52&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&nras=1&correlator=7216094358391&frm=24&ife=1&pv=2&ga_vid=622920125.1631087754&ga_sid=1631087754&ga_hid=877285634&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=1200&ish=295&ifk=2445910273&scr_x=-12245933&scr_y=-12245933&eid=42530672%2C44747621%2C31060033%2C31062297&oid=3&pvsid=1014470750789572&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1200%2C295&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=1&uci=1.y90ggrjtgiyo&fsb=1&dtd=66

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4000e1372f4cbd8f0511bb73b788458fd5b57cd8e49c73fb29904b9560ee5a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5121538459968588&output=html&adk=1812271804&adf=3279755397&plat=1%3A1536%2C2%3A1536%2C8%3A134218240%2C9%3A134251016%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C26%3A512%2C27%3A512%2C30%3A1049088%2C32%3A32&format=0x0&url=https%3A%2F%2Fvoticle.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087753562&bpp=2&bdt=84&idt=52&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&nras=1&correlator=7216094358391&frm=24&ife=1&pv=2&ga_vid=622920125.1631087754&ga_sid=1631087754&ga_hid=877285634&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=1200&ish=295&ifk=2445910273&scr_x=-12245933&scr_y=-12245933&eid=42530672%2C44747621%2C31060033%2C31062297&oid=3&pvsid=1014470750789572&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1200%2C295&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=1&uci=1.y90ggrjtgiyo&fsb=1&dtd=66
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fonolive.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkye3ceLN6JHXNNDb0lJhJIS5skXu2kNRpYtOVsGo2yy3gPt2bBHMRODvpSz-A
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fonolive.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 08 Sep 2021 07:55:53 GMT
server: cafe
content-length: 664
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 86AF 72 KB
27 KB 32ms
18ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fecb5df18e8faa43dc3aa3f49ffd7224c84e378eb7514326a9ca3757a42daf35

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1630694577084272"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27575
x-xss-protection: 0
expires: Wed, 08 Sep 2021 07:55:53 GMT

GET
H3-29 403 ads Show response
googleads.g.doubleclick.net/pagead/ Frame AC43 436 B
232 B 118ms
118ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&slotname=8250817351&adk=248325190&adf=123856640&pi=t.ma~as.8250817351&w=1140&fwrn=16&fwrnh=100&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fvoticle.com%2F&ea=0&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087753564&bpp=1&bdt=86&idt=71&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=7216094358391&frm=24&ife=1&pv=1&ga_vid=622920125.1631087754&ga_sid=1631087754&ga_hid=877285634&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=1200&ish=295&ifk=2445910273&scr_x=-12245933&scr_y=-12245933&eid=42530672%2C44747621%2C31060033%2C31062297&oid=3&pvsid=1014470750789572&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1200%2C295&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=2.mnrzxzw8jvjp&fsb=1&dtd=81

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0a9e1770a0ed2adb82495e548f71d40972f48d7575652dad00987e6bb37a41f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&slotname=8250817351&adk=248325190&adf=123856640&pi=t.ma~as.8250817351&w=1140&fwrn=16&fwrnh=100&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fvoticle.com%2F&ea=0&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087753564&bpp=1&bdt=86&idt=71&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=7216094358391&frm=24&ife=1&pv=1&ga_vid=622920125.1631087754&ga_sid=1631087754&ga_hid=877285634&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=1200&ish=295&ifk=2445910273&scr_x=-12245933&scr_y=-12245933&eid=42530672%2C44747621%2C31060033%2C31062297&oid=3&pvsid=1014470750789572&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1200%2C295&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=2.mnrzxzw8jvjp&fsb=1&dtd=81
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fonolive.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkye3ceLN6JHXNNDb0lJhJIS5skXu2kNRpYtOVsGo2yy3gPt2bBHMRODvpSz-A
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fonolive.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 08 Sep 2021 07:55:53 GMT
server: cafe
content-length: 211
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 css
fonts.googleapis.com/ Frame 0519 376 B
299 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Engagement

Requested by

Host: fonolive.com
URL: https://fonolive.com/promoted-ads

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a58ca0e14e9b06ff94afa9d0d13ea965f64ad7c2c716b0ecc502da670d406cee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 08 Sep 2021 07:55:53 GMT
server: ESF
date: Wed, 08 Sep 2021 07:55:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 08 Sep 2021 07:55:53 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 0519 2 KB
546 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans

Requested by

Host: fonolive.com
URL: https://fonolive.com/promoted-ads

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3a57826dd4437403ec9dffe3d8a907466926d7123e4a765ec724d79ae24e1d54

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 08 Sep 2021 07:51:47 GMT
server: ESF
date: Wed, 08 Sep 2021 07:55:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 08 Sep 2021 07:55:53 GMT

GET
H3-29 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ Frame 0519 118 KB
20 KB 18ms
17ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css

Requested by

Host: fonolive.com
URL: https://fonolive.com/promoted-ads

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 632, 617, 617, 617
age: 1318971
cdn-cachedat: 2021-06-08 21:21:23
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:03:59 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 203451c6c050184245ebe231729b4b5c
cf-ray: 68b69dfc8e02bedd-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H3-29 200 bootstrap-theme.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ Frame 0519 23 KB
3 KB 17ms
16ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap-theme.min.css

