to.xrivonet.info Open in urlscan Pro
2606:4700:3037::ac43:c04d Public Scan

URL: http://www.blogger.com/rearrange?blogID=3127189521511558727&widgetType=HTML&widgetId=HTML2&action=editWidget&sectionId=crosscol

URL: https://wrivz1.blogspot.com/2015/01/sx.html
Title: rv

URL: https://wrivz1.blogspot.com/feeds/posts/default
Title: Posts (Atom)

URL: http://www.blogger.com/rearrange?blogID=3127189521511558727&widgetType=HTML&widgetId=HTML1&action=editWidget&sectionId=sidebar-right-1

URL: http://www.blogger.com/rearrange?blogID=3127189521511558727&widgetType=HTML&widgetId=HTML3&action=editWidget&sectionId=footer-1

URL: https://www.blogger.com/
Title: Blogger

URL: http://www.blogger.com/rearrange?blogID=3127189521511558727&widgetType=Attribution&widgetId=Attribution1&action=editWidget&sectionId=footer-3

ec2-3-129-201-32.us-east-2.compute.amazonaws.com

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5

http://adspop.me/js/script.min.js HTTP 301
https://adspop.me/js/script.min.js

Request Chain 35

https://sportzonline.to/channels/hd/hd7.php HTTP 301
https://sportsonline.to/channels/hd/hd7.php

Request Chain 36

http://jsc.mgid.com/x/r/xrivonet.info.266699.js?t=12202816 HTTP 301
https://jsc.mgid.com/x/r/xrivonet.info.266699.js?t=12202816

Request Chain 60

https://pixel.onaudience.com/?partner=137085098&mapped=6D0016433857660ED732E3C018C0B7DB HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=xksw9la&ttd_tpi=1 HTTP 302
https://pixel.onaudience.com/?partner=147&mapped=dbbc26c1-e300-4981-b31d-6ed65ba41a6e&icm HTTP 302
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25 HTTP 302
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25&xl8blockcheck=1 HTTP 302
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=a61cb36d27e8cfc1ac00162a4ddc6f45 HTTP 302
https://pixel.onaudience.com/?partner=109&icm&cver&smartmap=1&redirect=tags.bluekai.com%2Fsite%2F33141%3F%26id%3D%25m HTTP 302
https://tags.bluekai.com/site/33141?&id=ae8251805a33a2d1

Request Chain 85

https://whos.amung.us/cwidget/sportsonline/000000ffffff.png HTTP 307
https://widgets.amung.us/draw/?w=colored&n=1057&c=000000ffffff&p=

Request Chain 90

http://t.sharethis.com/a/t_.htm?ver=1.825.22807&cid=c010&cls=C HTTP 307
https://t.sharethis.com/a/t_.htm?ver=1.825.22807&cid=c010&cls=C

Request Chain 91

https://sb.scorecardresearch.com/b?c1=7&c2=34354936&c3=1&ns__t=1643385767486&ns_c=windows-1252&ns_if=1&cv=3.5&c8=&c7=https%3A%2F%2Fst.chatango.com%2Fh5%2Fgz%2Fr1101210814%2Fid.html&c9=http%3A%2F%2Fto.xrivonet.info%2F HTTP 302
https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1643385767486&ns_c=windows-1252&ns_if=1&cv=3.5&c8=&c7=https%3A%2F%2Fst.chatango.com%2Fh5%2Fgz%2Fr1101210814%2Fid.html&c9=http%3A%2F%2Fto.xrivonet.info%2F

Request Chain 93

https://dp2.33across.com/ps/?tt=iframe&pid=1198&us_privacy=&random=1643385767380.7&r=true HTTP 302
https://tags.bluekai.com/site/27519?id=118928525083550&ret=html&random=1643385767

Request Chain 94

https://map.go.affec.tv/map/3a/?pid=CoIKS2H0E6eKLRmAA%2FBqAg%3D%3D&us_privacy=&ts=1643385767380.1 HTTP 303
https://secure.adnxs.com/getuid?https%3A%2F%2Fmap.go.affec.tv%2Fmap%2Fan%2F%24UID%3Fch%3D61f413a76af6fd0001d8639f%26chc%3Dtt%26floc%3D%26redirect_url%3D HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fmap.go.affec.tv%252Fmap%252Fan%252F%2524UID%253Fch%253D61f413a76af6fd0001d8639f%2526chc%253Dtt%2526floc%253D%2526redirect_url%253D HTTP 302
https://map.go.affec.tv/map/an/8396142445851402393?ch=61f413a76af6fd0001d8639f&chc=tt&floc=&redirect_url=

Request Chain 95

https://pixel.tapad.com/idsync/ex/receive?partner_id=1388&partner_device_id=CoIKS2H0E6eKLRmAA%2FBqAg%3D%3D&us_privacy=&random=1643385767380.2&redirect=https%3A%2F%2Fthinkcxad.azurewebsites.net%2Fapi%2Fpixel%3Fid%3D%24%7BTA_DEVICE_ID%7D%26partner%3DTAPAD HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=1388&partner_device_id=CoIKS2H0E6eKLRmAA%2FBqAg%3D%3D&us_privacy=&random=1643385767380.2&redirect=https%3A%2F%2Fthinkcxad.azurewebsites.net%2Fapi%2Fpixel%3Fid%3D%24%7BTA_DEVICE_ID%7D%26partner%3DTAPAD HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=d5a576c2-c8e3-4a42-9390-f757b648aaf1%252Chttps%253A%252F%252Fusermatch.krxd.net%252Fum%252Fv2%253Fpartner%253Dtapad&gdpr=0&gdpr_consent= HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=dbbc26c1-e300-4981-b31d-6ed65ba41a6e&ttd_puid=d5a576c2-c8e3-4a42-9390-f757b648aaf1%2Chttps%3A%2F%2Fusermatch.krxd.net%2Fum%2Fv2%3Fpartner%3Dtapad HTTP 302
https://usermatch.krxd.net/um/v2?partner=tapad HTTP 302
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=tapad

Request Chain 96

https://ps.eyeota.net/pixel?pid=c9gd671&t=gif&uid=CoIKS2H0E6eKLRmAA%2FBqAg%3D%3D&us_privacy=&33random=1643385767380.3&cat=33across HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=c9gd671&t=gif&uid=CoIKS2H0E6eKLRmAA%2FBqAg%3D%3D&us_privacy=&33random=1643385767380.3&cat=33across HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=Mk9UWllWY2t1VlZsSjBHZTlCNVViLVd4cmduSG5RdU43a0l5NnlrT3I3SVE&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=c9gd671 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=Mk9UWllWY2t1VlZsSjBHZTlCNVViLVd4cmduSG5RdU43a0l5NnlrT3I3SVE&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=c9gd671&google_tc= HTTP 302
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=c9gd671&google_gid=CAESEGIUYL5xFmGkcUdUp23ZjpU&google_cver=1

Request Chain 97

https://spl.zeotap.com/z.png?zdid=239&ctry=CA&env=mWeb&eventType=pageview&zpb=w%21rtnlniviutns&zpbcat=Seasonal&zcluid=CoIKS2H0E6eKLRmAA%2FBqAg%3D%3D&us_privacy=&ziid=1643385767380.4 HTTP 302
https://ib.adnxs.com/getuid?https://mwzeom.zeotap.com/mw?adnxs_uid=$UID&zpartnerid=2&ctry=CA&env=mWeb&eventType=pageview&id_mid_4=963c4b95-2e4c-4ef1-53ea-96cf418fb455&reqId=031b26b2-58ca-45fd-694a-8b6ca7436f02&us_privacy=&zcluid=CoIKS2H0E6eKLRmAA%2FBqAg%3D%3D&zdid=239&ziid=1643385767380.4&zpb=w%21rtnlniviutns&zpbcat=Seasonal HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fadnxs_uid%3D%24UID%26zpartnerid%3D2%26ctry%3DCA%26env%3DmWeb%26eventType%3Dpageview%26id_mid_4%3D963c4b95-2e4c-4ef1-53ea-96cf418fb455%26reqId%3D031b26b2-58ca-45fd-694a-8b6ca7436f02%26us_privacy%3D%26zcluid%3DCoIKS2H0E6eKLRmAA%252FBqAg%253D%253D%26zdid%3D239%26ziid%3D1643385767380.4%26zpb%3Dw%2521rtnlniviutns%26zpbcat%3DSeasonal HTTP 302
https://mwzeom.zeotap.com/mw?adnxs_uid=8396142445851402393&zpartnerid=2&ctry=CA&env=mWeb&eventType=pageview&id_mid_4=963c4b95-2e4c-4ef1-53ea-96cf418fb455&reqId=031b26b2-58ca-45fd-694a-8b6ca7436f02&us_privacy=&zcluid=CoIKS2H0E6eKLRmAA/BqAg==&zdid=239&ziid=1643385767380.4&zpb=w!rtnlniviutns&zpbcat=Seasonal

Request Chain 98

https://dp2.33across.com/ps/?pid=1205&random=1643385767380.5&r=true HTTP 302
https://idsync.rlcdn.com/405716.gif?partner_uid=1868439873968

Request Chain 99

https://dp1.33across.com/ps/?pid=669&uid=CoIKS2H0E6eKLRmAA%2FBqAg%3D%3D&us_privacy=&random=1643385767380.8&r=true HTTP 302
https://secure.adnxs.com/mapuid?t=2&member=1001&user=77824875118210&seg_code=33x&random=1643385767 HTTP 307
https://secure.adnxs.com/bounce?%2Fmapuid%3Ft%3D2%26member%3D1001%26user%3D77824875118210%26seg_code%3D33x%26random%3D1643385767

Request Chain 100

https://ps.eyeota.net/pixel?pid=c9gd671&t=gif&uid=CoIKS2H0E6eKLRmAA%2FBqAg%3D%3D&us_privacy=&33random=1643385767380.9&cat=33across HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=c9gd671&t=gif&uid=CoIKS2H0E6eKLRmAA%2FBqAg%3D%3D&us_privacy=&33random=1643385767380.9&cat=33across HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MjBBR2hvczJmeFAwLXJ2c3ZmUGlVVnVlV1M0RGQ0aFlBc3hFY0JGMlhDN2s&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=c9gd671 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MjBBR2hvczJmeFAwLXJ2c3ZmUGlVVnVlV1M0RGQ0aFlBc3hFY0JGMlhDN2s&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=c9gd671&google_tc= HTTP 302
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=c9gd671&google_gid=CAESEB6ZY74iNZJl-NvGBtnBm5Q&google_cver=1

Request Chain 110

https://match.adsrvr.org/track/cmf/generic?ttd_pid=1h1y1a7&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://sync.sharethis.com/ttd?uid=dbbc26c1-e300-4981-b31d-6ed65ba41a6e&gdpr=0&gdpr_consent=

Request Chain 111

https://loadus.exelator.com/load/?p=847&g=001&j=0&gdpr=0&gdpr_consent= HTTP 302
https://sync.sharethis.com/nlsn?uid=a61cb36d27e8cfc1ac00162a4ddc6f45

Request Chain 112

https://ps.eyeota.net/pixel?pid=1mpb5m0&t=gif&gdpr=0&gdpr_consent= HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=1mpb5m0&t=gif&gdpr=0&gdpr_consent= HTTP 302
https://sync.sharethis.com/eyeota?uid=26NO1UMTD9kH8rso6CDHYvPxGE5wiV777pJlhDOX7TNI&gdpr=0&gdpr_consent=

Request Chain 113

https://ml314.com/utsync.ashx?eid=50131&et=13&cid=lr&fp=ZHIABWH0E6cAAAAIGLpiAw%3D%3D&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fidsync.rlcdn.com%2F395886.gif%3Fpartner_uid%3D%5BPersonID%5D HTTP 302
https://idsync.rlcdn.com/395886.gif?partner_uid=3624742848256540733 HTTP 307
https://ml314.com/csync.ashx?fp=6f0c079df43063ee32e04b69ae8fc2f743eae4bfe1c94d35898f80c98849a7e0f4cb09cee1a4f8eb&person_id=3624742848256540733&eid=50082

Request Chain 114

https://tags.bluekai.com/site/59574?id=ZHIABWH0E6cAAAAIGLpiAw%3D%3D&redir=https%3A%2F%2Fsync.sharethis.com%2Foracle%3Fuid%3D%24_BK_UUID%26BK_SWAP_DEST%3D5957 HTTP 302
https://sync.sharethis.com/oracle?uid=$_BK_UUID&BK_SWAP_DEST=5957

Request Chain 120

https://ap.lijit.com/readerinfo/v2 HTTP 307
https://ap.lijit.com/readerinfo/v2?sovrn_retry=true

Request Chain 121

https://ap.lijit.com/readerinfo/v2 HTTP 307
https://ap.lijit.com/readerinfo/v2?sovrn_retry=true

Request Chain 122

https://ap.lijit.com/readerinfo/v2 HTTP 307
https://ap.lijit.com/readerinfo/v2?sovrn_retry=true

Request Chain 130

https://whos.amung.us/cwidget/y7opzyrraw/000000ffffff.png HTTP 307
https://widgets.amung.us/draw/?w=colored&n=3710&c=000000ffffff&p=

Request Chain 131

https://um.simpli.fi/lj_match?r=53600 HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=5EEB6C5CE7194E90B17CA488D4E3BA96

Request Chain 132

https://i.liadm.com/s/57333?bidder_id=204553&bidder_uuid=a0f6d2235356c54a5a74190b HTTP 303
https://i.liadm.com/s/57333?bidder_id=204553&bidder_uuid=a0f6d2235356c54a5a74190b&_li_chk=true&previous_uuid=bd7dbf9b649643d590977c27bf11e43a HTTP 303
https://x.bidswitch.net/sync?dsp_id=42&user_id= HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=42&user_id=

Request Chain 133

https://i.liadm.com/s/59074?bidder_id=204553&bidder_uuid=a0f6d2235356c54a5a74190b HTTP 303
https://i.liadm.com/s/59074?bidder_id=204553&bidder_uuid=a0f6d2235356c54a5a74190b&_li_chk=true&previous_uuid=906d9691d81d42549e0e96d90e6a8793 HTTP 303
https://i6.liadm.com/s/59074?bidder_id=204553&bidder_uuid=a0f6d2235356c54a5a74190b

Request Chain 134

https://p.adsymptotic.com/d/px/?_pid=15697&_psign=0a885fb568701ac53478d88866a10345&_pu&_puuid=a0f6d2235356c54a5a74190b&_redirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D5014%263pid%3D${UUID}&_rand=62546 HTTP 302
https://p.adsymptotic.com/d/px/?_pid=15697&_psign=0a885fb568701ac53478d88866a10345&_pu&_puuid=a0f6d2235356c54a5a74190b&_redirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D5014%263pid%3D${UUID}&_rand=62546&_expected_cookie=4f08a20a7462d74dfb47202c600d3a00 HTTP 302
https://ce.lijit.com/merge?pid=5014&3pid=4f08a20a7462d74dfb47202c600d3a00

Request Chain 143

https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai HTTP 302
https://tags.bluekai.com/site/5386?id=dbbc26c1-e300-4981-b31d-6ed65ba41a6e&gdpr=0&gdpr_consent= HTTP 302
https://sync-tm.everesttech.net/upi/pid/2j4ke5f0?redir=https%3A%2F%2Ftags.bluekai.com%2Fsite%2F4413%3Fid%3D%24%7BUSER_ID%7D&r=123 HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/2j4ke5f0?redir=https%3A%2F%2Ftags.bluekai.com%2Fsite%2F4413%3Fid%3D%24%7BUSER_ID%7D&r=123&_test=YfQTqAAB_be8rgBB HTTP 302
https://tags.bluekai.com/site/4413?id=YfQTqAAB_be8rgBB&r=123&_test=YfQTqAAB_be8rgBB

Request Chain 144

https://cm.g.doubleclick.net/pixel?google_nid=bluekai&google_cm&google_sc&google_hm=QitheUIyb1E5OTlZc3dIQw%3D%3D HTTP 302
https://tags.bluekai.com/site/2981?id=&google_gid=CAESEOeTT_u2Sq5B0LF3ASh-tWk&google_cver=1

Request Chain 145

https://cms.analytics.yahoo.com/cms?partner_id=BLKAI HTTP 302
https://tags.bluekai.com/site/19505?id=y-GrU7UJ9E2pL9Mim9gtS6xQSiE3OnxbVoufc-~A

Request Chain 146

https://sync.mathtag.com/sync/img?mt_exid=10002&redir=https%3A%2F%2Fstags.bluekai.com%2Fsite%2F4448%3Fid%3D%5BMM_UUID%5D HTTP 302
https://stags.bluekai.com/site/4448?id=c24861f4-13a8-4300-8d9b-7c1b6b2fe07a

Request Chain 147

https://s.amazon-adsystem.com/dcm?pid=825dc896-34e2-49b2-8823-60c90dd536b1&id=KNPyB84A99Ow7wHC&cb=1436305485 HTTP 302
https://s.amazon-adsystem.com/dcm?pid=825dc896-34e2-49b2-8823-60c90dd536b1&id=KNPyB84A99Ow7wHC&cb=1436305485&dcc=t

Request Chain 152

https://match.adsrvr.org/track/cmf/generic?ttd_pid=lotame&ttd_tpi=1&gdpr=0 HTTP 302
https://sync.crwdcntrl.net/map/c=10620/tp=TRAD/tpid=dbbc26c1-e300-4981-b31d-6ed65ba41a6e/gdpr=0/gdpr_consent=

Request Chain 154

https://pixel.tapad.com/idsync/ex/receive?partner_id=LOTAME&partner_device_id=bfdd2a8c33d4e2b6c8fe6a6b0cc2b448&gdpr=0&partner_url=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D10158%2Ftp%3DTPAD%2Ftpid%3D%24%7BTA_DEVICE_ID%7D HTTP 302
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3Dd5a576c2-c8e3-4a42-9390-f757b648aaf1%252Chttps%253A%252F%252Fsync.crwdcntrl.net%252Fmap%252Fc%253D10158%252Ftp%253DTPAD%252Ftpid%253Dd5a576c2-c8e3-4a42-9390-f757b648aaf1 HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=8396142445851402393&pt=d5a576c2-c8e3-4a42-9390-f757b648aaf1%2Chttps%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D10158%2Ftp%3DTPAD%2Ftpid%3Dd5a576c2-c8e3-4a42-9390-f757b648aaf1 HTTP 302
https://sync.crwdcntrl.net/map/c=10158/tp=TPAD/tpid=d5a576c2-c8e3-4a42-9390-f757b648aaf1

Request Chain 156

https://ads.avocet.io/getuid?url=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D10492%2Ftp%3DAVCT%2Ftpid%3D%7B%7BUUID%7D%7D HTTP 301
https://ads.avct.cloud/getuid?r=1&url=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D10492%2Ftp%3DAVCT%2Ftpid%3D%7B%7BUUID%7D%7D HTTP 307
https://ads.avct.cloud/getuid?bounce=true&r=1&url=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D10492%2Ftp%3DAVCT%2Ftpid%3D%7B%7BUUID%7D%7D HTTP 302
https://sync.crwdcntrl.net/map/c=10492/tp=AVCT/tpid=338589ec-b295-4667-b0e8-7977cf5692e5

Request Chain 157

https://px.surveywall-api.survata.com/t HTTP 302
https://bcp.crwdcntrl.net/map/c=10098/tp=SRVT/tpid=8c0f1a40-f93c-9735-55c6-e1f843346936

Request Chain 158

https://dpm.demdex.net/ibs:dpid=121998&dpuuid=bfdd2a8c33d4e2b6c8fe6a6b0cc2b448&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D9828%2Ftp%3DADBE%2Ftpid%3D%24%7BDD_UUID%7D HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=121998&dpuuid=bfdd2a8c33d4e2b6c8fe6a6b0cc2b448&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D9828%2Ftp%3DADBE%2Ftpid%3D%24%7BDD_UUID%7D HTTP 302
https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/tpid=67056841134482556493381626961617211010

Request Chain 162

https://aorta.clickagy.com/pixel.gif?ch=120&cm=bfdd2a8c33d4e2b6c8fe6a6b0cc2b448 HTTP 302
https://pixel-sync.sitescout.com/connectors/clickagy/usersync?redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D HTTP 302
https://pixel-sync.sitescout.com/connectors/clickagy/usersync?cookieQ=1&redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D HTTP 302
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=5&cm=559e5d8d-ece1-4a16-95c5-d2f8d4788911-61f413a9-4341 HTTP 302
https://idsync.rlcdn.com/420246.gif?partner_uid=c:5a4b023959421b5a5a2e9b1c479f109d HTTP 307
https://aorta.clickagy.com/pixel.gif?ch=114&cm=3a4b4a11a8b46df19066aec65c61479ff93f2f702474e218cfeca1eec580794825abae5358c0e7bc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=clickagy&google_sc&google_cm&google_hm=Yzo1YTRiMDIzOTU5NDIxYjVhNWEyZTliMWM0NzlmMTA5ZA HTTP 302
https://aorta.clickagy.com/pixel.gif?ch=8&cm=CAESEOi9ZaAnKX0lvLKw7KhalXg&google_cver=1 HTTP 302
https://stags.bluekai.com/site/51557?id=c:5a4b023959421b5a5a2e9b1c479f109d&redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D122%26cm%3D$_BK_UUID&BKUUID=$_BK_UUID&limit=1 HTTP 302
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=122&cm=2CByBh3i99eYtFHC HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9212289188&_puid=c:5a4b023959421b5a5a2e9b1c479f109d&_redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D128%26cm%3D HTTP 302
https://d.agkn.com/pixel/10751/?che=1643385769455&ip=2607:5300:60:7867::13&l1=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D128%26cm%3D163850504045007532772 HTTP 302
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=128&cm=163850504045007532772 HTTP 302
https://pixel-sync.sitescout.com/connectors/clickagy/usersync?redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D HTTP 302
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=5&cm=f805299c-3fb5-4600-88f5-70bf34823016-61f413a9-4341 HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9212289188&_puid=c:5a4b023959421b5a5a2e9b1c479f109d&_redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D128%26cm%3D HTTP 302
https://d.agkn.com/pixel/10751/?che=1643385769805&ip=2607:5300:60:7867::13&l1=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D128%26cm%3D163850504045007532772 HTTP 302
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=128&cm=163850504045007532772 HTTP 302
https://dpm.demdex.net/ibs:dpid=79908&dpuuid=c:5a4b023959421b5a5a2e9b1c479f109d&redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D124%26cm%3D%24%7BDD_UUID%7D HTTP 302
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=124&cm=67056841134482556493381626961617211010 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=clickagy&google_sc&google_cm&google_hm=Yzo1YTRiMDIzOTU5NDIxYjVhNWEyZTliMWM0NzlmMTA5ZA

Request Chain 163

https://global.ib-ibi.com/image.sbxx?go=262106&pid=420&xid=bfdd2a8c33d4e2b6c8fe6a6b0cc2b448 HTTP 302
https://ib.mookie1.com/image.sbxx?go=262106&pid=420&xid=bfdd2a8c33d4e2b6c8fe6a6b0cc2b448

Request Chain 164

https://aa.agkn.com/adscores/g.pixel?sid=9202276048 HTTP 302
https://bcp.crwdcntrl.net/5/c=368/tp=NEUS/tpid=163850504045007532772

Request Chain 165

https://sync.srv.stackadapt.com/sync?nid=lotame HTTP 302
https://bcp.crwdcntrl.net/map/c=6569/tp=STKA/tpid=0-a568bb8b-d52a-4e3c-544d-c9dbf28be2e1$ip$149.56.153.183

Request Chain 166

https://sync.tidaltv.com/GenericUserSync.ashx?dpid=1695 HTTP 302
https://sync.tidaltv.com/genericusersync.ashx?dpid=1695&s_h=1 HTTP 302
https://bcp.crwdcntrl.net/map/c=6584/tp=VIDO/tpid=c580ebb6-f936-494c-8e0a-7b2c801df006

Request Chain 167

https://cm.adgrx.com/bridge?AG_SETCOOKIE&AG_PID=lotame&AG_REDIR=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D363%2Ftp%3DADGR%2Ftpid%3D__AG_UID__ HTTP 302
https://cm.adgrx.com/bridge.gif?AG_PID=lotame&AG_REDIR=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D363%2Ftp%3DADGR%2Ftpid%3D__AG_UID__ HTTP 302
https://sync.crwdcntrl.net/map/c=363/tp=ADGR/tpid=bd76cea4-8053-11ec-8743-3609c7f2b18d

Request Chain 168

https://sync.mathtag.com/sync/img?sync=auto&mt_exid=10040&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D4735%26tp%3DMDMA%26tpid%3D%5BMM_UUID%5D HTTP 302
https://sync.crwdcntrl.net/qmap?c=4735&tp=MDMA&tpid=c24861f4-13a8-4300-8d9b-7c1b6b2fe07a

Request Chain 169

https://pixel-sync.sitescout.com/connectors/lotame/usersync?redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D1389%2Ftp%3DSTSC%2Ftpid%3D%24UUID HTTP 302
https://pixel-sync.sitescout.com/connectors/lotame/usersync?cookieQ=1&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D1389%2Ftp%3DSTSC%2Ftpid%3D%24UUID HTTP 302
https://sync.crwdcntrl.net/map/c=1389/tp=STSC/tpid=f805299c-3fb5-4600-88f5-70bf34823016-61f413a9-4341

Request Chain 170

https://sync-tm.everesttech.net/upi/pid/bsTd8NdE?redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D1811%2Ftp%3DTBMG%2Ftpid%3D%24%7BTM_USER_ID%7D HTTP 302
https://sync.crwdcntrl.net/map/c=1811/tp=TBMG/tpid=YfQTqAAB_be8rgBB

Request Chain 173

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMzQ4ODM4MC90LzI/dpuid/bfdd2a8c33d4e2b6c8fe6a6b0cc2b448/url/https://sync.crwdcntrl.net/map/c=10915/tp=TRNN/tpid=$!%7BTURN_UUID%7D HTTP 302
https://sync.crwdcntrl.net/map/c=10915/tp=TRNN/tpid=2346857161986540181

Request Chain 174

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc=281%2Frand=572717888%2Ftpid%3D%24UID%2Ftp%3DANXS HTTP 302
https://sync.crwdcntrl.net/map/c=281/rand=572717888/tpid=8396142445851402393/tp=ANXS

177 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request am7.html Show response
to.xrivonet.info/ 57 KB
16 KB 251ms
213ms Document
text/html 2606:4700:3037::ac43:c04d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 2606:4700:3037::ac43:c04d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6e8efebf255db2a99f730abde864679395a3956dedc1b482cc4c70b3defc604b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Date: Fri, 28 Jan 2022 16:02:46 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Sun, 28 Nov 2021 18:17:02 GMT
vary: Accept-Encoding,User-Agent
x-turbo-charged-by: LiteSpeed
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QVzlBbtiuwOGIOdDSno%2B5x5jWvgWn3GsJlmR76WV8t6jmWI1xH43ahcBaRN1gQWM4F7SoEz%2Bljo%2BacYD5G1%2Bp%2BOILcYgfTBz9R0rrrRRVRrZTVe2bHpLJOc9wJdW7H7I2qjLnC8FDra7zt%2FLJ2Uc"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 6d4b726cf98b7138-YUL
Content-Encoding: gzip
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 403
Forbidden 05f4c9fbb0d0e23d527016355f12b6c7.js
pl15563626.passtechusa.com/05/f4/c9/ 0
0 152ms
34ms Script
application/javascript 192.243.59.13
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://pl15563626.passtechusa.com/05/f4/c9/05f4c9fbb0d0e23d527016355f12b6c7.js
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 192.243.59.13 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.17.6 /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 28 Jan 2022 16:02:46 GMT
Server: nginx/1.17.6
Connection: keep-alive
Content-Type: application/javascript
Content-Length: 0
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
36 KB 105ms
50ms Script
application/javascript 2607:f8b0:4006:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-153096092-1

Requested by

Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1995dd1e634d223d327b33ed4a7ea25702290ebf9920b98287f07c696223e4e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:46 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36112
x-xss-protection: 0
last-modified: Fri, 28 Jan 2022 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 28 Jan 2022 16:02:46 GMT

GET
H2 200 16153472-css_bundle_v2.css
www.blogger.com/static/v1/widgets/ 42 KB
9 KB 107ms
20ms Stylesheet
text/css 2607:f8b0:4006:808::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/widgets/16153472-css_bundle_v2.css

Requested by

Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:808::2009 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

df6b27e051729b0993ec014da7b81ec8643265763d7239e50a9fdc404eb5b963

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 24 Jan 2022 19:53:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 331779
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8912
x-xss-protection: 0
last-modified: Thu, 02 Jul 2015 01:50:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
expires: Tue, 24 Jan 2023 19:53:07 GMT

GET
H2 200 authorization.css
www.blogger.com/dyn-css/ 1 B
684 B 190ms
102ms Stylesheet
text/css 2607:f8b0:4006:808::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/dyn-css/authorization.css?targetBlogID=3127189521511558727&zx=d740d3e9-2abb-42bf-b18d-41c9a8d4501c

Requested by

Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:808::2009 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' .google.com .google-analytics.com 'unsafe-inline' 'unsafe-eval' .gstatic.com .googlesyndication.com .blogger.com .googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 28 Jan 2022 16:02:46 GMT
server: GSE
date: Fri, 28 Jan 2022 16:02:46 GMT
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-type: text/css; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21
x-xss-protection: 1; mode=block
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK / Show response
d2fbkzyicji7c4.cloudfront.net/ 330 KB
110 KB 125ms
96ms Script
text/plain 13.225.205.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://d2fbkzyicji7c4.cloudfront.net/?zkbfd=622073
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 13.225.205.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-205-121.ewr50.r.cloudfront.net
Software: /
Resource Hash: 646f51bd7595ff1f203cdf3d03d85589f9e7f2d7c4a4b99b051e768adfa54c75

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 28 Jan 2022 16:02:46 GMT
content-encoding: gzip
X-Amz-Cf-Pop: EWR50-C1
X-Cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
Connection: keep-alive
Content-Length: 112039
Via: 1.1 3ea7dd920772e2ffb2371e107e093dfc.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 9jinrGSSBuyANvQlkNDHRHLe2OxYfwWURWKjGXPzDAyqe0FD9WYrGQ==

GET
H2

200

script.min.js Show response
adspop.me/js/
Redirect Chain

http://adspop.me/js/script.min.js
https://adspop.me/js/script.min.js

2 KB
2 KB

176ms
129ms

Script
application/javascript

2606:4700:3033::6815:2064
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://adspop.me/js/script.min.js
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: H2
Server: 2606:4700:3033::6815:2064 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c49d62b395feabb32b570c9dc81f05508be331db38478dd8a2dd83e9866543ae

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 18 May 2019 08:29:51 GMT
server: cloudflare
etag: W/"9e7-589254d87d5ed-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V6p3fX2fc0PcJvcY2dHCT28knlXYPj2ea%2F7IEEgYn53Luvo4mkMJp%2BPu78295J3hVVGyVqyLwY5RUuDqLK5Txm3LDspPKImJxUo894bANerrU0Ag%2F0lh57v3GPWndId%2FLDM3FuDCo9w%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6d4b726f6fa37144-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

Date: Fri, 28 Jan 2022 16:02:46 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WZxmj144gmqfN3OGX4RlosTqZF%2FJGem9gGKFbYi%2BgJtDQRQsXTB67drX2raKsa1%2BVJU5FIFC6TIHHYrKFn%2FareZdBKRABNomEHS0bv%2BZcCERhclJB85ZhbC9PgmVSzeB5HU%2BDr5J%2BkA%3D"}],"group":"cf-nel","max_age":604800}
Location: https://adspop.me/js/script.min.js
Cache-Control: max-age=3600
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 6d4b726eed227138-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Expires: Fri, 28 Jan 2022 17:02:46 GMT

GET
H/1.1 403
Forbidden 61b9671524e2ca246e7898cf092e4832.js
pl164625.pvclouds.com/61/b9/67/ 0
0 105ms
34ms Script
application/javascript 192.243.59.13
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://pl164625.pvclouds.com/61/b9/67/61b9671524e2ca246e7898cf092e4832.js
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 192.243.59.13 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.17.6 /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 28 Jan 2022 16:02:46 GMT
Server: nginx/1.17.6
Connection: keep-alive
Content-Type: application/javascript
Content-Length: 0
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

GET
H/1.1 200
OK 6507 Show response
ligninenchant.com/rsEl6Kc2wxE8/ 0
1 KB 247ms
103ms Script
application/javascript 23.109.248.166
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL

http://ligninenchant.com/rsEl6Kc2wxE8/6507

Requested by

Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html

Protocol

HTTP/1.1

Server

23.109.248.166 , Netherlands, ASN7979 (SERVERS-COM, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:46 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=1
Server: nginx
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: http://to.xrivonet.info
Access-Control-Max-Age: 600
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
X-Content-Type-Options: nosniff
Keep-Alive: timeout=20

GET
H/1.1 200
OK icon18_wrench_allbkg.png
img1.blogblog.com/img/ 475 B
1 KB 57ms
19ms Image
image/png 2607:f8b0:4006:808::2009
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://img1.blogblog.com/img/icon18_wrench_allbkg.png

Requested by

Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html

Protocol

HTTP/1.1

Server

2607:f8b0:4006:808::2009 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d172d750493be64a7ed84dec1dd2a0d787ba42f78bc694b0858f152c52b6620b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Thu, 27 Jan 2022 17:40:45 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 27 Jan 2022 14:51:31 GMT
Server: sffe
Age: 80521
Report-To: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
Content-Type: image/png
Cache-Control: public, max-age=604800
Cross-Origin-Resource-Policy: cross-origin
Accept-Ranges: bytes
Content-Length: 475
X-XSS-Protection: 0
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="blogger-tech"
Expires: Thu, 03 Feb 2022 17:40:45 GMT