Requested by

Host: fonolive.com
URL: https://fonolive.com/promoted-ads

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

653e073e97423adda5bc3917a241ee8497dd38a48f14bcde0098a4e54fd0fa5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 601, 617
age: 14609055
cdn-cachedat: 2021-03-11 11:57:57
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:03:59 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 4af8c755c17c8550f5f53c6d6b83f353
cf-ray: 68b69dfc8e03bedd-FRA
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H3-29 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 0519 138 KB
48 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: fonolive.com
URL: https://fonolive.com/promoted-ads

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d9e83e3e3d08f9a8d567753deae5b2de7e51709a25adba8cb4525db28a22f4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49516
x-xss-protection: 0
server: cafe
etag: 11734312164484278086
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 07:55:53 GMT

GET
H2 200 dmedianet.js Show response
contextual.media.net/ Frame 0519 148 KB
50 KB 90ms
90ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/dmedianet.js?cid=8CU24V3HJ

Requested by

Host: fonolive.com
URL: https://fonolive.com/promoted-ads

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

671d6b0d22b5c6d33b1436846e1dbee612ed9f479bd59bbbf30b12a89e5c164b

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-mnt-h: 10-4
content-encoding: gzip
server: Apache
etag: "f835f6836450da5fe97cf9801017e66d"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
date: Wed, 08 Sep 2021 07:55:53 GMT
strict-transport-security: max-age=604800
x-mnt-w: 8-32
expires: Wed, 08 Sep 2021 08:00:53 GMT

GET
H3-29 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.4.1/ Frame 0519 86 KB
30 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js

Requested by

Host: fonolive.com
URL: https://fonolive.com/promoted-ads

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 18:29:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48405
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30774
x-xss-protection: 0
last-modified: Mon, 13 May 2019 14:37:17 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 07 Sep 2022 18:29:08 GMT

GET
H3-29 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 0519 99 KB
25 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: fonolive.com
URL: https://fonolive.com/promoted-ads

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

335b59e615135313a66319e641cdad6ac3489a600e04d4181c859699bed4babe

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 25999
x-xss-protection: 0
pragma: public
x-fb-debug: QIcApKarcGIFxnF0JJd0QmlYl8hWdNlwuXY8ckhs89GppCYngul6lQ3sAoDHNh08jwNjOmW6fO0mG3eOuy1HaA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 08 Sep 2021 07:55:53 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-29 200 599283737456594 Show response
connect.facebook.net/signals/config/ Frame 0519 306 KB
87 KB 152ms
152ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/599283737456594?v=2.9.45&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d7987faa6b5a2695914ebd197d709371b723a07945e82f9dbc47fd9948632428

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: 8W21DgHrAsOe68ZoFiybWOcwRv6holoTYiRF+dkMvZIzbJ124igU8a7XNgRR5SOulwGynwtPK1DduLPLg4uoAQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 08 Sep 2021 07:55:53 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ Frame 86AF 44 B
297 B 19ms
6ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=599283737456594&ev=PageView&dl=https%3A%2F%2Ffonolive.com%2Fpromoted-ads&rl=https%3A%2F%2Fvoticle.com%2F&if=true&ts=1631087753763&sw=1600&sh=1200&v=2.9.45&r=stable&ec=0&o=30&it=1631087753545&coo=false&exp=p1&rqm=GET

Requested by

Host: fonolive.com
URL: https://fonolive.com/promoted-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Wed, 08 Sep 2021 07:55:53 GMT

GET
H3-29 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109010101/ Frame 0519 250 KB
93 KB 31ms
31ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109010101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-5121538459968588&plah=fonolive.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d739f4e9502d3c672029d4580ddff6e52872660508cc4b3f5c2eb2735c66a466

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95175
x-xss-protection: 0
server: cafe
etag: 18091442808060632251
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 07:55:53 GMT

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 86AF 11 KB
8 KB 34ms
20ms XHR
application/json 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210901&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

faa33986536695858d96f5396103627258f0af29d9eea5f8d047adafd86ed7c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8480
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ Frame 0519 107 B
122 B 15ms
14ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=fonolive.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ Frame 0519 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=fonolive.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 403 ads Show response
googleads.g.doubleclick.net/pagead/ Frame CC0B 7 KB
685 B 63ms
63ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&adk=1812271804&adf=3279755396&plat=1%3A1536%2C2%3A1536%2C8%3A134218240%2C9%3A134251016%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C26%3A512%2C27%3A512%2C30%3A1049088%2C32%3A32&format=0x0&url=https%3A%2F%2Fvoticle.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087753773&bpp=2&bdt=89&idt=51&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&nras=1&correlator=4291511303119&frm=24&ife=1&pv=2&ga_vid=2021952632.1631087754&ga_sid=1631087754&ga_hid=1095933314&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=1200&ish=295&ifk=2445910273&scr_x=-12245933&scr_y=-12245933&eid=42530671%2C31062297&oid=3&pvsid=1416224256187787&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1200%2C295&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=1&uci=1.6twtcihz6j0b&fsb=1&dtd=69

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4000e1372f4cbd8f0511bb73b788458fd5b57cd8e49c73fb29904b9560ee5a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5121538459968588&output=html&adk=1812271804&adf=3279755396&plat=1%3A1536%2C2%3A1536%2C8%3A134218240%2C9%3A134251016%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C26%3A512%2C27%3A512%2C30%3A1049088%2C32%3A32&format=0x0&url=https%3A%2F%2Fvoticle.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087753773&bpp=2&bdt=89&idt=51&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&nras=1&correlator=4291511303119&frm=24&ife=1&pv=2&ga_vid=2021952632.1631087754&ga_sid=1631087754&ga_hid=1095933314&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=1200&ish=295&ifk=2445910273&scr_x=-12245933&scr_y=-12245933&eid=42530671%2C31062297&oid=3&pvsid=1416224256187787&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1200%2C295&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=1&uci=1.6twtcihz6j0b&fsb=1&dtd=69
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fonolive.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkye3ceLN6JHXNNDb0lJhJIS5skXu2kNRpYtOVsGo2yy3gPt2bBHMRODvpSz-A
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fonolive.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 08 Sep 2021 07:55:53 GMT
server: cafe
content-length: 664
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0519 72 KB
27 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fecb5df18e8faa43dc3aa3f49ffd7224c84e378eb7514326a9ca3757a42daf35

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1630694577084272"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27575
x-xss-protection: 0
expires: Wed, 08 Sep 2021 07:55:53 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 86AF 17 KB
7 KB 41ms
19ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Wed, 08 Sep 2021 07:55:53 GMT

GET
H3-29 403 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 92BE 436 B
233 B 70ms
70ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&slotname=8250817351&adk=248325190&adf=123856643&pi=t.ma~as.8250817351&w=1140&fwrn=16&fwrnh=100&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fvoticle.com%2F&ea=0&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087753775&bpp=1&bdt=91&idt=76&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4291511303119&frm=24&ife=1&pv=1&ga_vid=2021952632.1631087754&ga_sid=1631087754&ga_hid=1095933314&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=1200&ish=295&ifk=2445910273&scr_x=-12245933&scr_y=-12245933&eid=42530671%2C31062297&oid=3&pvsid=1416224256187787&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1200%2C295&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=2.pa6qf56u657v&fsb=1&dtd=80

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

11793598211da55452f3fd0ce2c4aa35f3cab8b4372de5d367bf7ca27dba11c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5121538459968588&output=html&h=280&slotname=8250817351&adk=248325190&adf=123856643&pi=t.ma~as.8250817351&w=1140&fwrn=16&fwrnh=100&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fvoticle.com%2F&ea=0&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1631087753775&bpp=1&bdt=91&idt=76&shv=r20210901&mjsv=m202109010101&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4291511303119&frm=24&ife=1&pv=1&ga_vid=2021952632.1631087754&ga_sid=1631087754&ga_hid=1095933314&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=1200&ish=295&ifk=2445910273&scr_x=-12245933&scr_y=-12245933&eid=42530671%2C31062297&oid=3&pvsid=1416224256187787&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1200%2C295&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=2.pa6qf56u657v&fsb=1&dtd=80
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fonolive.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkye3ceLN6JHXNNDb0lJhJIS5skXu2kNRpYtOVsGo2yy3gPt2bBHMRODvpSz-A
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fonolive.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 08 Sep 2021 07:55:53 GMT
server: cafe
content-length: 212
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 988A 12 KB
5 KB 22ms
6ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fonolive.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fonolive.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Wed, 08 Sep 2021 07:31:37 GMT
expires: Thu, 08 Sep 2022 07:31:37 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1456
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 83F4 783 B
532 B 16ms
15ms Document
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

aa582fd2b5c040d31161e9269066c16f3413ee08a356d4ee86f588cf82a0bf9c

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-B4FBQeqdQXRi84HgcHEYhA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fonolive.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fonolive.com/

Response headers

expires: Wed, 08 Sep 2021 07:55:53 GMT
date: Wed, 08 Sep 2021 07:55:53 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-B4FBQeqdQXRi84HgcHEYhA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 /
www.facebook.com/tr/ Frame 0519 44 B
91 B 8ms
7ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=599283737456594&ev=PageView&dl=https%3A%2F%2Ffonolive.com%2Fpromoted-ads&rl=https%3A%2F%2Fvoticle.com%2F&if=true&ts=1631087753902&sw=1600&sh=1200&v=2.9.45&r=stable&ec=0&o=30&it=1631087753732&coo=false&exp=p1&rqm=GET

Requested by

Host: fonolive.com
URL: https://fonolive.com/promoted-ads

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Wed, 08 Sep 2021 07:55:53 GMT

GET
H3-29 200 _KGu62JP3w4V72mm3cmDaqkgOPwqP-vkWuOQlm7wfU0.js Show response
pagead2.googlesyndication.com/bg/ Frame 988A 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/_KGu62JP3w4V72mm3cmDaqkgOPwqP-vkWuOQlm7wfU0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fca1aeeb624fdf0e15ef69a6ddc9836aa92038fc2a3febe45ae390966ef07d4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 04:04:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 100313
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13240
x-xss-protection: 0
last-modified: Mon, 30 Aug 2021 12:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 04:04:00 GMT