GET
H2 200 display.php Show response
www.adnetworkperformance.com/a/ 6 KB
3 KB 116ms
49ms Script
application/javascript 130.211.17.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.adnetworkperformance.com/a/display.php?r=404241
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.17.196 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 196.17.211.130.bc.googleusercontent.com
Software: openresty /
Resource Hash: 41d880ee8a20df4c9c41f793e9f9bcac2194f2766cd9a9fc0a0b7e801b05d429

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 28 Jan 2022 16:02:46 GMT
content-encoding: gzip
server: openresty
alt-svc: clear
via: 1.1 google
content-type: application/javascript; charset=utf-8

GET
H/1.1 200
OK emb.js Show response
st.chatango.com/js/gz/ 68 KB
24 KB 246ms
77ms Script
application/x-javascript 208.93.230.26
CHATANGO

General

Check archive.org

Show headers Download Go to

Full URL: http://st.chatango.com/js/gz/emb.js
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 208.93.230.26 , United States, ASN29893 (CHATANGO, US),
Reverse DNS
Software: nginx /
Resource Hash: b7d4497fd5bd7b3f566d86cbea6008402a4886a30fd42b0a005b23dc1be57179

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:46 GMT
Content-Encoding: gzip
Last-Modified: Mon, 01 Nov 2021 15:18:25 GMT
Server: nginx
Content-Type: application/x-javascript
Cache-Control: max-age=0
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 23775
Expires: Fri, 28 Jan 2022 16:02:46 GMT

GET
H2 200 3190386002-widgets.js Show response
www.blogger.com/static/v1/widgets/ 91 KB
37 KB 32ms
28ms Script
text/javascript 2607:f8b0:4006:808::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/widgets/3190386002-widgets.js

Requested by

Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:808::2009 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fa1ec33b80e0c92accdd28f35ca370bf013d740d4ec702ec01f3d503419cddd5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 24 Jan 2022 21:57:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 324313
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37848
x-xss-protection: 0
last-modified: Thu, 02 Jul 2015 01:50:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
expires: Tue, 24 Jan 2023 21:57:33 GMT

GET
H2 200 plusone.js Show response
apis.google.com/js/ 52 KB
21 KB 147ms
81ms Script
application/javascript 2607:f8b0:4006:823::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/plusone.js

Requested by

Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

237aa21168a7e458f506010606ab48d11c54b08221ae6297b2964ee41c71c8ad

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-SuP1gZIqie0b6sMKW732CQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
cross-origin-opener-policy: same-origin
etag: "5607e44eccf70f61d1f62a4b18e3ff88"
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-SuP1gZIqie0b6sMKW732CQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
expires: Fri, 28 Jan 2022 16:02:46 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 82ms
19ms Script
text/javascript 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-153096092-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 6055
date: Fri, 28 Jan 2022 14:21:51 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Fri, 28 Jan 2022 16:21:51 GMT

GET
H/1.1 403
Forbidden invoke.js
www.bcloudhost.com/976b0d76d773f5547d37fe90ada4248d/ 0
0 104ms
37ms Script
application/javascript 192.243.59.20
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.bcloudhost.com/976b0d76d773f5547d37fe90ada4248d/invoke.js
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 192.243.59.20 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.17.9 /
Resource Hash

Request headers

Referer: http://to.xrivonet.info/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 28 Jan 2022 16:02:46 GMT
Server: nginx/1.17.9
Connection: keep-alive
Content-Type: application/javascript
Content-Length: 0
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 58ms
31ms XHR
text/plain 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=686524238&t=pageview&_s=1&dl=http%3A%2F%2Fto.xrivonet.info%2Fam7.html&ul=en-us&de=UTF-8&dt=RivoRD&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=2080392901&gjid=315146124&cid=855447333.1643385767&tid=UA-153096092-1&_gid=1023658712.1643385767&_r=1&gtm=2ou1q0&z=141922489

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://to.xrivonet.info/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:46 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: http://to.xrivonet.info
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
freychang.fun/ 14 B
714 B 104ms
41ms Fetch
text/plain 2606:4700:3030::ac43:dadd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://freychang.fun/
Requested by: Host: d2fbkzyicji7c4.cloudfront.net
URL: http://d2fbkzyicji7c4.cloudfront.net/?zkbfd=622073
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:dadd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3faeb6b8159cab360ed1da14b65021067495b34afe93bd363d7b152f587699f

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:46 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: http://to.xrivonet.info
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TOGb%2BO3YDNY%2BKL%2Fc62q%2Bg5dwh2QfXgZ4Uph6AWiLaeXgrC4F0sVFFUrq%2Bb05Xdhv%2FMzIgGMW479x6Re1co%2Bia%2BtSnRkpOAG3sf%2FjKzAlCqDeN6%2BJhUpxMpzqfYQOBTW9cTYiE9HtXo%2Fhk1Z0"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 6d4b72713f597154-YUL
access-control-allow-headers: X-Requested-With, content-type
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 204 utx Show response
withexdcel.biz/ 0
490 B 116ms
28ms XHR
text/plain 99.84.191.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://withexdcel.biz/utx?cb=G3Fn3dhYqD5A&top=to.xrivonet.info&tid=622073
Requested by: Host: d2fbkzyicji7c4.cloudfront.net
URL: http://d2fbkzyicji7c4.cloudfront.net/?zkbfd=622073
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.191.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-191-8.iad89.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:46 GMT
via: 1.1 8ad5a9cbb864898c238f716c1a12623c.cloudfront.net (CloudFront)
server: openresty/1.17.8.2
x-amz-cf-pop: IAD89-C2
x-cache: Miss from cloudfront
p3p: CP="NID DSP ALL COR"
access-control-allow-origin: http://to.xrivonet.info
cache-control: no-store, no-cache, must-revalidate, no-transform
access-control-allow-credentials: true
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
x-amz-cf-id: kNKNu27wUEdKsH15VQBCFbjxAi0RLShnjh0ST1F3Da18pSzAXOmh2Q==

GET
H/1.1 200
OK FA52NBwYfmZEHxd2dy8BM3J2MwwXdhlFABwQAjQwOgMOLwEdH3AnLhAeGjExOAQREj44BxU0ER4MejQjFB4aMTEdAQUOMjsEBTU6ESIyNBgyAxkYdBwUEgEQIw0GJz0PPxZPDzE2ITw3aQENAT0xJDsGGhsOJwcbHyoZOTAhHAskPT4BOzAdGCx3DgEhFxsvHjESB... Show response
withexdcel.biz/WUZDdlk4JCAbZjh7IVAsKyp+U2sfY3EwPWsgIR0jIC8gHDBuJXdYOjUpNhI/KyktAnc3IzdTax8EDhoTAAgLMAsJEhklDTIfdCYYNQ4CMRs2B3M/DBYFNxQRaQw1Jh8bACUxDCkQNCQdEwd2AwgyEwAQMhgKFRtgNgMrRw0JAns8D2glezkuNQ... Frame 1915 3 KB
2 KB 66ms
41ms Document
text/html 99.84.191.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://withexdcel.biz/WUZDdlk4JCAbZjh7IVAsKyp+U2sfY3EwPWsgIR0jIC8gHDBuJXdYOjUpNhI/KyktAnc3IzdTax8EDhoTAAgLMAsJEhklDTIfdCYYNQ4CMRs2B3M/DBYFNxQRaQw1Jh8bACUxDCkQNCQdEwd2AwgyEwAQMhgKFRtgNgMrRw0JAns8D2glezkuNQcFMhRhECgBHj0FOzMRNSo1OB82AhQyLjESAh4/FA52NBwYfmZEHxd2dy8BM3J2MwwXdhlFABwQAjQwOgMOLwEdH3AnLhAeGjExOAQREj44BxU0ER4MejQjFB4aMTEdAQUOMjsEBTU6ESIyNBgyAxkYdBwUEgEQIw0GJz0PPxZPDzE2ITw3aQENAT0xJDsGGhsOJwcbHyoZOTAhHAskPT4BOzAdGCx3DgEhFxsvHjESBTAcbAg7RwwYAQpBARgIJyYjaRQSRQsrJDsGGxEBGQMdDAsgLA4yFBIBEDEJFT8ICAI3TxszJQsvDmEnEhELaQoSHX8zNSwYKWQiJ0IXbjcgAygvEBlFLgk
Requested by: Host: d2fbkzyicji7c4.cloudfront.net
URL: http://d2fbkzyicji7c4.cloudfront.net/?zkbfd=622073
Protocol: HTTP/1.1
Server: 99.84.191.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-191-8.iad89.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: fce914548fd723d6d7168436ed28da079ccb159c16b3576347679b30c8315c7c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/

Response headers

Content-Type: text/html
Content-Length: 1238
Connection: keep-alive
Date: Fri, 28 Jan 2022 16:02:46 GMT
Server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
Pragma: no-cache
P3P: CP="NID DSP ALL COR"
content-encoding: gzip
Accept-CH: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
X-Cache: Miss from cloudfront
Via: 1.1 4f9e9e3e8a2a5cea2848aac8473267f2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: IAD89-C2
X-Amz-Cf-Id: 1NlypdpXMHUVa3EM--wOUvfp4YToTqG0AivKJGva8Els4gfQrpp67A==

GET
H/1.1 200
OK I0sLPhpWHQIsGgwuPiZ6FToPOCMmECE6GVc3BzEZVTs+HS9RPSIFMTwhXS8KHSAgPiBcLio0GgktIlgRDzI8Ggc2MQwWLjZIJi8gBxIxNChTOFYaACkxKhEtVSgFJRoUCCceBhw6DQ0fLDFdPi01HjUlI1QeMicRHiE1Hgk2MQwTEjUBIhd6VREgRQEeITxMByETJ... Show response
ericantpas.com/eWR1S2QYBhYmWxhZF20RCwhIblY/QUcNAEsCFyAeAA0WIQ1OB0FlBxULAC8CCwsbP0oXAQFuVj8HITEMAzIYcxcvHEU8MT0QJw1WDT4RPBw1PSN+FCwDNH4lLVwzGzYBMzcDNj4hHCglPSYBICwrFAwNVzgGOx0cNj4eIA4uNkUzMRQIEQMwLz... Frame 1BD0 3 KB
2 KB 68ms
27ms Document
text/html 18.67.76.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://ericantpas.com/eWR1S2QYBhYmWxhZF20RCwhIblY/QUcNAEsCFyAeAA0WIQ1OB0FlBxULAC8CCwsbP0oXAQFuVj8HITEMAzIYcxcvHEU8MT0QJw1WDT4RPBw1PSN+FCwDNH4lLVwzGzYBMzcDNj4hHCglPSYBICwrFAwNVzgGOx0cNj4eIA4uNkUzMRQIEQMwLzcTI1AqKRJ6HT0iICEgFy4jAycOIzx6NSoHRHsuPTJEJjcXVDwcHTwjPB0TGi0nMxU6Dzh/I0sLPhpWHQIsGgwuPiZ6FToPOCMmECE6GVc3BzEZVTs+HS9RPSIFMTwhXS8KHSAgPiBcLio0GgktIlgRDzI8Ggc2MQwWLjZIJi8gBxIxNChTOFYaACkxKhEtVSgFJRoUCCceBhw6DQ0fLDFdPi01HjUlI1QeMicRHiE1Hgk2MQwTEjUBIhd6VREgRQEeITxMByETJTobMj8zLwgITydFGVAhLB4uJhQXUyEXFgoFdiozXT4HUT0sOn8MSxYgAQA
Requested by: Host: d2fbkzyicji7c4.cloudfront.net
URL: http://d2fbkzyicji7c4.cloudfront.net/?zkbfd=622073
Protocol: HTTP/1.1
Server: 18.67.76.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-76-95.iad89.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: afcb621948a44864288c16a1283f967299f02b54c554fef5d97efc44c8d1bd0e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/

Response headers

Content-Type: text/html
Content-Length: 1223
Connection: keep-alive
Date: Fri, 28 Jan 2022 16:02:46 GMT
Server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
Pragma: no-cache
P3P: CP="NID DSP ALL COR"
content-encoding: gzip
Accept-CH: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
X-Cache: Miss from cloudfront
Via: 1.1 ec18462cf9d88c8bdb0cd5e50dbe442a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: IAD89-P2
X-Amz-Cf-Id: gpeksOj6a7ayycSg_qozf_HsE5jrL8Divt51eamoWqHWTFwwQHPDEg==

GET
H/1.1 200
OK EwpeEyQ Show response
ericantpas.com/SnczbXcrFVAASCtKUUsCOBsOSEUMUgErE3gRUQYNMx5QBx59FAdDFCYYRgkROBhdGVkkEkdIRQwaVjsfOBVrDhYEAGYhJAtHSylGCDZnKjEpIAM3EQcfVC4wGxtfIA0lRX48R29FcScNAw12O0MAI1gCTwgiQCk2MA9kNSEPIXw8IgEkX1VOCC... Frame 27F9 3 KB
2 KB 58ms
34ms Document
text/html 18.67.76.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://ericantpas.com/SnczbXcrFVAASCtKUUsCOBsOSEUMUgErE3gRUQYNMx5QBx59FAdDFCYYRgkROBhdGVkkEkdIRQwaVjsfOBVrDhYEAGYhJAtHSylGCDZnKjEpIAM3EQcfVC4wGxtfIA0lRX48R29FcScNAw12O0MAI1gCTwgiQCk2MA9kNSEPIXw8IgEkX1VOCCYGJiQCQ3guJRwyUShHEzFYPEYINVAIMR4meD4yH1IBKxUfIVc4HD4YYhUYLzFJGjINEGEOFiYEdyxGMgZkXA8CIQEFOBIdZQ4WJgRSJR8uAmtdHw84AFwtEiYKPRUPPXo/IiFCdBVHKD9wVTgOD0Q8Ow9aBgs6Hw9BNTIEMmdeRhAvZVUkBzULLDB7D0ImMiIxYDkmCTVbJxQrG0AmMiIYSS8yGCRgXxADNWI4IAQmBiQlHk5bNTIEP2VfDy4hdjsvKEZDJCUfHEEuEDkgcBcxBS9JKzorRkspJQ9OFl81AhtySx05GF0dShIgciUiHz12Jz5/EwpeEyQ
Requested by: Host: d2fbkzyicji7c4.cloudfront.net
URL: http://d2fbkzyicji7c4.cloudfront.net/?zkbfd=622073
Protocol: HTTP/1.1
Server: 18.67.76.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-76-95.iad89.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: 0f16bae91530a8397c29122b1cebd1781d4902b450b7e1cf94524882e9fd9085

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/

Response headers

Content-Type: text/html
Content-Length: 1220
Connection: keep-alive
Date: Fri, 28 Jan 2022 16:02:46 GMT
Server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
Pragma: no-cache
P3P: CP="NID DSP ALL COR"
content-encoding: gzip
Accept-CH: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
X-Cache: Miss from cloudfront
Via: 1.1 9c6666844f92bfc6b8685747b641abc6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: IAD89-P2
X-Amz-Cf-Id: ZyUZ3m4z_BKRUAaaPJAtOnE8cT4DRoL_bbVHI-SVrC1TzCPusy7_LQ==

GET
H2 200 / Show response
freychang.fun/ 16 B
352 B 42ms
41ms Fetch
text/plain 2606:4700:3030::ac43:dadd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://freychang.fun/
Requested by: Host: d2fbkzyicji7c4.cloudfront.net
URL: http://d2fbkzyicji7c4.cloudfront.net/?zkbfd=622073
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:dadd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6efd2afee0f98d9c25fa68d0a2fdb98999fe328104c69b1101c2210e6c311d78

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:46 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: http://to.xrivonet.info
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qiuJL%2BTyNxOjVscKOB5IIewLQ%2BNF04u9u4sDQT4%2FnK030BK33jgHisVw0Ody%2FKnsei8ig2grV6Gje%2BzGypBQT%2BQSNv4ksB9qqKCWEzS0lqhNzhtMnTiZ3%2FiPEs02qyUAc7qjdjvqbSbQiQR6"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 6d4b72714f707154-YUL
access-control-allow-headers: X-Requested-With, content-type
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 204 utx Show response
ericantpas.com/ 0
490 B 82ms
32ms XHR
text/plain 18.67.76.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ericantpas.com/utx?cb=wuZBwNCej6DC&top=to.xrivonet.info&tid=712339
Requested by: Host: d2fbkzyicji7c4.cloudfront.net
URL: http://d2fbkzyicji7c4.cloudfront.net/?zkbfd=622073
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.76.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-76-95.iad89.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:46 GMT
via: 1.1 2b0c54ffe9876882253b010d44184bdc.cloudfront.net (CloudFront)
server: openresty/1.17.8.2
x-amz-cf-pop: IAD89-P2
x-cache: Miss from cloudfront
p3p: CP="NID DSP ALL COR"
access-control-allow-origin: http://to.xrivonet.info
cache-control: no-store, no-cache, must-revalidate, no-transform
access-control-allow-credentials: true
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
x-amz-cf-id: HQrqip2APqJN17CnhZVa6nhKcCaZkaJ35W_dsglcLSq8AvEDV6LFIA==