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 0519 11 KB
8 KB 23ms
22ms XHR
application/json 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210901&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04aa6bead873ef05803a3dab09dfcdb24f178894d6506fe890c3581d7d628f03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8449
x-xss-protection: 0

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 18ms
18ms XHR
application/json 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210901&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

99ee0379d153c3ece9ac56ac3f9f3547db6d1db6f22cff622dc118ea94da057f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8503
x-xss-protection: 0

POST
H3-29 204 mod_pagespeed_beacon Show response
voticle.com/ 0
521 B 2972ms
2972ms XHR
text/plain 2606:4700:3032::6815:235e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://voticle.com/mod_pagespeed_beacon?url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Requested by: Host: voticle.com
URL: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:235e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-fetch-mode: cors
origin: https://voticle.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: empty
cookie: PHPSESSID=8u4cv57pnq46d1k5o26l95en74; __utma=229138075.279172295.1631087751.1631087751.1631087751.1; __utmc=229138075; __utmz=229138075.1631087751.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=229138075.1.10.1631087751; __gads=ID=9f287233d4edc8c4-2269351afcc800af:T=1631087750:RT=1631087750:S=ALNI_Mbn-iqNYL53ITuvI6ijpCGz0YxTHg
content-length: 124
:path: /mod_pagespeed_beacon?url=https%3A%2F%2Fvoticle.com%2Fa%2Farticles%2F163591%2Fgetting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type: application/x-www-form-urlencoded
accept: */*
cache-control: no-cache
:authority: voticle.com
referer: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
:scheme: https
sec-fetch-site: same-origin
:method: POST
Referer: https://voticle.com/a/articles/163591/getting-my-triple-buy-3-x-herbalife-protein-bars-42-bars-great-to-be-to-work
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 08 Sep 2021 07:55:56 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fi2TaQlQ9uJU4wsWqCL1nMC9sg78FQYEltuHvL8tP6%2B4CphLq8khDDGWV8hNGy7KB3caoSZ0h9FQ82gZTgm7hMCSTb9MpLjtLdol10eb12oS5adWd4DG50fgvRuoIRfcHUr7F2L3aWAzZQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=0, no-cache
cf-ray: 68b69dfe29191e47-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Wed, 08 Sep 2021 07:55:53 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 0519 17 KB
6 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Wed, 08 Sep 2021 07:55:53 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 2EDF 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://voticle.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://voticle.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Wed, 08 Sep 2021 07:31:37 GMT
expires: Thu, 08 Sep 2022 07:31:37 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1456
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 6AB2 783 B
535 B 16ms
16ms Document
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

b29ff1f7a0430d39cc2b59a55da5872a2ec34a36be1da2ed6d3e7a0eaea968f1

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-OW/dAF0/Ikb8t0RfBRc4CQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://voticle.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://voticle.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Wed, 08 Sep 2021 07:55:53 GMT
date: Wed, 08 Sep 2021 07:55:53 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-OW/dAF0/Ikb8t0RfBRc4CQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 2E61 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fonolive.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fonolive.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Wed, 08 Sep 2021 07:31:37 GMT
expires: Thu, 08 Sep 2022 07:31:37 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1456
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame E5E8 783 B
536 B 17ms
16ms Document
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

725279826377bcb9240e875470241d8e5ecd1b29ceff2ec11e93540446065cd8

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-39iHDBK2HnNF27E6/GUscA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fonolive.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fonolive.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Wed, 08 Sep 2021 07:55:54 GMT
date: Wed, 08 Sep 2021 07:55:54 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-39iHDBK2HnNF27E6/GUscA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 _KGu62JP3w4V72mm3cmDaqkgOPwqP-vkWuOQlm7wfU0.js Show response
pagead2.googlesyndication.com/bg/ Frame 2EDF 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/_KGu62JP3w4V72mm3cmDaqkgOPwqP-vkWuOQlm7wfU0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fca1aeeb624fdf0e15ef69a6ddc9836aa92038fc2a3febe45ae390966ef07d4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 04:04:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 100314
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13240
x-xss-protection: 0
last-modified: Mon, 30 Aug 2021 12:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 04:04:00 GMT

GET
H3-29 200 _KGu62JP3w4V72mm3cmDaqkgOPwqP-vkWuOQlm7wfU0.js Show response
pagead2.googlesyndication.com/bg/ Frame 2E61 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/_KGu62JP3w4V72mm3cmDaqkgOPwqP-vkWuOQlm7wfU0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fca1aeeb624fdf0e15ef69a6ddc9836aa92038fc2a3febe45ae390966ef07d4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 04:04:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 100314
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13240
x-xss-protection: 0
last-modified: Mon, 30 Aug 2021 12:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 04:04:00 GMT