GET
H/1.1 200
OK LBA5LHRSGkpKdDloVhFnUTQGLWoIFyU7Yy4IOjoXURoqSGAJDjw5ByAyPTlUDhkoNnM6Nj9IWlMOXA9IIAsiM3s3DiohSy1pNUgLCwtcEF80HyE0V1EeKiEDNn1dPn8yOxg+SzVpOgBWMj5dHGI6NCEJeDUvSRJBDDYfRUELEygyBik+Pw Show response
ericantpas.com/WG94MmM5DRtfXDlSGhQWKgNFF1EeSkp0B2oJGlkZIQYbWApvDEwcADQADVYFKgAWRk02CgwXUR4JLHQhMDovZxUIGEABNDIITXA0IDweZSkLNhRKEhcHMRdRGiwCShcdBRNHICAfLnUUFQwcWjYqLiB0BAoVSHcqMgsbVhQZBjUDGz8+AQJTGV... Frame 8E53 3 KB
2 KB 49ms
26ms Document
text/html 18.67.76.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://ericantpas.com/WG94MmM5DRtfXDlSGhQWKgNFF1EeSkp0B2oJGlkZIQYbWApvDEwcADQADVYFKgAWRk02CgwXUR4JLHQhMDovZxUIGEABNDIITXA0IDweZSkLNhRKEhcHMRdRGiwCShcdBRNHICAfLnUUFQwcWjYqLiB0BAoVSHcqMgsbVhQZBjUDGz8+AQJTGV0AYAIxPipiBG0XKHNbMisBexMfPB97LzY2LX8lPwcoShBsLCtzGwooNVgGAFoqViU8Vx1wOmwsAVVGaik+WykZCRVzMxI6OhdRGjY+cAsLXAADNjAhOVQOGTg3cxduNT1gChJdFFs2CwMsVys0KiEDNiwmOh8mYS48QVIZFRd/LBA5LHRSGkpKdDloVhFnUTQGLWoIFyU7Yy4IOjoXURoqSGAJDjw5ByAyPTlUDhkoNnM6Nj9IWlMOXA9IIAsiM3s3DiohSy1pNUgLCwtcEF80HyE0V1EeKiEDNn1dPn8yOxg+SzVpOgBWMj5dHGI6NCEJeDUvSRJBDDYfRUELEygyBik+Pw
Requested by: Host: d2fbkzyicji7c4.cloudfront.net
URL: http://d2fbkzyicji7c4.cloudfront.net/?zkbfd=622073
Protocol: HTTP/1.1
Server: 18.67.76.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-76-95.iad89.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: a03a95627e432999f0e1b9915052866b417e0fdf7536dd66d0dee8c7b2cc67af

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/

Response headers

Content-Type: text/html
Content-Length: 1225
Connection: keep-alive
Date: Fri, 28 Jan 2022 16:02:46 GMT
Server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
Pragma: no-cache
P3P: CP="NID DSP ALL COR"
content-encoding: gzip
Accept-CH: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
X-Cache: Miss from cloudfront
Via: 1.1 e0a78b49206aba2a7e76eb45b9688a8e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: IAD89-P2
X-Amz-Cf-Id: YmUIvNNSGr4jNFQ8-oDhEBYOjOSStlWMX8sdMMi7x_-6fESrM9avIA==

GET
H2 204 cHVsUGVfSg8jWBFHJSkyHhEIBwIyBT4GDSg2ASQtJyMPFgc1TUokDBRIWmJXQEJfdhUZEVFhQwMBDSQQA0hddgweEwNtQwZIXX5WRFteZEtCUxltVFYBHDECTURKIBEEGVFhU0RGX2hQR0NaZVdI
esmentbrads.com/ 0
263 B 105ms
45ms Image
text/plain 2606:4700:3030::ac43:aab8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://esmentbrads.com/cHVsUGVfSg8jWBFHJSkyHhEIBwIyBT4GDSg2ASQtJyMPFgc1TUokDBRIWmJXQEJfdhUZEVFhQwMBDSQQA0hddgweEwNtQwZIXX5WRFteZEtCUxltVFYBHDECTURKIBEEGVFhU0RGX2hQR0NaZVdI
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:aab8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dnDtvC8VzQ2KUpgsvZGtuYap%2BJQRShr1ST%2B0uCWFWnhCwolmaZId2SHp9jFBSCu6P74OJi6%2B6hZPDcIrJnvnMvqX17qNmM6rWmBwJvA8IQsLMutjJdh%2FyU002wS%2BkkIirDRHMSJ7ZrpAw75PhL0%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 6d4b7271cdc3713e-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 login.php
www.facebook.com/ 0
0 148ms
110ms Image
text/html 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Ffavicon.ico%3F_rdr%3Dp
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H2 200 ServiceLogin
accounts.google.com/ 0
0 133ms
86ms Image
text/html 2607:f8b0:4006:816::200d
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:816::200d , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H2 200 ServiceLogin
accounts.google.com/ 0
0 167ms
120ms Image
text/html 2607:f8b0:4006:816::200d
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:816::200d , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H2 204 RHR1YVRrSxYSaSAeL1IGAQQ9Iz8KDRAKAQEmGzdjFiUnIDB3B1MVPSBJQlBmd0dMRyQtEEhTbWIHAQAgMQdIUHItGhMOaWICSFB6dFpAVHp2UgBcZWIABQAzeUVTESAwGEhQYnBHRllhc0JDVG19
esmentbrads.com/ 0
497 B 103ms
45ms Image
text/plain 2606:4700:3030::ac43:aab8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://esmentbrads.com/RHR1YVRrSxYSaSAeL1IGAQQ9Iz8KDRAKAQEmGzdjFiUnIDB3B1MVPSBJQlBmd0dMRyQtEEhTbWIHAQAgMQdIUHItGhMOaWICSFB6dFpAVHp2UgBcZWIABQAzeUVTESAwGEhQYnBHRllhc0JDVG19
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:aab8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=94Jb0YVWGWXvr1P9Gywe0YvYCOkkYTnD3jQ8iLcZ0bX1QszgGnX%2FtXOg7nUU3BXqVCmYJkJ1AzloXwjs8EKNVD41GuoirwjUh7dyBv8kirsYKi880%2BLhQ%2BVU6GHY5k5uGCipMqaJUn3dinJ%2F%2B4o%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 6d4b7271cdc7713e-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 403
Forbidden 61b9671524e2ca246e7898cf092e4832.js
pl164625.pvclouds.com/61/b9/67/ 0
0 63ms
62ms Script
application/javascript 192.243.59.13
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://pl164625.pvclouds.com/61/b9/67/61b9671524e2ca246e7898cf092e4832.js
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 192.243.59.13 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.17.6 /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 28 Jan 2022 16:02:46 GMT
Server: nginx/1.17.6
Connection: keep-alive
Content-Type: application/javascript
Content-Length: 0
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

GET
H/1.1 200
OK N04YXj45EUN0Z3YEVABicEMYXDY3QwIXYGhaBRdgaAVBHGJ9BzMXYGhDGFxkbBFCcHdqBAkEZn-ERQwIzKEQdVyU9VhpbJn0GNwdhbxpCBHdqBFlZOixZHRdgGxFDAj4xXxQXYGhTFFE5Nx1UAGI7XANdPz0RQ3RrbxpBHGZuDUMcZWkRQwIhOVIQQDt9BjcHYW8a... Show response
d2fbkzyicji7c4.cloudfront.net/BMlJYNHFRPTZSTkY7PAlHAGBoA0IUOCtbH0JvPFBFfGUpVwRDJA5uQkUCfkALVm9oEh1TPD8JV1c8OwlAFDM8VkwGdCxEHllvNFoDWDwhTAhfMH5BEA8/ Frame 1915 651 B
870 B 88ms
85ms Script
text/plain 13.225.205.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://d2fbkzyicji7c4.cloudfront.net/BMlJYNHFRPTZSTkY7PAlHAGBoA0IUOCtbH0JvPFBFfGUpVwRDJA5uQkUCfkALVm9oEh1TPD8JV1c8OwlAFDM8VkwGdCxEHllvNFoDWDwhTAhfMH5BEA8/N04YXj45EUN0Z3YEVABicEMYXDY3QwIXYGhaBRdgaAVBHGJ9BzMXYGhDGFxkbBFCcHdqBAkEZn-ERQwIzKEQdVyU9VhpbJn0GNwdhbxpCBHdqBFlZOixZHRdgGxFDAj4xXxQXYGhTFFE5Nx1UAGI7XANdPz0RQ3RrbxpBHGZuDUMcZWkRQwIhOVIQQDt9BjcHYW8aQgR0LQk
Requested by: Host: withexdcel.biz
URL: http://withexdcel.biz/WUZDdlk4JCAbZjh7IVAsKyp+U2sfY3EwPWsgIR0jIC8gHDBuJXdYOjUpNhI/KyktAnc3IzdTax8EDhoTAAgLMAsJEhklDTIfdCYYNQ4CMRs2B3M/DBYFNxQRaQw1Jh8bACUxDCkQNCQdEwd2AwgyEwAQMhgKFRtgNgMrRw0JAns8D2glezkuNQcFMhRhECgBHj0FOzMRNSo1OB82AhQyLjESAh4/FA52NBwYfmZEHxd2dy8BM3J2MwwXdhlFABwQAjQwOgMOLwEdH3AnLhAeGjExOAQREj44BxU0ER4MejQjFB4aMTEdAQUOMjsEBTU6ESIyNBgyAxkYdBwUEgEQIw0GJz0PPxZPDzE2ITw3aQENAT0xJDsGGhsOJwcbHyoZOTAhHAskPT4BOzAdGCx3DgEhFxsvHjESBTAcbAg7RwwYAQpBARgIJyYjaRQSRQsrJDsGGxEBGQMdDAsgLA4yFBIBEDEJFT8ICAI3TxszJQsvDmEnEhELaQoSHX8zNSwYKWQiJ0IXbjcgAygvEBlFLgk
Protocol: HTTP/1.1
Server: 13.225.205.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-205-121.ewr50.r.cloudfront.net
Software: /
Resource Hash: e94fa06b19b85f8cff0699e4c3337cde64a8437170c9e17d5f1f3c4291a7cfa4

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://withexdcel.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:46 GMT
content-encoding: gzip
X-Amz-Cf-Pop: EWR50-C1
X-Cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: max-age=31556926
Connection: keep-alive
Content-Length: 483
Via: 1.1 3ea7dd920772e2ffb2371e107e093dfc.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 8zVmh83YFukbZhc_OH_DqrZ9Ta5lCSXDdN0s7vHgwtdIaKe9AExaHw==

GET
H/1.1 200
OK cTzhzVm8sVx0wUDtRF2tZdwxLYV5pUgA5AT8FPRxWBHRGEicADBtkHRpyF3AbNVxOZkkjWR0xUmldHTVSfh4SMg1yDFUjDnJVHCwGI1QSc10JDV1mSn0IWyEGIVwcIRxqCkM4G2oKQ2dfYQhWZS1qCkMhBiEOR3NcDR1BZhd5DFpzXX9ZAyYDKk8WNAQmTF-ZkKXo... Show response
d2fbkzyicji7c4.cloudfront.net/ Frame 1BD0 256 B
603 B 165ms
147ms Script
text/plain 13.225.205.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://d2fbkzyicji7c4.cloudfront.net/cTzhzVm8sVx0wUDtRF2tZdwxLYV5pUgA5AT8FPRxWBHRGEicADBtkHRpyF3AbNVxOZkkjWR0xUmldHTVSfh4SMg1yDFUjDnJVHCwGI1QSc10JDV1mSn0IWyEGIVwcIRxqCkM4G2oKQ2dfYQhWZS1qCkMhBiEOR3NcDR1BZhd5DFpzXX9ZAyYDKk8WNAQmTF-ZkKXoLRHhceR1BZkckUAc7A2oKMHNdf1QaPQpqCkMxCixTHH9KfQgQPh0gVRZzXQkBRHhfYQxFb11hD0JzXX9LEjAOPVFWZCl6C0R4XHkeBms
Requested by: Host: ericantpas.com
URL: http://ericantpas.com/eWR1S2QYBhYmWxhZF20RCwhIblY/QUcNAEsCFyAeAA0WIQ1OB0FlBxULAC8CCwsbP0oXAQFuVj8HITEMAzIYcxcvHEU8MT0QJw1WDT4RPBw1PSN+FCwDNH4lLVwzGzYBMzcDNj4hHCglPSYBICwrFAwNVzgGOx0cNj4eIA4uNkUzMRQIEQMwLzcTI1AqKRJ6HT0iICEgFy4jAycOIzx6NSoHRHsuPTJEJjcXVDwcHTwjPB0TGi0nMxU6Dzh/I0sLPhpWHQIsGgwuPiZ6FToPOCMmECE6GVc3BzEZVTs+HS9RPSIFMTwhXS8KHSAgPiBcLio0GgktIlgRDzI8Ggc2MQwWLjZIJi8gBxIxNChTOFYaACkxKhEtVSgFJRoUCCceBhw6DQ0fLDFdPi01HjUlI1QeMicRHiE1Hgk2MQwTEjUBIhd6VREgRQEeITxMByETJTobMj8zLwgITydFGVAhLB4uJhQXUyEXFgoFdiozXT4HUT0sOn8MSxYgAQA
Protocol: HTTP/1.1
Server: 13.225.205.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-205-121.ewr50.r.cloudfront.net
Software: /
Resource Hash: e75f31b3723100a9528bec2656d871fe2d1229155137cc8fd6e327752b1bd0f2

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://ericantpas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:46 GMT
content-encoding: gzip
X-Amz-Cf-Pop: EWR50-C1
X-Cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: max-age=31556926
Connection: keep-alive
Content-Length: 216
Via: 1.1 110142bfecf028552c3361846a29130a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: SpY7buLMKVg38ME0x-sD1pMbmPO-YoqzsWBhKJyjTPiHAzfo3G0DMQ==

GET
H/1.1 200
OK bUVdUktoQxoeFzwEGgRcalsDA1xqW1xHV2hOXjVcalsaHhduX0hEO31ZXQ9PbEJIRUk5Gx0bHC8ODxwQLE-5fMUxrXENET31ZXV8SMB8AG1xqKEhFSTQCBhJcalsKEhozBERSS2gIBQUWNQ5IRT9hXENHV2xdVEVXb1pIRUkrCgsWCzFOXzFMa1xDRE9+HlA Show response
d2fbkzyicji7c4.cloudfront.net/meVhrbXcaNwULSA0xD1BATGFcW0ZfMhgCGQllMzo2MQ0+JzIzEV4JTko8BUsDAzxWXVEVOQUKSl89BQ5KSH4KCRVEbE0YFkQ1BBceFTQKSEU/ Frame 27F9 188 B
571 B 102ms
84ms Script
text/plain 13.225.205.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://d2fbkzyicji7c4.cloudfront.net/meVhrbXcaNwULSA0xD1BATGFcW0ZfMhgCGQllMzo2MQ0+JzIzEV4JTko8BUsDAzxWXVEVOQUKSl89BQ5KSH4KCRVEbE0YFkQ1BBceFTQKSEU/bUVdUktoQxoeFzwEGgRcalsDA1xqW1xHV2hOXjVcalsaHhduX0hEO31ZXQ9PbEJIRUk5Gx0bHC8ODxwQLE-5fMUxrXENET31ZXV8SMB8AG1xqKEhFSTQCBhJcalsKEhozBERSS2gIBQUWNQ5IRT9hXENHV2xdVEVXb1pIRUkrCgsWCzFOXzFMa1xDRE9+HlA
Requested by: Host: ericantpas.com
URL: http://ericantpas.com/SnczbXcrFVAASCtKUUsCOBsOSEUMUgErE3gRUQYNMx5QBx59FAdDFCYYRgkROBhdGVkkEkdIRQwaVjsfOBVrDhYEAGYhJAtHSylGCDZnKjEpIAM3EQcfVC4wGxtfIA0lRX48R29FcScNAw12O0MAI1gCTwgiQCk2MA9kNSEPIXw8IgEkX1VOCCYGJiQCQ3guJRwyUShHEzFYPEYINVAIMR4meD4yH1IBKxUfIVc4HD4YYhUYLzFJGjINEGEOFiYEdyxGMgZkXA8CIQEFOBIdZQ4WJgRSJR8uAmtdHw84AFwtEiYKPRUPPXo/IiFCdBVHKD9wVTgOD0Q8Ow9aBgs6Hw9BNTIEMmdeRhAvZVUkBzULLDB7D0ImMiIxYDkmCTVbJxQrG0AmMiIYSS8yGCRgXxADNWI4IAQmBiQlHk5bNTIEP2VfDy4hdjsvKEZDJCUfHEEuEDkgcBcxBS9JKzorRkspJQ9OFl81AhtySx05GF0dShIgciUiHz12Jz5/EwpeEyQ
Protocol: HTTP/1.1
Server: 13.225.205.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-205-121.ewr50.r.cloudfront.net
Software: /
Resource Hash: 0e84610a6c02e59909e1a3abf85aa5013af2a49984fedfc5327cbd1a4ed52628

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://ericantpas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:46 GMT
content-encoding: gzip
X-Amz-Cf-Pop: EWR50-C1
X-Cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: max-age=31556926
Connection: keep-alive
Content-Length: 184
Via: 1.1 00fd85d5c5d5bd788f272591be9ecbca.cloudfront.net (CloudFront)
X-Amz-Cf-Id: kEc0zbP-P-W5gf7VwBYaKFLxq7RtW2jbVvFSPaYE9pXMEX5xGMMRAA==