GET
H3-29 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 86AF 0
0 93ms
93ms Image
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&t=2&li=gda_r20210901&jk=1014470750789572&bg=!cnGlcTXNAAYJpm41CaY7ACkAdvg8Wg_CDtxZCDDU_BiJr8CVutsCI2yo8XgQhUb9aCMNCSiBLhl9oAIAAAB2UgAAAChoAQeZApSKpjORX24X0GmNb6L3JQVitjLzTpo9zerjMAQdItL6SS5427LIeZEOccxT1HpujLKlE29SDo_pMmaKOChkDPTah_tI3MjfY5eWoEKLaorYyjvpU8Di_a-AKjWQowU6ofCTjfTuc3WCgdcxSk7X0XzLtE4rt-6d7Zpt0hUzImdO7GXGmVtE58pu0jNQMmm8UEzETbEAzm42Rt2KdW3Cx6DxlLgPa27vlTNXakmH-gx6lsOsJ5u5qwJSQbz5H1MsrVpFpM-_sMQtmj05xFxlEYr8gbg82PhO840mZalDBBAP4_jPhxRBJEOFAfUPzXbYgE-3rfhh6oaNmZQ55Bh847xwPdPDd9vz6TQt1U_Coe8Mn7yreNi8_duDQWyjeU5KWic6Mmru8J0AdEt2ePnqMmLLz5CQ9vZQ_FIwvF8LbiNGTmLdZ4O_yC5OcKZGfMdB5WkxcZf5SrDC-ArzXsxtV6gTgUZUoWDeO1JFwkcgHOOD2lRpLD7NYy6yQiQQNi6y-FbEUaYWPquQfS64j9uaWquNC7mhOwj0jxCxXtF6KQ8sYQCYJmx2TwvH6j-pjxJ7YprJLVzKSKVTcvPNx8L0lFtAu8tamZ4RCBRLDEjlqqvXv9ni0DlKOSuXZiYBOYvGGhOMhXMIJJ23VlxIE9sbk-Vw4LwP11i7NJVBpY28wLLv3IcxF_rFgMwJWXu2KTswv3-EOpcq4UM8t5Nur1P9jJARHVL28Lzztm0QGuicT7jZZ_LuIRz_uQIOOHRipQItIeT5ezPoWe2TfhmJlQ6Io2Psn_UZ9e-YxXWgXzKQ72XfemWloqco7ZwpEnUwMYIp6PHW0TDXCKwWiZ3dLBT1FHWwrBfSi2KBO9n_DZEe9lWt8b9Y4gE
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 60ms
60ms Image
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&t=2&li=gda_r20210901&jk=3446732076693805&bg=!d3SldDDNAAYJpm41CaY7ACkAdvg8WsiU0lBDx6oi-pQf2zQLxbu664s_aNuE9oULfgy_41btuCIhJAIAAACdUgAAABhoAQcKACe1d5_2ccUxRMVg8rvU7Gw9qsFlDaQ4cGky9r44ogXXXUl7uHdhfkmZAnLfGLgzp8P0rzhexjd1OUmYoTjLkXpp-8kxDDgGeNZ8cHSACif5vk0VJ8Ub0WgKdWZ2oTXSf47dk7nXSFvUC_QlJO1uvbf7-00pG1StObTqfA5cTGzaJExzkyrP75aEZb88BAcep4R7d0HxG2xqQBvXLdeCYC9p_U2ZkAch2mOkpAVaeFjlrQhFw_sHDRnaRQQbh6COUvc2osq6jEfV7xnLVcY9LiXnqKc_K5L9rNO18NHzq8bKoAsMZhXLcja5i0u91sK32nG5vEdb0uqzSlk9f4PFvZN2lWzdTmRgXQLFbdwyxiCDRuRQxQ4xjPetnmRRztHU8ZZAo_vdS-Ysw65jhYot2Pjx8nSPAWLM9xJKLjp2EJqdNZKp_PhuFL_r-rXIh5bZ_uFPauzfKKohHHr_jdlbV7RtQMXB3ffig_UZHoTQOjCgYVvFTMW00t4he07GClSSEITrRZrVqmD3eLkTI9lVXaXjNI99vCM96eJomRp9oToXMoAVcflX7qlIq3cfpRqzL3G-jspCCJa8RE1WR64KORYRqwlIXYVTeAD76r0BXiRDq1diZC4k2HLHoobjhvsSgPI7TADLewVkGtQQtBRcc9F5-jpVJhNwRQrY4PiYfdl44trKCEvDu6X4FpzBX3wcsy2iugCxj1D14wwVOYTck0q0j3nR561JLEWtf2GGTIsfvRcCumbx3EfLAgs4XLfk_XMLiYFyxN8eWrdNZgsqa9F4fjvZlL6DKCbzenZy9Dm2WrCb5Nz35knD-sJWRAcQjYVEW02KZ0kFnP6JVFqVcJpXCUZx7ns6ZEP9m5Zy0xLqRTLI_fqassj6n2Xcpw
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://voticle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 0519 0
0 68ms
61ms Image
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&t=2&li=gda_r20210901&jk=1416224256187787&bg=!ZWalZiLNAAYJpm41CaY7ACkAdvg8WiNctlqNCHsuraQB2OqpOFpbvJDionWmyQRQVszyqzqcdgcdlwIAAABxUgAAAAZoAQcKAP5sbJRm1OQoBCtcXvKeQMuyo7FBhHZx_b9ORsaCS2TAuXlsZhfUg4YQOzSD1Y2E1hp9VvH83iEN5Q1XxRC8oNZPAXKmnJLahP3ULDmuDdo4VNkXxyFZmt9sSow6e3ZZxoK2WhSEyjko6_4hAjuVC4-_1dytmnau5BiUIiPeo46k4peFbWMTZkW_DFWcXp6yDb7bCY3xQGGc-rbiS3hvgJ1K2dAhQO97_UPOqpjWu-QRC6INsqQoHPJq9sWhEcYucpLHruo6I3Pgh-ByTwVVbBwcxlxYOIWleozQiizdQt_uKiWsJ4QyqG8vRqI78EMQjnwAIfq7l-fSGm9yal6Cz5kChKkDnyev683hbD4HVYQ9dcMeEVVm7kiv8VJwKxsaWkIB7iyWEp8Hv-sx1tjJGPPhLKdPuVID-DQ63drAKXJcPjLMLuVMgVGTeMEM9rZ2_vSO3uQPND4lF1bzdjN4ykn9658WGxCurGICoIqlr8ItdUK8DyME_bcZKuEU0GBubte5A93lrid7Y8k0QwPpLZbkQFDf7wIXZVQxmitYot9plyNQD561nDyW8M_tJDfyz-T2qrnMqpr0R-l_4lOA5k_FotezTYNpsIHldTXed8NyIUSDiwQGOi5tbvjoQa-bsgkO1c74k5TZiDD4d1acY-PZS93ujRVI93sWQ5z34x9hfgvxbPdL-LNDCSQlK20uBj4CEjysWFRHgdWpHWWC6d3oQLcoyr-SbNmO1Zeb_Yr2SVzTgqV6JxPdogVpnytngJV-XzbaWkObEP3m6CxFyhRBwU98Bg0N2bnwy40FUQjiaIOSptjbDB-4YNMW4KAL58aLzaoxhWJhbnwCcGbFyiNL03BeF9oUcYPskOGKDzvwvkn1QkKIqye4zcOdUA7YtG0fPkkw4PyX1ZbS42ayaY3Kxgxqagtu31vgcvKsbGdfGtl-N199fOLwifpzC0EF3N0CfSkeCpaBBdinyHvZvo8Pj2q1FxO6VQ2pP3GXX_5fagacc_agFtj81inr4ssxZ4F_RfeodRqDe_BafoVbv5GdfUionohEKlFQEsJPUhGIYFGV_gnrU1kHpBlTnlUdbpBsx5_xPJjOOdNEXEIrR9WxHvW90-6SDS4XtiZPHg94wxY2mAgZsOjLFwMjIqsa7TuYKey200iDZD6YMTU5xlajTwOZd0S33gyEdAyOmec3M-c4IGf7
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 /
www.facebook.com/tr/ Frame 86AF 44 B
88 B 6ms
6ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=599283737456594&ev=Microdata&dl=https%3A%2F%2Ffonolive.com%2Fpromoted-ads&rl=https%3A%2F%2Fvoticle.com%2F&if=true&ts=1631087755266&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%5Cn%5Cn%5Cn%5Cn%5Cn%5Cn%5Cn%20%22%2C%22meta%3Adescription%22%3A%22%20%22%2C%22meta%3Akeywords%22%3A%22%20%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.45&r=stable&ec=1&o=30&it=1631087753545&coo=false&es=automatic&tm=3&exp=p1&rqm=GET