GET
H/1.1 200
OK MQcwFyV1UxdQf2dPYlNqJVw Show response
d2fbkzyicji7c4.cloudfront.net/fTFBhUWUvPw83Wjg5BWxSfWJSYlxqOhI+CzxtEjkuCxpVGwMcdhUrAXFgRz0EIjdcdwAiM1xgQy00A2xRaiQRPg5xPA8jDyIpGSgILnYUMFghPxs4CSAxRGMjeX5RdFd8eBY4Cyg/FiJAfmAPJUB+YFBhS3x1UhNAfmAWOA... Frame 8E53 445 B
738 B 184ms
166ms Script
text/plain 13.225.205.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://d2fbkzyicji7c4.cloudfront.net/fTFBhUWUvPw83Wjg5BWxSfWJSYlxqOhI+CzxtEjkuCxpVGwMcdhUrAXFgRz0EIjdcdwAiM1xgQy00A2xRaiQRPg5xPA8jDyIpGSgILnYUMFghPxs4CSAxRGMjeX5RdFd8eBY4Cyg/FiJAfmAPJUB+YFBhS3x1UhNAfmAWOAt6ZERiJ2liUSlTeHlEY1UtIB-E9ADs1AzoMOHVTF1B/Z09iU2liUXkOJCQMPUB+E0RjVSA5CjRAfmAGNAYnP0h0V3wzCSMKITVEYyN1Z09hS3hmWGNLe2FEY1U/MQcwFyV1UxdQf2dPYlNqJVw
Requested by: Host: ericantpas.com
URL: http://ericantpas.com/WG94MmM5DRtfXDlSGhQWKgNFF1EeSkp0B2oJGlkZIQYbWApvDEwcADQADVYFKgAWRk02CgwXUR4JLHQhMDovZxUIGEABNDIITXA0IDweZSkLNhRKEhcHMRdRGiwCShcdBRNHICAfLnUUFQwcWjYqLiB0BAoVSHcqMgsbVhQZBjUDGz8+AQJTGV0AYAIxPipiBG0XKHNbMisBexMfPB97LzY2LX8lPwcoShBsLCtzGwooNVgGAFoqViU8Vx1wOmwsAVVGaik+WykZCRVzMxI6OhdRGjY+cAsLXAADNjAhOVQOGTg3cxduNT1gChJdFFs2CwMsVys0KiEDNiwmOh8mYS48QVIZFRd/LBA5LHRSGkpKdDloVhFnUTQGLWoIFyU7Yy4IOjoXURoqSGAJDjw5ByAyPTlUDhkoNnM6Nj9IWlMOXA9IIAsiM3s3DiohSy1pNUgLCwtcEF80HyE0V1EeKiEDNn1dPn8yOxg+SzVpOgBWMj5dHGI6NCEJeDUvSRJBDDYfRUELEygyBik+Pw
Protocol: HTTP/1.1
Server: 13.225.205.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-205-121.ewr50.r.cloudfront.net
Software: /
Resource Hash: 19444fa85de1804afd8e2cc53d74727e6835f738c39021bdc1d8e3eb2cc4d48e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://ericantpas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:46 GMT
content-encoding: gzip
X-Amz-Cf-Pop: EWR50-C1
X-Cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: max-age=31556926
Connection: keep-alive
Content-Length: 351
Via: 1.1 ebeca2ec07c54274f6b9125c7b82aecc.cloudfront.net (CloudFront)
X-Amz-Cf-Id: mdWd_5h94xJF7Bi3JLu-QQHNDJQU5qu5diwpBVyjUyIwPKptkljqVg==

GET
H/1.1 200
OK compatibility.js Show response
celeritascdn.com/script/ 20 KB
8 KB 69ms
34ms Script
application/javascript 2606:4700::6810:5c06
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://celeritascdn.com/script/compatibility.js
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 2606:4700::6810:5c06 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 03241a470052a86e3d0bc4c77894ae3f87a1452092fff62ff01d499ead7decac

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:46 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Age: 1727
X-GUploader-UploadID: ABg5-Uz9uY-bRiaF5jd0Q0Z2PRUa-ygGuWH2sM3NSaRKB9yfiSj_1mN7nuf_zWgMEOj0mT3fCV-ZsAFPpvC5iLw_bULz5QDc5w
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
Connection: keep-alive
Content-Type: application/javascript
Last-Modified: Tue, 15 Sep 2020 12:10:32 GMT
Server: cloudflare
ETag: W/"c2bbc1e2544049cb035c321919bef2bc"
Vary: Accept-Encoding
x-goog-hash: crc32c=6TBdZQ==, md5=wrvB4lRAScsDXDIZGb7yvA==
x-goog-generation: 1600171832181211
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=14400
Transfer-Encoding: chunked
x-goog-stored-content-length: 20647
CF-RAY: 6d4b72721c0e713f-YUL
Expires: Fri, 28 Jan 2022 20:02:46 GMT

GET
H2

200

hd7.php Show response
sportsonline.to/channels/hd/ Frame 1579
Redirect Chain

https://sportzonline.to/channels/hd/hd7.php
https://sportsonline.to/channels/hd/hd7.php

2 KB
2 KB

526ms
464ms

Document
text/html

2606:4700:3032::ac43:d85e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sportsonline.to/channels/hd/hd7.php
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::ac43:d85e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.4.16
Resource Hash: 1143a2349a3ff113aeb106f6581ec365a5f0c2fa94e2864f313839a6307d119c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
content-type: text/html
x-powered-by: PHP/5.4.16
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p7Fb5zqpNDRqUZhRwa%2BFiHEo31hypc4u5Qo0dcJ7Z%2FR5u4Wluo3A%2BsAZ8K%2BnYRjMBlalaupqo9mfeNiLSfx0MBh%2FvRJNIgCmMWCQ5FUhwAniye0JFic33c9BPFF63XJg9dEY8GbONvXKRl25YmE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6d4b72732e7a714b-YUL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

date: Fri, 28 Jan 2022 16:02:46 GMT
location: https://sportsonline.to/channels/hd/hd7.php
cache-control: max-age=3600
expires: Fri, 28 Jan 2022 17:02:46 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hOS6n9kTcge0hh2d6lcJBJXVEwC9rILy%2BxhKqgKO2o%2BL6P9CUMLLI9XAEGXuRjSH2yLeyXQhaINLBiz%2Bq0beY94NKuzcGtoe9GnlkUZSoqbfjhNIA8Sk3vb3MgImCmoCb3skGkIGmdVHmq%2Ffy6c%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 6d4b72729c9a7156-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2

200

xrivonet.info.266699.js Show response
jsc.mgid.com/x/r/ Frame 4200
Redirect Chain

http://jsc.mgid.com/x/r/xrivonet.info.266699.js?t=12202816
https://jsc.mgid.com/x/r/xrivonet.info.266699.js?t=12202816

0
659 B

162ms
118ms

Script
text/javascript

104.19.133.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jsc.mgid.com/x/r/xrivonet.info.266699.js?t=12202816
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: H2
Server: 104.19.133.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:46 GMT
cf-cache-status: HIT
x-amz-request-id: M24ZNPXT1PHS4EJR
cf-polished: origSize=32
last-modified: Mon, 10 Jan 2022 16:10:38 GMT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
x-amz-id-2: 8TNZgJV1foAhyx3KEMreULtf593vSObhHxy5Q9kVmjPeq9mTLAVZqxGg44gjIUC1swYU//JO9wI=
cf-bgj: minify
server: cloudflare
etag: "1dccc79d71362b3fd242526629979a52"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=10800
accept-ranges: bytes
cf-ray: 6d4b7272aaf33ff1-YYZ
expires: Fri, 28 Jan 2022 19:02:46 GMT

Redirect headers

Date: Fri, 28 Jan 2022 16:02:46 GMT
Server: cloudflare
Vary: Accept-Encoding
Location: https://jsc.mgid.com/x/r/xrivonet.info.266699.js?t=12202816
Cache-Control: max-age=3600
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 6d4b72722c6d54a9-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Expires: Fri, 28 Jan 2022 17:02:46 GMT

GET
H2 204 display.php
www.adnetworkperformance.com/ad/ Frame 4128 0
0 51ms
50ms Document
text/plain 130.211.17.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.adnetworkperformance.com/ad/display.php?stamat=m%257C%252Co9jLiIjdrB1dAN0dEdHP3xP.ad6%252CZMkKdRAQlkuDbgTABrav5LUY0VwSYh50_GYiSgngKQ6xmoABTG4qAk6yzpjT7WWkIUbuxAqZE9lIsa04sd8jgdYdQjRmV302QJZ-lp9RDHs%252C&cbur=0.8557506267573642&cbtitle=RivoRD&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=&cbkeywords=&cbref=
Requested by: Host: www.adnetworkperformance.com
URL: https://www.adnetworkperformance.com/a/display.php?r=404241
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.17.196 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 196.17.211.130.bc.googleusercontent.com
Software: openresty /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/

Response headers

server: openresty
date: Fri, 28 Jan 2022 16:02:46 GMT
access-control-allow-origin: *
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK pop.js Show response
c1.popads.net/ 30 KB
10 KB 116ms
45ms Script
application/javascript 2a02:6ea0:c400::12
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: http://c1.popads.net/pop.js
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 2a02:6ea0:c400::12 , United States, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 2c1d923947d609eee480c2ab3d67e58e7ed8c9d329aaa6fda21b30cb14e44dbe

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

X-77-POP: newyorkUSNY
Date: Fri, 28 Jan 2022 16:02:46 GMT
Content-Encoding: gzip
X-77-NZT-Ray: 9QnnJTYYbFs=
Transfer-Encoding: chunked
X-77-Cache: HIT
X-Cache: HIT
Connection: keep-alive
alt-svc: quic="89.187.177.15:443"; ma=2592000; v="44,43,39"
X-77-NZT: AVm7sQ/B857/ufAKAA==
X-Accel-Expires: @1643705581
Last-Modified: Thu, 03 Jun 2021 12:12:03 GMT
Server: CDN77-Turbo
ETag: W/"60b8c713-78c7"
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
X-Age: 716985

GET
H/1.1 403
Forbidden invoke.js
www.bcloudhost.com/07dde3e2c5af0db032c8826e3b79914d/ 0
0 34ms
34ms Script
application/javascript 192.243.59.20
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.bcloudhost.com/07dde3e2c5af0db032c8826e3b79914d/invoke.js
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 192.243.59.20 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.17.9 /
Resource Hash

Request headers

Referer: http://to.xrivonet.info/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 28 Jan 2022 16:02:46 GMT
Server: nginx/1.17.9
Connection: keep-alive
Content-Type: application/javascript
Content-Length: 0
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

GET
H/1.1 200
OK id.html Show response
st.chatango.com/h5/gz/r1101210814/ Frame 7474 681 KB
219 KB 551ms
155ms Document
text/html 208.93.230.26
CHATANGO

General

Check archive.org

Show headers Download Go to

Full URL: https://st.chatango.com/h5/gz/r1101210814/id.html
Requested by: Host: st.chatango.com
URL: http://st.chatango.com/js/gz/emb.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.93.230.26 , United States, ASN29893 (CHATANGO, US),
Reverse DNS
Software: nginx /
Resource Hash: 0cd48ecf566c428483038b6c85df7cccfee861ad42a9104148c8c0624a74818e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/

Response headers

Server: nginx
Date: Fri, 28 Jan 2022 16:02:47 GMT
Content-Type: text/html
Content-Length: 224126
Last-Modified: Mon, 01 Nov 2021 15:18:25 GMT
Connection: keep-alive
Expires: Sat, 28 Jan 2023 16:02:47 GMT
Cache-Control: max-age=31536000
Content-Encoding: gzip
P3P: CP="Chatango does not have a P3P policy. Please see our privacy policy: http://chatango.com/page?full_privacy"
Accept-Ranges: bytes

GET
H/1.1 200
OK r.json Show response
st.chatango.com/cfg/nc/ 20 B
338 B 479ms
83ms XHR
application/octet-stream 208.93.230.26
CHATANGO

General

Check archive.org

Show headers Download Go to

Full URL: https://st.chatango.com/cfg/nc/r.json?d467120020000088758738261
Requested by: Host: st.chatango.com
URL: http://st.chatango.com/js/gz/emb.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.93.230.26 , United States, ASN29893 (CHATANGO, US),
Reverse DNS
Software: nginx /
Resource Hash: 7a696ca70e9e29c641cd50f8b3a39f08c0fdd73bb032ccec20341f5c0af71df9

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Last-Modified: Mon, 01 Nov 2021 15:18:25 GMT
Server: nginx
Content-Type: application/octet-stream
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 20

GET
H/1.1 200
OK colored.js Show response
widgets.amung.us/ 8 KB
3 KB 62ms
29ms Script
application/x-javascript 2606:4700:10::6816:4aab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://widgets.amung.us/colored.js
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 2606:4700:10::6816:4aab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b957ea339d35a0f04ef914c475611606e5b3b326cf08cb9d68bf78bca23a6521

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:46 GMT
content-encoding: gzip
CF-Cache-Status: HIT
last-modified: Mon, 03 May 2021 17:48:47 GMT
Server: cloudflare
Age: 885
etag: W/"6090377f-1ee4"
Vary: Accept-Encoding
Content-Type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=86400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 6d4b72725f7c715a-YUL
expires: Sat, 29 Jan 2022 15:48:01 GMT

GET
H3 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.J6wwVzZFlys.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCNJLWaj6_C-48nmIacOG08UNqZiFA/ 150 KB
51 KB 52ms
21ms Script
text/javascript 2607:f8b0:4006:823::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.J6wwVzZFlys.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCNJLWaj6_C-48nmIacOG08UNqZiFA/cb=gapi.loaded_0?le=oz

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

451a4ca6125cd8d5ee49f2c741d26f3a6093e88a60ead72648c18a3672cda807

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 16:25:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 171424
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52416
x-xss-protection: 0
last-modified: Tue, 11 Jan 2022 03:49:34 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding, Origin
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Thu, 26 Jan 2023 16:25:42 GMT

GET
H/1.1 200
OK identify.html Show response
ufpcdn.com/script/ Frame 80DF 2 KB
2 KB 125ms
92ms Document
text/html 2606:4700:3037::ac43:8e31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://ufpcdn.com/script/identify.html?frmt=0
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 2606:4700:3037::ac43:8e31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ffb16355784a4a89472be6cb28c3408234ec0518326a3a1908797b8d8c78a76a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/

Response headers

Date: Fri, 28 Jan 2022 16:02:46 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Tue, 15 May 2018 06:39:25 GMT
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OELjrNoAdV%2BbHbjZm7nYi47Kx0bDK5grcryPWwel6jWDnbguweZRiVphYExNocyiEEqmHs6lrWO10FSUNLFBV8daeDNKGWAiIQDzUhSTEdoy4461N%2Fy9PDKCgyQc74Lfa%2BxQXUWn0pH8"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 6d4b72729aececf2-YUL
Content-Encoding: gzip
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK / Show response
t.dtscout.com/i/ 9 KB
10 KB 79ms
20ms Script
application/javascript 167.114.209.61
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://t.dtscout.com/i/?l=http%3A%2F%2Fto.xrivonet.info%2Fam7.html&j=
Requested by: Host: widgets.amung.us
URL: http://widgets.amung.us/colored.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 167.114.209.61 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ns515688.ip-167-114-209.net
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 7e860912a367d69416c9c9e19f06687c49593b77d2c0fc50d1348e74241b4eb3

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:46 GMT
X-T: 0.572
Server: nginx/1.10.3 (Ubuntu)
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: no-cache
Connection: close
X-S: mtl1
Expires: Fri, 28 Jan 2022 16:02:45 GMT

GET
H/1.1 200
OK / Show response
whos.amung.us/pingjs/ 30 B
214 B 83ms
36ms Script
text/javascript 67.202.114.214
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: http://whos.amung.us/pingjs/?k=rtnlniviutns&t=RivoRD&c=u&x=http%3A%2F%2Fto.xrivonet.info%2Fam7.html&y=&a=0&d=0.88&v=27&r=6683
Requested by: Host: widgets.amung.us
URL: http://widgets.amung.us/colored.js
Protocol: HTTP/1.1
Server: 67.202.114.214 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: amung.us
Software: /
Resource Hash: 73c6e123274d573fa35a46ebc48723ed4a534a70ad23fe103514f382e786db07

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:46 GMT
content-encoding: gzip
transfer-encoding: chunked
content-type: text/javascript;charset=UTF-8

GET
H/1.1 200
OK / Show response
t.dtscout.com/idg/ Frame 0F9D 1 KB
751 B 40ms
12ms Document
text/html 167.114.209.61
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://t.dtscout.com/idg/?su=6D0016433857660ED732E3C018C0B7DB
Requested by: Host: t.dtscout.com
URL: https://t.dtscout.com/i/?l=http%3A%2F%2Fto.xrivonet.info%2Fam7.html&j=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 167.114.209.61 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ns515688.ip-167-114-209.net
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: c1c49f9bb5910c8d7203b09affd53e01ffe05b02ea0e9817e2b6ef90c1f591fa

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/

Response headers

Server: nginx/1.10.3 (Ubuntu)
Date: Fri, 28 Jan 2022 16:02:46 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Expires: Fri, 28 Jan 2022 16:02:45 GMT
Cache-Control: no-cache
Content-Encoding: gzip

GET
H2 200 tag.min.js Show response
get.s-onetag.com/f0c84061-4182-4398-8e37-5ff5b5698a6f/ 30 KB
10 KB 67ms
19ms Script
text/javascript 13.225.63.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://get.s-onetag.com/f0c84061-4182-4398-8e37-5ff5b5698a6f/tag.min.js
Requested by: Host: t.dtscout.com
URL: https://t.dtscout.com/i/?l=http%3A%2F%2Fto.xrivonet.info%2Fam7.html&j=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-60.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d9262f833e999fddfae1cb297ae5f9e260529ca0ca737ed805a11fbf3ab92bcd

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: BC1z2ASq_5A8fCLvu30SOKeIK4SZ9jqY
content-encoding: gzip
last-modified: Thu, 03 Jun 2021 13:27:46 GMT
server: AmazonS3
age: 64190
etag: W/"a1c6ef0f57fd5dc66dd46feb78238adf"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 b8508a82603ebd452aecb2900fb8eef0.cloudfront.net (CloudFront)
cache-control: max-age=86400
date: Thu, 27 Jan 2022 22:12:57 GMT
x-amz-cf-pop: EWR53-C1
x-amz-cf-id: MHWoJ0zI3Svi7YWLTKhqJiIbx1QppTs0TDpRkijtQgIGFr2EtJ2wuw==

GET
H/1.1 200
OK dtscout Show response
pd.sharethis.com/pd/ 2 KB
3 KB 157ms
38ms Script
application/javascript 3.129.201.32
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://pd.sharethis.com/pd/dtscout

Requested by

Host: t.dtscout.com
URL: https://t.dtscout.com/i/?l=http%3A%2F%2Fto.xrivonet.info%2Fam7.html&j=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.129.201.32 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

3b284a74de0fae2b410681f459bd6ea5501c25437740762e48c8f7d496366904

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Connection: keep-alive
X-Robots-Tag: noindex, nofollow
Content-Length: 2273
Strict-Transport-Security: max-age=63072000; includeSubDomains;
Content-Type: application/javascript

GET
H/1.1 200
OK / Show response
t.dtscout.com/pv/ 50 B
318 B 38ms
10ms Script
application/javascript 167.114.209.61
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://t.dtscout.com/pv/?_a=v&_h=to.xrivonet.info&_ss=2lf1hi6368&_pv=1&_ls=0&_u1=1&_u3=1&_cc=ca&_pl=d&_cbid=6vd1&_cb=_dtspv.c
Requested by: Host: t.dtscout.com
URL: https://t.dtscout.com/i/?l=http%3A%2F%2Fto.xrivonet.info%2Fam7.html&j=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 167.114.209.61 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ns515688.ip-167-114-209.net
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 3df0b22e7afe4a8ab7d8a75050c83d9cd036d403c1a66117f2027a5b06f66b18

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:46 GMT
X-T: 0.167
Server: nginx/1.10.3 (Ubuntu)
Transfer-Encoding: chunked
X-C: 0
Content-Type: application/javascript
Cache-Control: no-cache
Connection: close
Expires: Fri, 28 Jan 2022 16:02:45 GMT

GET
H2 200 tc.js Show response
cdn.tynt.com/ 17 KB
7 KB 111ms
46ms Script
application/javascript 104.18.29.199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.tynt.com/tc.js
Requested by: Host: widgets.amung.us
URL: http://widgets.amung.us/colored.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.29.199 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2347066080fea31af55c7112dca5245ea3eea67df5f24f1daae09f0870fbce62

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 27 Aug 2021 20:58:37 GMT
server: cloudflare
age: 16648
etag: W/"612951fd-431d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 6d4b7273bd014003-YYZ
expires: Mon, 31 Jan 2022 16:02:47 GMT

GET
H/1.1 200
OK /
widgets.amung.us/colwid/ 3 KB
4 KB 25ms
25ms Image
image/png 2606:4700:10::6816:4aab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://widgets.amung.us/colwid/?c=ffc20e000000
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 2606:4700:10::6816:4aab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 661c696659df6d576a75b9f65e11a05995760c8bc0e4aeec85e00a977bc7d2e7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:46 GMT
CF-Cache-Status: HIT
Last-Modified: Fri, 28 Jan 2022 01:54:27 GMT
Server: cloudflare
Age: 50899
Vary: Accept-Encoding
Content-Type: image/png
access-control-allow-origin: *
cache-control: max-age=432000
Transfer-Encoding: chunked
content-disposition: filename=wau-widget.png
Connection: keep-alive
CF-RAY: 6d4b7273489e715a-YUL
expires: Sat, 29 Jan 2022 01:54:27 GMT

GET
H/1.1 200
OK suurl.php Show response
onclickgenius.com/script/ 5 KB
2 KB 189ms
167ms Script
application/javascript 35.190.71.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://onclickgenius.com/script/suurl.php?r=2059055&cbrandom=0.5128888147066526&cbiframe=0&cbWidth=1600&cbHeight=1200&cbtitle=RivoRD&cbref=&cbdescription=&cbkeywords=&cbcdn=celeritascdn.com&ufp=15731751739543303242008461254
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 35.190.71.96 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.71.190.35.bc.googleusercontent.com
Software: openresty /
Resource Hash: f5e1d56d6c30ea037f1561d47e8a966ba3ec1b1c9f1ba7cc67572d028d09c9b7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 28 Jan 2022 16:02:47 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: openresty
Via: 1.1 google
Content-Type: application/javascript; charset=utf-8

GET
H/1.1 200
OK chrome.js Show response
celeritascdn.com/script/ 36 KB
12 KB 34ms
34ms Script
application/javascript 2606:4700::6810:5c06
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://celeritascdn.com/script/chrome.js
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 2606:4700::6810:5c06 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 59f4d7efe6da31323c45da80772acec8cd177a21530c2de576f86ee3fcefd946

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:46 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Age: 2529
X-GUploader-UploadID: ADPycdtLIXxnZMNA-UHD6wXxuMv2SSPlY6zFeNfCU4JmDwUJRTdJhS2LoiEVkVZM_moSNlkXmbQHR-vc7wdaLeBOxwg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
Connection: keep-alive
Content-Type: application/javascript
Last-Modified: Mon, 14 Sep 2020 09:15:29 GMT
Server: cloudflare
ETag: W/"ef6565ab259dafbc08468b4d0bb46762"
Vary: Accept-Encoding
x-goog-hash: crc32c=KoLUvQ==, md5=72VlqyWdr7wIRotNC7RnYg==
x-goog-generation: 1600074929755781
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=14400
Transfer-Encoding: chunked
x-goog-stored-content-length: 37300
CF-RAY: 6d4b72735da5713f-YUL
Expires: Fri, 28 Jan 2022 20:02:46 GMT

GET
H2 200 / Show response
c.adsco.re/ 62 KB
22 KB 102ms
39ms Script
text/html 2606:4700::6811:a7ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.adsco.re/
Requested by: Host: c1.popads.net
URL: http://c1.popads.net/pop.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:a7ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9aaaac87a4cddb7db367764a7080fd31491c36ae256ba81391c270f8c4b2d0f8

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 5348762
etag: W/"2Ma3006J78KgzL0RD+7gUg=="
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html
link: <//6.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//4.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//adsco.re/>;rel=dns-prefetch
cache-control: public, max-age=2678400
cf-ray: 6d4b7273ee76ece6-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Mon, 28 Feb 2022 16:02:47 GMT

GET
H2 200 lt.min.js Show response
tags.crwdcntrl.net/lt/c/3825/ 43 KB
44 KB 82ms
23ms Script
text/javascript 54.230.162.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/3825/lt.min.js
Requested by: Host: t.dtscout.com
URL: https://t.dtscout.com/i/?l=http%3A%2F%2Fto.xrivonet.info%2Fam7.html&j=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.162.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-162-121.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c5f5fafca53e303f739660340b7354ea21f79ccb6f80aed85f4110c941b6cfc9

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Thu, 27 Jan 2022 21:00:24 GMT
via: 1.1 e3fb879a67c14c7a96059b2b777ccbc8.cloudfront.net (CloudFront)
last-modified: Mon, 10 Jan 2022 15:33:32 GMT
server: AmazonS3
age: 68544
etag: "e8e52baa0cf6ccb764f317323674bacd"
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age: 86400
x-amz-cf-pop: EWR53-C3
accept-ranges: bytes
content-length: 44180
x-amz-cf-id: 2crNc1Hk-fU9b2Qg-vFDoMRcEwe8hS6smUB4MRvsmT5eyFyB3ltt7A==

GET
H/1.1 200
OK / Show response
t.dtscdn.com/widget/ 0
407 B 94ms
24ms Script
application/javascript 45.55.120.93
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://t.dtscdn.com/widget/?d=6D0016433857660ED732E3C018C0B7DB&nid=0&p=836148727&t=0&s=1600x1200x24&u=http%3A%2F%2Fto.xrivonet.info%2Fam7.html&r=
Requested by: Host: t.dtscout.com
URL: https://t.dtscout.com/i/?l=http%3A%2F%2Fto.xrivonet.info%2Fam7.html&j=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 45.55.120.93 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:07:41 GMT
X-T: 1.16
x-server: web15.ny1.dtscdn.com
Cache-Control: no-cache
Content-Type: application/javascript; charset=UTF-8
Transfer-Encoding: chunked
Expires: Fri, 28 Jan 2022 16:07:40 GMT

GET
H2 200 e Show response
a.dtssrv.com/ 21 B
667 B 112ms
55ms XHR
application/json 2606:4700:3032::ac43:dc33
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.dtssrv.com/e?i=6D0016433857660ED732E3C018C0B7DB
Requested by: Host: t.dtscout.com
URL: https://t.dtscout.com/i/?l=http%3A%2F%2Fto.xrivonet.info%2Fam7.html&j=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::ac43:dc33 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 767b7b3133c056a84b31fbaa9c4a03fdd1614a439a66680e0c6d0f7a9048e1a3

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
pragma: cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eTfSQby3EUuVF72X4Mc%2B8nDAizfA%2F8qgu1TNpbiiofNn7DHCJlbbOmD9RGHMuwjjFQv8bp0LGIzOmnHUd0N7yvZs84MGycACzndDa%2FQ0uu4vMaVOV%2FxkEjyfh%2B2qs0hF5aCHwhTrQ%2B%2BFwUM%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: http://to.xrivonet.info
cache-control: s-maxage=0
access-control-allow-credentials: true
cf-ray: 6d4b72741a47713c-YUL
expires: Fri, 28 Jan 2022 18:02:47 GMT

GET
H/1.1 200
OK 27675
tags.bluekai.com/site/ 62 B
425 B 144ms
88ms Image
image/gif 173.223.56.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/27675?id=6D0016433857660ED732E3C018C0B7DB&ret=html&phint=__bk_t%3DRivoRD&phint=__bk_l%3Dhttp%3A%2F%2Fto.xrivonet.info%2Fam7.html&r=12646890
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 173.223.56.123 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a173-223-56-123.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 28 Jan 2022 16:02:47 GMT
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 62
BK-Server: 3a13
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200
OK

33141
tags.bluekai.com/site/
Redirect Chain

https://pixel.onaudience.com/?partner=137085098&mapped=6D0016433857660ED732E3C018C0B7DB
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=xksw9la&ttd_tpi=1
https://pixel.onaudience.com/?partner=147&mapped=dbbc26c1-e300-4981-b31d-6ed65ba41a6e&icm
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25&xl8blockcheck=1
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=a61cb36d27e8cfc1ac00162a4ddc6f45
https://pixel.onaudience.com/?partner=109&icm&cver&smartmap=1&redirect=tags.bluekai.com%2Fsite%2F33141%3F%26id%3D%25m
https://tags.bluekai.com/site/33141?&id=ae8251805a33a2d1

62 B
583 B

194ms
192ms

Image
image/gif

173.223.56.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/33141?&id=ae8251805a33a2d1
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 173.223.56.123 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a173-223-56-123.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Connection: keep-alive
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Content-Length: 62
Content-Type: image/gif

Redirect headers

location: https://tags.bluekai.com/site/33141?&id=ae8251805a33a2d1
content-length: 0

GET
H2 200 / Show response
onetag-geo.s-onetag.com/ 535 B
948 B 107ms
49ms Fetch
application/json 54.230.162.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://onetag-geo.s-onetag.com/
Requested by: Host: get.s-onetag.com
URL: https://get.s-onetag.com/f0c84061-4182-4398-8e37-5ff5b5698a6f/tag.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.162.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-162-30.ewr53.r.cloudfront.net
Software: /
Resource Hash: 338dacde17883d60c2dfd00e56dd18d04bcebe147e818315978f530e19397009

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 01:03:06 GMT
via: 1.1 613faec4b883bfe2ebdd8a74d5006f4c.cloudfront.net (CloudFront), 1.1 b2406c07406aaa3fa3e9edc1125ffcf8.cloudfront.net (CloudFront)
age: 53981
x-amzn-requestid: 82cfa9df-b968-4b03-83d7-0e5bff4fed2e
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-pop: IAD89-C3, EWR53-C3
x-amz-apigw-id: MocPtFtViYcF2fQ=
content-length: 535
x-amz-cf-id: oMSnOMnJTve4n2yXHaxKW6NqPmP22ujD3eamzqptUpds8bYhCbhE5Q==

GET
H2 200 p
ic.tynt.com/b/ 35 B
523 B 111ms
33ms Image
image/gif 67.202.105.34
STEADFAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ic.tynt.com/b/p?id=w!rtnlniviutns&lm=0&ts=1643385767042&dn=TC&iso=0&t=RivoRD&cu=https%3A%2F%2Fwrivz1.blogspot.com%2F
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.34 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip34.67-202-105.static.steadfastdns.net
Software: nginx/1.16.1 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/am7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
last-modified: Fri, 16 Apr 2010 15:38:20 GMT
server: nginx/1.16.1
etag: "4bc8846c-23"
p3p: policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID", CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
cache-control: "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
accept-ranges: bytes
content-type: image/gif
content-length: 35
expires: "Sat, 26 Jul 1997 05:00:00 GMT"

GET
H/1.1 200
OK popunder.gif
esmentbrads.com/ 35 B
876 B 58ms
33ms Image
image/gif 2606:4700:3030::ac43:aab8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://esmentbrads.com/popunder.gif
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 2606:4700:3030::ac43:aab8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
content-encoding: gzip
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 158267
Connection: keep-alive
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 58
pragma: public
Last-Modified: Wed, 26 Jan 2022 20:05:00 GMT
Server: cloudflare
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2BN0NaUlQkLtk306Q6H9nPIkBRB1gjiSsozg%2BTe7dwfYyOZgk8oqJSeyIrYJRHo1W71jlfjmPAbEGbpjcUmSuuakQuX3sJUaVYifGr8T0xfgJztLCSS6YRz3kl99c6jMUa%2Ft22%2FyTuyZ3cRZLco%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=604800, immutable
Accept-Ranges: bytes
CF-RAY: 6d4b72744fec7156-YUL

GET
H2 200 /
6.adsco.re/ 0
415 B 95ms
27ms Other
text/plain 2606:4700::6811:a6ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://6.adsco.re/
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:a6ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://to.xrivonet.info/
Origin: http://to.xrivonet.info
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
content-encoding: br
server: cloudflare
access-control-allow-headers: Content-Type
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: text/plain;charset=UTF-8
access-control-allow-origin: http://to.xrivonet.info
access-control-max-age: 2592000
cache-control: private, max-age=10
cf-ray: 6d4b72749a4c715a-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK /
4.adsco.re/ 0
462 B 170ms
44ms Other
text/html 162.252.214.5
TUT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://4.adsco.re/
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 162.252.214.5 , United States, ASN53334 (TUT-AS, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://to.xrivonet.info/
Origin: http://to.xrivonet.info
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Content-Encoding: gzip
Access-Control-Max-Age: 2592000
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: http://to.xrivonet.info
Cache-Control: private, max-age=5
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Headers: Content-Type

POST
H/1.1 200
OK p Show response
adsco.re/ 0
424 B 101ms
52ms XHR
text/html 162.252.214.5
TUT-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://adsco.re/p
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Server: 162.252.214.5 , United States, ASN53334 (TUT-AS, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://to.xrivonet.info/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
AS-P-4: OK
Transfer-Encoding: chunked
AS-P-1: OK nyc124
Access-Control-Allow-Origin: http://to.xrivonet.info
Access-Control-Max-Age: 2592000
Cache-Control: no-transform
Access-Control-Allow-Credentials: true
Connection: keep-alive
AS-E: ND
AS-P-2: OK
AS-P-3: OK

GET
H/1.1 200
OK / Show response
4.adsco.re/ 47 B
462 B 88ms
52ms XHR
text/html 162.252.214.5
TUT-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://4.adsco.re/
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Server: 162.252.214.5 , United States, ASN53334 (TUT-AS, US),
Reverse DNS
Software: /
Resource Hash: 7b1bade61a0142d25faef554b6fa4aaa721b8459f7bb2970c3144eb04c8e01fa