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:55 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Wed, 08 Sep 2021 07:55:55 GMT

GET
H3-29 200 /
www.facebook.com/tr/ Frame 0519 44 B
88 B 7ms
7ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=599283737456594&ev=Microdata&dl=https%3A%2F%2Ffonolive.com%2Fpromoted-ads&rl=https%3A%2F%2Fvoticle.com%2F&if=true&ts=1631087755404&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%5Cn%5Cn%5Cn%5Cn%5Cn%5Cn%5Cn%20%22%2C%22meta%3Adescription%22%3A%22%20%22%2C%22meta%3Akeywords%22%3A%22%20%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.45&r=stable&ec=1&o=30&it=1631087753732&coo=false&es=automatic&tm=3&exp=p1&rqm=GET

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://fonolive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:55:55 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Wed, 08 Sep 2021 07:55:55 GMT

Verdicts & Comments Add Verdict or Comment

88 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-20 06:26:23	Name: IDE Value: AHWqTUkye3ceLN6JHXNNDb0lJhJIS5skXu2kNRpYtOVsGo2yy3gPt2bBHMRODvpSz-A
.voticle.com/	1970-01-20 06:26:23	Name: __gads Value: ID=9f287233d4edc8c4-2269351afcc800af:T=1631087750:RT=1631087750:S=ALNI_Mbn-iqNYL53ITuvI6ijpCGz0YxTHg
.voticle.com/	1970-01-19 21:04:49	Name: __utmb Value: 229138075.1.10.1631087751
.voticle.com/	1970-01-20 01:27:35	Name: __utmz Value: 229138075.1631087751.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.voticle.com/	1970-01-19 21:04:48	Name: __utmt Value: 1
.voticle.com/	1969-12-31 23:59:59	Name: __utmc Value: 229138075
.voticle.com/	1970-01-20 14:35:59	Name: __utma Value: 229138075.279172295.1631087751.1631087751.1631087751.1
voticle.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 8u4cv57pnq46d1k5o26l95en74