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Content-Encoding: gzip
Access-Control-Max-Age: 2592000
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: http://to.xrivonet.info
Cache-Control: private, max-age=5
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Headers: Content-Type

GET
H/1.1 200
OK / Show response
6.adsco.re/ 54 B
594 B 42ms
24ms XHR
text/plain 2606:4700::6811:a6ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://6.adsco.re/
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Server: 2606:4700::6811:a6ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f67f8b19170f0d64a9772e4a034119f8d42834d64a46a317760bf2789d97659

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Content-Encoding: gzip
Server: cloudflare
Access-Control-Allow-Headers: Content-Type
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: text/plain;charset=UTF-8
Access-Control-Allow-Origin: http://to.xrivonet.info
Access-Control-Max-Age: 2592000
Cache-Control: private, max-age=10
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 6d4b72748d727133-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

POST
H/1.1 200
OK /
ukpfduzssxxk.l4.adsco.re/ 0
464 B 452ms
85ms Ping
text/html 185.200.118.90
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://ukpfduzssxxk.l4.adsco.re/
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 185.200.118.90 London, United Kingdom, ASN9009 (M247, GB),
Reverse DNS: adscore.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://to.xrivonet.info/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Last-Modified: Tue, 31 Jul 2018 22:16:15 GMT
ETag: "5b60dfaf-0"
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/html
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Range
Connection: close
Accept-Ranges: bytes
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Content-Length: 0

POST
H/1.1 200
OK /
ukpfduzssxxk.n4.adsco.re/ 0
464 B 79ms
19ms Ping
text/html 38.132.109.186
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://ukpfduzssxxk.n4.adsco.re/
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 38.132.109.186 New York, United States, ASN9009 (M247, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://to.xrivonet.info/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Last-Modified: Mon, 30 Jul 2018 15:32:42 GMT
ETag: "5b5f2f9a-0"
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/html
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Range
Connection: close
Accept-Ranges: bytes
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Content-Length: 0

POST
H/1.1 200
OK /
ukpfduzssxxk.s4.adsco.re/ 0
464 B 1394ms
253ms Ping
text/html 185.200.116.90
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://ukpfduzssxxk.s4.adsco.re/
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 185.200.116.90 Singapore, Singapore, ASN9009 (M247, GB),
Reverse DNS: no-mans-land.m247.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://to.xrivonet.info/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Fri, 28 Jan 2022 16:02:48 GMT
Last-Modified: Mon, 30 Jul 2018 15:38:01 GMT
ETag: "5b5f30d9-0"
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/html
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Range
Connection: close
Accept-Ranges: bytes
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Content-Length: 0

GET
H/1.1 200
OK / Show response
c.adsco.re/ Frame 9226 62 KB
25 KB 46ms
26ms Document
text/html 2606:4700::6811:a7ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://c.adsco.re/
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Server: 2606:4700::6811:a7ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9aaaac87a4cddb7db367764a7080fd31491c36ae256ba81391c270f8c4b2d0f8

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: public, max-age=2678400
Link: <//6.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//4.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//adsco.re/>;rel=dns-prefetch
Expires: Mon, 28 Feb 2022 16:02:47 GMT
ETag: W/"2Ma3006J78KgzL0RD+7gUg=="
Content-Encoding: gzip
CF-Cache-Status: HIT
Age: 5348758
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 6d4b72749a60715a-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK /
6.adsco.re/ Frame 9226 0
588 B 25ms
25ms Other
text/plain 2606:4700::6811:a6ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://6.adsco.re/
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 2606:4700::6811:a6ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://c.adsco.re/
Origin: http://c.adsco.re
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Content-Encoding: gzip
Server: cloudflare
Access-Control-Allow-Headers: Content-Type
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: text/plain;charset=UTF-8
Access-Control-Allow-Origin: http://c.adsco.re
Access-Control-Max-Age: 2592000
Cache-Control: private, max-age=10
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 6d4b72759eb67133-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK /
4.adsco.re/ Frame 9226 0
456 B 42ms
42ms Other
text/html 162.252.214.5
TUT-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://4.adsco.re/
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 162.252.214.5 , United States, ASN53334 (TUT-AS, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://c.adsco.re/
Origin: http://c.adsco.re
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Content-Encoding: gzip
Access-Control-Max-Age: 2592000
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: http://c.adsco.re
Cache-Control: private, max-age=5
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Headers: Content-Type

GET
H2 200 multi Show response
ericantpas.com/ 3 KB
2 KB 31ms
30ms XHR
text/plain 18.67.76.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ericantpas.com/multi?cs=WU1qQklofV50eWp%2FW3N4an9dcXg&abt=0&red=1&sm=74&k=&v=1.0.55.2&sts=2&prn=0&emb=0&tid=712339&u=1211260029020555&fs=1&ref=http%3A%2F%2Fto.xrivonet.info%2Fam7.html&jst=0&enr=0&lcua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F97.0.4692.71%20safari%2F537.36&tzd=0&uloc=&if=0&_Cn1D=1643385767327&crc=1
Requested by: Host: d2fbkzyicji7c4.cloudfront.net
URL: http://d2fbkzyicji7c4.cloudfront.net/?zkbfd=622073
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.76.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-76-95.iad89.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: d19a4fcde0d8fa8f39f6b2ac597e6a24bd4795a6e220e99ad432df8922cdf9c7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:47 GMT
content-encoding: gzip
server: openresty/1.17.8.2
x-amz-cf-pop: IAD89-P2
x-cache: Miss from cloudfront
p3p: CP="NID DSP ALL COR"
access-control-allow-origin: http://to.xrivonet.info
cache-control: no-store, no-cache, must-revalidate, no-transform
access-control-allow-credentials: true
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
content-type: text/plain
content-length: 1322
via: 1.1 2b0c54ffe9876882253b010d44184bdc.cloudfront.net (CloudFront)
x-amz-cf-id: SbeagUoAZRjXfyf26oDAEWhVnrHI5YGUUOWuYE8-Alj5BsVKb_y7iA==

GET
H/1.1 200
OK t.dhj Show response
t.sharethis.com/1/d/ 2 KB
2 KB 84ms
19ms Script
application/javascript 23.192.50.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://t.sharethis.com/1/d/t.dhj?cid=c010&cls=C&rnd=0.42833360993268044&stid=ZHIABWH0E6cAAAAIGLpiAw%3D%3D

Requested by

Host: pd.sharethis.com
URL: https://pd.sharethis.com/pd/dtscout

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.192.50.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

ec2-3-129-201-32.us-east-2.compute.amazonaws.com

Software

Resource Hash

6e3e6848f42bed2363e5bf0ea2703562a6dc879ab20fd67c3062edef98e21b90

Security Headers

Name	Value
Strict-Transport-Security	max-age=2628000 ; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=2628000 ; includeSubDomains
Content-Type: application/javascript
Cache-Control: private, max-age=3600
Connection: keep-alive
X-Robots-Tag: noindex, nofollow
Content-Length: 1364
Expires: Fri, 28 Jan 2022 17:02:47 GMT

GET
H/1.1 200
OK dtscout
pd.sharethis.com/pd/ 42 B
265 B 35ms
34ms Image
image/gif 3.129.201.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pd.sharethis.com/pd/dtscout?_t_=px&url=http%3A%2F%2Fto.xrivonet.info%2Fam7.html&event_source=dtscout&rnd=0.42833360993268044&exptid=ZHIABWH0E6cAAAAIGLpiAw%3D%3D&fcmp=false

Requested by

Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.129.201.32 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Connection: keep-alive
X-Robots-Tag: noindex, nofollow
Content-Length: 42
Strict-Transport-Security: max-age=63072000; includeSubDomains;
Content-Type: image/gif

GET
H/1.1 200
OK / Show response
c.adsco.re/ Frame 9226 62 KB
25 KB 27ms
26ms XHR
text/html 2606:4700::6811:a7ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://c.adsco.re/
Requested by: Host: c.adsco.re
URL: http://c.adsco.re/
Protocol: HTTP/1.1
Server: 2606:4700::6811:a7ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9aaaac87a4cddb7db367764a7080fd31491c36ae256ba81391c270f8c4b2d0f8

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://c.adsco.re/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Server: cloudflare
Age: 5348758
ETag: W/"2Ma3006J78KgzL0RD+7gUg=="
Vary: Accept-Encoding
Content-Type: text/html
Link: <//6.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//4.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//adsco.re/>;rel=dns-prefetch
Cache-Control: public, max-age=2678400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 6d4b7275fc1e715a-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Expires: Mon, 28 Feb 2022 16:02:47 GMT

GET
H2 200 loader.js Show response
cdn.taboola.com/libtrc/chatango-network/ Frame 7474 74 KB
21 KB 43ms
11ms Script
application/javascript 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/chatango-network/loader.js
Requested by: Host: st.chatango.com
URL: https://st.chatango.com/h5/gz/r1101210814/id.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: obaker.95.4.1-11.205 /
Resource Hash: 79272c4829349f1fd469443fb3d85d5d459f22f1a01b9510c07973f0568b0c67

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://st.chatango.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: JzRKP754wYARqAyyRT2AchkPRLd5gqQs
content-encoding: gzip
etag: "0cc88d138e77daf5a98d689046b1e1d6e22681ba"
age: 886
via: 1.1 varnish
x-cache: HIT
x-from-cache: 1
content-length: 20523
x-amz-id-2: Zx7ypsqSSZ5YG03Q3Qa/Q5S1Ea0orZgO6SW8gF97DFMr4il4gbm04eX6rouPNysU7G7CBcx5jeA=
x-served-by: cache-yul12822-YUL
last-modified: Thu, 27 Jan 2022 15:01:03 UTC
server: obaker.95.4.1-11.205
x-timer: S1643385767.381798,VS0,VE1
date: Fri, 28 Jan 2022 16:02:47 GMT
vary: Accept-Encoding, Accept-Encoding
x-amz-request-id: QR6RMW202A23H92H
access-control-allow-origin: *
cache-control: private,max-age=14400
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 3
x-cache-hits: 1

GET
H2 200 v2 Show response
de.tynt.com/deb/ 2 KB
3 KB 117ms
40ms Script
application/javascript 67.202.105.31
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://de.tynt.com/deb/v2?id=w!rtnlniviutns&dn=TC&cc=1&r=
Requested by: Host: cdn.tynt.com
URL: https://cdn.tynt.com/tc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.31 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip31.67-202-105.static.steadfastdns.net
Software: /
Resource Hash: 9d807622952ce3e274f5b00cc8c4501e1c1d776a9fd6d1b93ff2a9960152cedb

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/am7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:46 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-type: application/javascript
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
content-length: 1634
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET /
6.adsco.re/ Frame 9226 0
0

GET /
4.adsco.re/ Frame 9226 0
0

GET
H2 200 su.js Show response
cdnquality.com/script/ Frame 1579 24 KB
8 KB 91ms
32ms Script
text/javascript 2606:4700::6811:481e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdnquality.com/script/su.js
Requested by: Host: sportsonline.to
URL: https://sportsonline.to/channels/hd/hd7.php
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:481e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c0a97a9799bba7cbaca2ff35b43daaef3ac0c679ba39a90df166c39aad65bea3

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://sportsonline.to/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 517
x-guploader-uploadid: ADPycdvVO27XuYoeZ9xBphnspOZmoEu1sTZywr6g7-8Aj-lzxT9KmML-0r4zbbS9i6c67NcJgTIt-T7zo0e2uDClei0diE9fug
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-type: text/javascript
last-modified: Thu, 28 Oct 2021 10:36:10 GMT
server: cloudflare
etag: W/"765a50e18db5bdc3badf43040834c22a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=ZIf5+A==, md5=dlpQ4Y21vcO630MECDTCKg==
x-goog-generation: 1635417370397478
access-control-allow-origin: *
cache-control: public, max-age=14400
x-goog-stored-content-length: 24244
cf-ray: 6d4b72769c564bd1-YUL
expires: Fri, 28 Jan 2022 20:02:47 GMT

GET
H3 200 SCCfwxq.png
sportsonline.to/channels/hd/ Frame 1579 1 KB
2 KB 76ms
27ms Image
image/png 2606:4700:3032::ac43:d85e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sportsonline.to/channels/hd/SCCfwxq.png
Requested by: Host: sportsonline.to
URL: https://sportsonline.to/channels/hd/hd7.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::ac43:d85e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ae0433ac5d000ac03daf9059492d0390e427b7461332f0f488bbc6f44b5107a7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://sportsonline.to/channels/hd/hd7.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5688
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1220
last-modified: Tue, 07 Dec 2021 14:48:18 GMT
server: cloudflare
etag: "61af7432-4c4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DhukDHh5y5meoYtbiMsRp8tBxgNZjELkQlVTg6MyZvc2W91xDZYrJtNLkKQRSuBiL5ToaADq6U5bdiZLYgh1wH8LgfTDSABPWptHa7Muar6nkiH9OvpvVk%2BAjJ1RloIquCaLmTUYvQnQgbYAU3E%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6d4b727688584bca-YUL

GET
H2

200

/
widgets.amung.us/draw/ Frame 1579
Redirect Chain

https://whos.amung.us/cwidget/sportsonline/000000ffffff.png
https://widgets.amung.us/draw/?w=colored&n=1057&c=000000ffffff&p=

2 KB
2 KB

78ms
29ms

Image
image/png

2606:4700:10::6816:4aab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.amung.us/draw/?w=colored&n=1057&c=000000ffffff&p=
Requested by: Host: sportsonline.to
URL: https://sportsonline.to/channels/hd/hd7.php
Protocol: H2
Server: 2606:4700:10::6816:4aab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33b711fccccb115797466b3b5458913317216ee391b15f9094f325c1eba59a26

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://sportsonline.to/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
cf-cache-status: HIT
last-modified: Thu, 27 Jan 2022 08:12:46 GMT
server: cloudflare
age: 114601
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=432000
content-disposition: filename=wau-widget.png
cf-ray: 6d4b72778f0f4bd0-YUL
expires: Fri, 28 Jan 2022 08:12:46 GMT

Redirect headers

location: https://widgets.amung.us/draw/?w=colored&n=1057&c=000000ffffff&p=
date: Fri, 28 Jan 2022 16:02:47 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 1579 90 KB
35 KB 76ms
48ms Script
application/javascript 2607:f8b0:4006:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-202511892-1

Requested by

Host: sportsonline.to
URL: https://sportsonline.to/channels/hd/hd7.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

64cb84e848e0d1cd3408a766ee1611d6224e0d3111a50efd5a911fbfcd0a936a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://sportsonline.to/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36113
x-xss-protection: 0
last-modified: Fri, 28 Jan 2022 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 28 Jan 2022 16:02:47 GMT

GET
H2 200 impl.20220116-15_b2-DEV-104886-test-impact-of-eliminating-explore-event-in-r-box-e30b7c3f75b-SNAPSHOT.js Show response
cdn.taboola.com/libtrc/ Frame 7474 615 KB
127 KB 10ms
10ms Script
application/javascript 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/impl.20220116-15_b2-DEV-104886-test-impact-of-eliminating-explore-event-in-r-box-e30b7c3f75b-SNAPSHOT.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/chatango-network/loader.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3-br /
Resource Hash: 2afd23a15a62549b9656cae8cae7ec6183ecac798a8e867b0c465505070d51ca

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://st.chatango.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: IpPGqVAuGa3yMZyTWX2_dfB844A8okBa
content-encoding: br
etag: "bd522847be5419620be74933a873c7e1"
age: 20581
x-cache: HIT
content-length: 129759
x-amz-id-2: ucPG1ADdWCsa+2SuZSuXHm3svCOFqJLQOvsB0uByv1dPpHrMa37PuvpMn4wsj6kVTtMSIkwNPI4=
x-served-by: cache-yul12822-YUL
last-modified: Mon, 17 Jan 2022 10:10:41 GMT
server: AmazonS3-br
x-timer: S1643385767.404505,VS0,VE0
date: Fri, 28 Jan 2022 16:02:47 GMT
vary: Accept-Encoding
x-amz-request-id: B3QTS27BMD77RPS2
via: 1.1 varnish
cache-control: private,max-age=14400
accept-ranges: bytes
content-type: application/javascript
abp: 77
x-cache-hits: 865

GET
H2 200 beacon.js Show response
sb.scorecardresearch.com/ Frame 7474 1 KB
1 KB 60ms
20ms Script
application/javascript 13.225.214.85
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/chatango-network/loader.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.214.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-214-85.ewr50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://st.chatango.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 12:37:20 GMT
content-encoding: gzip
etag: W/"1827f116c73f319409b97f10b8a58ade"
last-modified: Fri, 26 Feb 2021 14:35:05 GMT
server: AmazonS3
age: 14235
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 e6fc68fd040718147cda2e3ef6f63636.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
x-amz-cf-id: RtUUezk3QouCVcGKabtNMS6niw_mvppjpYJHnMciWCM44kKw-xIyyA==