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
ajax.googleapis.com
az31823.vo.msecnd.net
connect.facebook.net
contextual.media.net
fonolive.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
i.ebayimg.com
image.slidesharecdn.com
maxcdn.bootstrapcdn.com
pagead2.googlesyndication.com
partner.googleadservices.com
productimages.hepsiburada.net
ssl.google-analytics.com
tpc.googlesyndication.com
voticle.com
www.facebook.com
www.google.com
www.googletagservices.com
z-na.amazon-adsystem.com
13.225.30.184
142.250.185.98
2.16.186.128
2.18.235.93
2606:2800:133:206e:1315:22a5:2006:24fd
2606:4700:3032::6815:235e
2606:4700:3033::6815:3653
2606:4700::6812:acf
2a00:1450:4001:800::2002
2a00:1450:4001:802::2003
2a00:1450:4001:803::2002
2a00:1450:4001:810::2002
2a00:1450:4001:813::2002
2a00:1450:4001:813::200a
2a00:1450:4001:827::2001
2a00:1450:4001:827::2003
2a00:1450:4001:828::2002
2a00:1450:4001:82a::2002
2a00:1450:4001:82a::200a
2a00:1450:4001:82f::2002
2a00:1450:4001:830::2008
2a00:1450:4001:830::200a
2a00:1450:4001:831::2004
2a00:1450:4001:831::2008
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:181:face:b00c:0:25de
2a04:4e42:3::718
34.96.96.52
03795c398f883a5c2189eb0cfefa6e2779ca38e1e71a719243073e4927666e67
04aa6bead873ef05803a3dab09dfcdb24f178894d6506fe890c3581d7d628f03
0626c6ed859b6954ac1fc149e261574282f1f2b8defe35e41976fde9b6460ceb
0765137ee8b4f6689ae7a4c5dfe4abd408735e95f7d7d117dd6409789d04d5b9
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0a9e1770a0ed2adb82495e548f71d40972f48d7575652dad00987e6bb37a41f6
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11793598211da55452f3fd0ce2c4aa35f3cab8b4372de5d367bf7ca27dba11c1
11c351a339eaaaafdf7843ca553caa112a08ccb5905059be4bbbd7e6c8dec2ab
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
13088125e10e9423be1410f4c68bed5d85781b3cf424e9b4b83effbe2d15000b
13ff721bb26c3c9569bba3aca324d975f95c504856ac87d78d4bead58d092f70
1799b6a54bf67a2e0c52436fca5a318b67e7825040e6f66e76bf32db8e9bb4ef
1870c5c47a57786303f059bd2a33e57b3098a73bfab05c0cd460b65217c52bb4
1b986ae793df3ae7aa417202e71ad60d7fee560e12ccdd011b31913e7b61a51e
1db238cccd64f02c294de98f556dc6d84086700b08f8ff91ccca37118165c145
218086d4079f261aadbdef5797b020f5126924b866870672ba78436dd52f2707
25944e4eb8ef497fa11ead9ca6c4dcd06863becda140dc93cd7bc5541fb81280
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
289f84ebadd42804fee945f1cbd0c928732b8b99b4312a368d9e6ae116ae186f
28e9420a6d03a70b837b51c9fbe1bb1f819a3d4aa71bffa07f7c3e79d7dcf878
2ae11b8d7458ea7d87d6889e190ad6b5701aaf6072f54df327f745c997c3a0d0
2bae9fc3e57c860103d1e03360ba3246e3b6c5bcaa6f3183ce8066cc69843a5d
334c965e8ed9376ee61c736418c90e32c1fefa3a0293e0bdad248412eadddd82
335b59e615135313a66319e641cdad6ac3489a600e04d4181c859699bed4babe
35f2dd7647ccaaca06fff2c995b8205086fde540d9d9d446f75c40a7efc34d87
3a57826dd4437403ec9dffe3d8a907466926d7123e4a765ec724d79ae24e1d54
3bc87889d5783ac71dcc39d28eb4b0207db7f96b12c2ed61b139c7550a2d3abb
4340e7fc096551699f0188b26cf77e264dda5868ea083f44066ea847772866e2
443bd5b2d289f44cc3b91029bbf7ae2dce66f74ec32358c6a5e432b30b2dfaf2
48bbd884822292041027d2269e8345482bd1afb6f613ff81935024177acaabdb
4bd403f69280495e9c89dc9d9de8355b2327c1f36789829fb40c8f64f97447b0
4d9e83e3e3d08f9a8d567753deae5b2de7e51709a25adba8cb4525db28a22f4a
4e857e52f3825038a21bb1fd8a89a150038f6d6418f994abb2b315380e0bc36f
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
563023f267d554ae8cfe37f2e1178a8966b73cef644391399a6d1a3541092c15
6056652beb1a991c89c3d70989fb23145da49036f35e6cb524ed1f3e239bb757
62bea161ad9776e426a3b9319eb49f4e8908f4f3ce8d18400e44e51a68330719
653e073e97423adda5bc3917a241ee8497dd38a48f14bcde0098a4e54fd0fa5e
662a65a85a54b8491ea015d1b1682d14f62495dbceb997f84cef3e2c1152f034
6639e1fccdac710583a8435193a1aa9761954ca9bf78b7c14c729523bb8dd98f
668d3cf3b7f44fee5eb3433e2cba0643c37bf428ab2b97b2e8ba7207963f03d1
671d6b0d22b5c6d33b1436846e1dbee612ed9f479bd59bbbf30b12a89e5c164b
6c462a751af6aeec10856860e6a0887193f98e3fe500686141d3cb0bdcdc042a
6e0b14ada918e9d7f9af06d12e7ecf2c5dc5690a3ef957a0657323d60f6a8e45
709e892a3304d6fb0ec23f6b92a985db77badcdf2ef17a43d768cd77a57cb389
725279826377bcb9240e875470241d8e5ecd1b29ceff2ec11e93540446065cd8
748f242e0d18f8cb6441c6af5dd0c55ec4753943c6bdd67ee4cb67424d972b4c
7560081f09d7c7cc914628f0d6f9bd2f91a1c33ccd0403e130c441c607d06f33
7cb8fe64a8e975bae17e815549eb6f4d63656e5c5e975a9e4da77321d7e7c7c6
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e355e2e4ca53d98c4228c02e6856f0312fcddb1a464f6f6c46ea8016b45f9f
85f97dc62641c13e65d09726fddc93036598addc9fe2a3f68f98e66d62d718e1
89be7b88d2278768de9590c4041d98ce65df81ad0b659a6399e23afb54533e26
99ee0379d153c3ece9ac56ac3f9f3547db6d1db6f22cff622dc118ea94da057f
a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a58ca0e14e9b06ff94afa9d0d13ea965f64ad7c2c716b0ecc502da670d406cee
a59f0759eff219dce25d028afa33e42dcba2e9cc9295b1480784c130aded54e5
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a6d5cae9278cfcb4b7c9bef2806cbb7bbc62842cd2f241031a213e3f3ac701a5
a7b494753236a3d0468db23fff9a17447c2953a1f2bd70e046e70afe252fd4cd
a8a4495f63f6bf0c33648e12b57d358d29f495ec8db73f6794fc713838e45faa
aa300a570cc50f33f0dbe6fa43169017bb99a2518e002f72b5a445ae07f7edc7
aa582fd2b5c040d31161e9269066c16f3413ee08a356d4ee86f588cf82a0bf9c
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
b29ff1f7a0430d39cc2b59a55da5872a2ec34a36be1da2ed6d3e7a0eaea968f1
b380544bfad0e92f48a20ab007b593061cc9b49e0fd86e8465a8c2b0378cd913
b4000e1372f4cbd8f0511bb73b788458fd5b57cd8e49c73fb29904b9560ee5a4
b67e8d4fedba254ce8ddb8ebd9c0816494c08ff0872bc0028484ceb76f9aa482
bf5230ffb8745d28c11ae8b743868364f9be8379300bd59d235f402a53ea96ee
d253693bd317f848731b27fe6346d0edaccbaae32f30d63c1d89f346998ecff5
d47a5942450438e6bd94b4351f7ec4fedddaaaa1bfaf1a87283b482fdc731b0e
d739f4e9502d3c672029d4580ddff6e52872660508cc4b3f5c2eb2735c66a466
d7987faa6b5a2695914ebd197d709371b723a07945e82f9dbc47fd9948632428
d88ece7e3dfe2e78ad23e830aa611335e06503f53325eedf5e8641c25e9e27ac
db18f576555681b146299bdb961f88c1ef224ea7ad37fa69d17c851816211adc
df322e5f44fa38089812b1fdacb72cf620030743cc997a37b43842b66f769646
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3ff0a9b4b8ab001e88e276ee8eccb5c3ca12ac572d894de2732616cfeb7212b
e6a8f4a13e0431032ee1b06321c014b13d652a681db80c64d8c2d584c4ce4e53
e97014099db9cdff06e2f704f8ed2bf6680ba6e91ef7647a0a1028d655a4f779
ed4962b03c17bb244a7560e381779e8c970af9cac72756fa764a88821f450db9
ee63724ca4074beba4fb0e1df477fbcb813e937302323b5f1e6c9e6ccfad3e3e
eecd9dde12fc559bbc8ab7a64b5ed5b756f1efe030b82a39430bf252172f27ef
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
f7de6a4be826e6cce23fc514bdd9c2a11b1fa5fa3b87c647d19354a9a16990a0
faa33986536695858d96f5396103627258f0af29d9eea5f8d047adafd86ed7c5
fca1aeeb624fdf0e15ef69a6ddc9836aa92038fc2a3febe45ae390966ef07d4d
fd9607fb490da15bcad08a1091da8b5b62069d578624da8711e2e59a1d72de49
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c
fecb5df18e8faa43dc3aa3f49ffd7224c84e378eb7514326a9ca3757a42daf35

voticle.com Open in urlscan Pro 2606:4700:3032::6815:235e Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

129 Requests

100 %HTTPS

82 %IPv6

20 Domains

23 Subdomains

29 IPs

2 Countries

3352 kBTransfer

5907 kBSize

8 Cookies

9 Outgoing links

Redirected requests

129 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

voticle.com Open in urlscan Pro
2606:4700:3032::6815:235e Public Scan

Screenshot
Live screenshot

Full Image

129
Requests

100 %
HTTPS

82 %
IPv6

20
Domains

23
Subdomains

29
IPs

2
Countries

3352 kB
Transfer

5907 kB
Size

8
Cookies

129 HTTP transactions
7 data transactions