GET
H2 200 tr5
cdn.taboola.com/libtrc/ Frame 7474 3 B
78 B 10ms
10ms Image
text/html 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.taboola.com/libtrc/tr5?abgroup=cancel_explore_var
Requested by: Host: st.chatango.com
URL: https://st.chatango.com/h5/gz/r1101210814/id.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://st.chatango.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1643385767.440224,VS0,VE0
x-served-by: cache-yul12822-YUL
x-cache: HIT
content-type: text/html
cache-control: private,max-age=14400
accept-ranges: bytes
content-length: 3
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

t_.htm Show response
t.sharethis.com/a/ Frame 24DC
Redirect Chain

http://t.sharethis.com/a/t_.htm?ver=1.825.22807&cid=c010&cls=C
https://t.sharethis.com/a/t_.htm?ver=1.825.22807&cid=c010&cls=C

2 KB
1 KB

22ms
21ms

Document
text/html

23.192.50.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://t.sharethis.com/a/t_.htm?ver=1.825.22807&cid=c010&cls=C

Requested by

Host: t.sharethis.com
URL: https://t.sharethis.com/1/d/t.dhj?cid=c010&cls=C&rnd=0.42833360993268044&stid=ZHIABWH0E6cAAAAIGLpiAw%3D%3D

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.192.50.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

Resource Hash

ec73870a124df2d105249652c84da8f949bf73bcd5ca8ad6deca84b4fbd2e9d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=2628000 ; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/

Response headers

Content-Length: 1160
Cache-Control: max-age=604800
Expires: Fri, 04 Feb 2022 16:02:47 GMT
Date: Fri, 28 Jan 2022 16:02:47 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=2628000 ; includeSubDomains
Content-Encoding: gzip
Content-Type: text/html
X-Robots-Tag: noindex, nofollow

Redirect headers

Location: https://t.sharethis.com/a/t_.htm?ver=1.825.22807&cid=c010&cls=C#cid=c010&cls=C&rnd=0.42833360993268044&stid=ZHIABWH0E6cAAAAIGLpiAw%253D%253D&tt=t.dhj&dhjLcy=1643385767418&lbl=pxcel&flbl=pxcel&ll=d&ver=1.825.22807&ell=d&cck=__stid&dmn=to.xrivonet.info&pn=%2Fam7.html&qs=na&rdn=to.xrivonet.info&rpn=%2Fam7.html&rqs=na&cc=CA&cont=NA&ipaddr=
Non-Authoritative-Reason: HSTS

GET
H2

204

b2
sb.scorecardresearch.com/ Frame 7474
Redirect Chain

https://sb.scorecardresearch.com/b?c1=7&c2=34354936&c3=1&ns__t=1643385767486&ns_c=windows-1252&ns_if=1&cv=3.5&c8=&c7=https%3A%2F%2Fst.chatango.com%2Fh5%2Fgz%2Fr1101210814%2Fid.html&c9=http%3A%2F%2F...
https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1643385767486&ns_c=windows-1252&ns_if=1&cv=3.5&c8=&c7=https%3A%2F%2Fst.chatango.com%2Fh5%2Fgz%2Fr1101210814%2Fid.html&c9=http%3A%2F%2...

0
225 B

132ms
132ms

Image
text/plain

13.225.214.85
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1643385767486&ns_c=windows-1252&ns_if=1&cv=3.5&c8=&c7=https%3A%2F%2Fst.chatango.com%2Fh5%2Fgz%2Fr1101210814%2Fid.html&c9=http%3A%2F%2Fto.xrivonet.info%2F
Requested by: Host: st.chatango.com
URL: https://st.chatango.com/h5/gz/r1101210814/id.html
Protocol: H2
Server: 13.225.214.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-214-85.ewr50.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://st.chatango.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
via: 1.1 e6fc68fd040718147cda2e3ef6f63636.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
x-amz-cf-id: iMCWBBc2H0SzZY9DvV93GvPO84eGl4ER3Gqg-Yj2neDSqWb6TX6maQ==
x-cache: Miss from cloudfront

Redirect headers

date: Fri, 28 Jan 2022 16:02:47 GMT
via: 1.1 e6fc68fd040718147cda2e3ef6f63636.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
vary: Accept
x-cache: Miss from cloudfront
content-type: text/plain; charset=utf-8
location: https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1643385767486&ns_c=windows-1252&ns_if=1&cv=3.5&c8=&c7=https%3A%2F%2Fst.chatango.com%2Fh5%2Fgz%2Fr1101210814%2Fid.html&c9=http%3A%2F%2Fto.xrivonet.info%2F
content-length: 239
x-amz-cf-id: rtAKcSWqHmAiHTA75Ulc4qAq2eznrCu6P7RfRBmjarxKeD_x93l-jQ==

GET
H2 200 lotame-sync.html Show response
cdn-tc.33across.com/ Frame F52F 343 B
531 B 113ms
32ms Document
text/html 104.18.15.222
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-tc.33across.com/lotame-sync.html
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/v2?id=w!rtnlniviutns&dn=TC&cc=1&r=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.15.222 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70170e469d8d05527acab7e3335c6fe91e2966ddbb6e9ea6211260b8f717d120

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/am7.html

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
content-type: text/html
last-modified: Fri, 27 Aug 2021 20:58:51 GMT
vary: Accept-Encoding
etag: W/"6129520b-157"
content-encoding: gzip
cf-cache-status: HIT
age: 78262
expires: Mon, 31 Jan 2022 16:02:47 GMT
cache-control: public, max-age=259200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6d4b72779dc25431-YYZ

GET
H/1.1

200
OK

27519 Show response
tags.bluekai.com/site/ Frame B684
Redirect Chain

https://dp2.33across.com/ps/?tt=iframe&pid=1198&us_privacy=&random=1643385767380.7&r=true
https://tags.bluekai.com/site/27519?id=118928525083550&ret=html&random=1643385767

71 B
766 B

134ms
99ms

Document
text/html

173.223.56.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.bluekai.com/site/27519?id=118928525083550&ret=html&random=1643385767
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/v2?id=w!rtnlniviutns&dn=TC&cc=1&r=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 173.223.56.123 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a173-223-56-123.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: about:blank

Response headers

Content-Type: text/html
Content-Length: 71
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
BK-Server: db6d
Date: Fri, 28 Jan 2022 16:02:47 GMT
Connection: keep-alive

Redirect headers

p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate
expires: Thu, 01-Jan-70 00:00:01 GMT
x-33x-status: 400000000040080C
server: 33XP004
location: https://tags.bluekai.com/site/27519?id=118928525083550&ret=html&random=1643385767
content-length: 0
date: Fri, 28 Jan 2022 16:02:46 GMT

GET
H2

204

8396142445851402393
map.go.affec.tv/map/an/
Redirect Chain

https://map.go.affec.tv/map/3a/?pid=CoIKS2H0E6eKLRmAA%2FBqAg%3D%3D&us_privacy=&ts=1643385767380.1
https://secure.adnxs.com/getuid?https%3A%2F%2Fmap.go.affec.tv%2Fmap%2Fan%2F%24UID%3Fch%3D61f413a76af6fd0001d8639f%26chc%3Dtt%26floc%3D%26redirect_url%3D
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fmap.go.affec.tv%252Fmap%252Fan%252F%2524UID%253Fch%253D61f413a76af6fd0001d8639f%2526chc%253Dtt%2526floc%253D%2526redirect_url%253D
https://map.go.affec.tv/map/an/8396142445851402393?ch=61f413a76af6fd0001d8639f&chc=tt&floc=&redirect_url=

0
625 B

82ms
81ms

Image
text/plain

13.225.214.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://map.go.affec.tv/map/an/8396142445851402393?ch=61f413a76af6fd0001d8639f&chc=tt&floc=&redirect_url=
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: H2
Server: 13.225.214.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-214-43.ewr50.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/am7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
via: 1.1 16d05722e4fd66d659ec48b5bb6f2d18.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
content-encoding: gzip
x-amz-cf-id: hv5Kt0ZvY193qNHsM_P46IfnbWD60D8T1LXnETRcvX0qtBv8n7Ac_A==
vary: Accept-Encoding
x-cache: Miss from cloudfront

Redirect headers

Pragma: no-cache
Date: Fri, 28 Jan 2022 16:02:47 GMT
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 669.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 0bcf78e0-b704-443a-8c98-9465b32b0568
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://map.go.affec.tv/map/an/8396142445851402393?ch=61f413a76af6fd0001d8639f&chc=tt&floc=&redirect_url=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

204

usermatch.gif
beacon.krxd.net/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=1388&partner_device_id=CoIKS2H0E6eKLRmAA%2FBqAg%3D%3D&us_privacy=&random=1643385767380.2&redirect=https%3A%2F%2Fthinkcxad.azurewebsites.net%2Fap...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=1388&partner_device_id=CoIKS2H0E6eKLRmAA%2FBqAg%3D%3D&us_privacy=&random=1643385767380.2&redirect=https%3A%2F%2Fthinkcxad.azurewebsites.ne...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=d5a576c2-c8e3-4a42-9390-f757b648aaf1%252Chttps%253A%252F%252Fusermatch.krxd.net%252Fum%252Fv2%253Fpartner%253Dtapad&gdpr=...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=dbbc26c1-e300-4981-b31d-6ed65ba41a6e&ttd_puid=d5a576c2-c8e3-4a42-9390-f757b648aaf1%2Chttps%3A%2F%2Fusermatch.krxd.net%2Fu...
https://usermatch.krxd.net/um/v2?partner=tapad
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=tapad

0
338 B

80ms
26ms

Image
text/plain

54.209.75.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=tapad
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: H2
Server: 54.209.75.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-75-74.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/am7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:48 GMT
cache-control: private, no-cache, no-store
x-request-time: D=31 t=1643385768
x-served-by: beacon-n038-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=tapad
date: Fri, 28 Jan 2022 16:02:47 GMT
x-cache-hits: 0
x-age: 0
content-length: 0
x-cache: MISS
x-served-by: usermatch-a006-ash-prod.krxd.net

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ps.eyeota.net/pixel?pid=c9gd671&t=gif&uid=CoIKS2H0E6eKLRmAA%2FBqAg%3D%3D&us_privacy=&33random=1643385767380.3&cat=33across
https://ps.eyeota.net/pixel/bounce/?pid=c9gd671&t=gif&uid=CoIKS2H0E6eKLRmAA%2FBqAg%3D%3D&us_privacy=&33random=1643385767380.3&cat=33across
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=Mk9UWllWY2t1VlZsSjBHZTlCNVViLVd4cmduSG5RdU43a0l5NnlrT3I3SVE&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=Mk9UWllWY2t1VlZsSjBHZTlCNVViLVd4cmduSG5RdU43a0l5NnlrT3I3SVE&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=c9gd671&google_gid=CAESEGIUYL5xFmGkcUdUp23ZjpU&google_cver=1

70 B
440 B

189ms
188ms

Image
image/gif

34.231.251.31
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=c9gd671&google_gid=CAESEGIUYL5xFmGkcUdUp23ZjpU&google_cver=1
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 34.231.251.31 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-251-31.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/am7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:48 GMT
Content-Type: image/gif
Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=c9gd671&google_gid=CAESEGIUYL5xFmGkcUdUp23ZjpU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 375
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

mw
mwzeom.zeotap.com/
Redirect Chain

https://spl.zeotap.com/z.png?zdid=239&ctry=CA&env=mWeb&eventType=pageview&zpb=w%21rtnlniviutns&zpbcat=Seasonal&zcluid=CoIKS2H0E6eKLRmAA%2FBqAg%3D%3D&us_privacy=&ziid=1643385767380.4
https://ib.adnxs.com/getuid?https://mwzeom.zeotap.com/mw?adnxs_uid=$UID&zpartnerid=2&ctry=CA&env=mWeb&eventType=pageview&id_mid_4=963c4b95-2e4c-4ef1-53ea-96cf418fb455&reqId=031b26b2-58ca-45fd-694a-...
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fadnxs_uid%3D%24UID%26zpartnerid%3D2%26ctry%3DCA%26env%3DmWeb%26eventType%3Dpageview%26id_mid_4%3D963c4b95-2e4c-4ef1-53...
https://mwzeom.zeotap.com/mw?adnxs_uid=8396142445851402393&zpartnerid=2&ctry=CA&env=mWeb&eventType=pageview&id_mid_4=963c4b95-2e4c-4ef1-53ea-96cf418fb455&reqId=031b26b2-58ca-45fd-694a-8b6ca7436f02&...

95 B
178 B

88ms
72ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?adnxs_uid=8396142445851402393&zpartnerid=2&ctry=CA&env=mWeb&eventType=pageview&id_mid_4=963c4b95-2e4c-4ef1-53ea-96cf418fb455&reqId=031b26b2-58ca-45fd-694a-8b6ca7436f02&us_privacy=&zcluid=CoIKS2H0E6eKLRmAA/BqAg==&zdid=239&ziid=1643385767380.4&zpb=w!rtnlniviutns&zpbcat=Seasonal
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: H2
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/am7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: http://to.xrivonet.info
access-control-allow-credentials: true
cf-ray: 6d4b7278da6c7151-YUL
access-control-allow-headers: *
content-length: 95

Redirect headers

Pragma: no-cache
Date: Fri, 28 Jan 2022 16:02:47 GMT
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 637.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: f50d6e8a-abe1-41d7-ada0-5bb12756b7e9
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://mwzeom.zeotap.com/mw?adnxs_uid=8396142445851402393&zpartnerid=2&ctry=CA&env=mWeb&eventType=pageview&id_mid_4=963c4b95-2e4c-4ef1-53ea-96cf418fb455&reqId=031b26b2-58ca-45fd-694a-8b6ca7436f02&us_privacy=&zcluid=CoIKS2H0E6eKLRmAA/BqAg==&zdid=239&ziid=1643385767380.4&zpb=w!rtnlniviutns&zpbcat=Seasonal
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

405716.gif
idsync.rlcdn.com/
Redirect Chain

https://dp2.33across.com/ps/?pid=1205&random=1643385767380.5&r=true
https://idsync.rlcdn.com/405716.gif?partner_uid=1868439873968

42 B
449 B

69ms
43ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/405716.gif?partner_uid=1868439873968
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: H2
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/am7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 28 Jan 2022 16:02:47 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:47 GMT
referrer-policy: unsafe-url
server: 33XP005
x-33x-status: 4000000000004000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://idsync.rlcdn.com/405716.gif?partner_uid=1868439873968
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H/1.1

200
OK

bounce
secure.adnxs.com/
Redirect Chain

https://dp1.33across.com/ps/?pid=669&uid=CoIKS2H0E6eKLRmAA%2FBqAg%3D%3D&us_privacy=&random=1643385767380.8&r=true
https://secure.adnxs.com/mapuid?t=2&member=1001&user=77824875118210&seg_code=33x&random=1643385767
https://secure.adnxs.com/bounce?%2Fmapuid%3Ft%3D2%26member%3D1001%26user%3D77824875118210%26seg_code%3D33x%26random%3D1643385767

43 B
1023 B

52ms
31ms

Image
image/gif

68.67.160.184
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fmapuid%3Ft%3D2%26member%3D1001%26user%3D77824875118210%26seg_code%3D33x%26random%3D1643385767

Requested by

Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html

Protocol

HTTP/1.1

Server

68.67.160.184 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/am7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 28 Jan 2022 16:02:47 GMT
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 669.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 85ecad1a-fd05-4478-a6df-5e563d932730
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 28 Jan 2022 16:02:47 GMT
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 669.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 7b616d4b-cd86-4ba6-9347-098b7cfaf30a
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://secure.adnxs.com/bounce?%2Fmapuid%3Ft%3D2%26member%3D1001%26user%3D77824875118210%26seg_code%3D33x%26random%3D1643385767
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ps.eyeota.net/pixel?pid=c9gd671&t=gif&uid=CoIKS2H0E6eKLRmAA%2FBqAg%3D%3D&us_privacy=&33random=1643385767380.9&cat=33across
https://ps.eyeota.net/pixel/bounce/?pid=c9gd671&t=gif&uid=CoIKS2H0E6eKLRmAA%2FBqAg%3D%3D&us_privacy=&33random=1643385767380.9&cat=33across
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MjBBR2hvczJmeFAwLXJ2c3ZmUGlVVnVlV1M0RGQ0aFlBc3hFY0JGMlhDN2s&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MjBBR2hvczJmeFAwLXJ2c3ZmUGlVVnVlV1M0RGQ0aFlBc3hFY0JGMlhDN2s&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=c9gd671&google_gid=CAESEB6ZY74iNZJl-NvGBtnBm5Q&google_cver=1

70 B
440 B

221ms
221ms

Image
image/gif

34.231.251.31
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=c9gd671&google_gid=CAESEB6ZY74iNZJl-NvGBtnBm5Q&google_cver=1
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 34.231.251.31 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-251-31.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/am7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:48 GMT
Content-Type: image/gif
Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=c9gd671&google_gid=CAESEB6ZY74iNZJl-NvGBtnBm5Q&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 375
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ut.js Show response
cdnquality.com/script/ Frame 1579 15 KB
5 KB 39ms
24ms Script
text/javascript 2606:4700::6811:481e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdnquality.com/script/ut.js?cb=1643385767506
Requested by: Host: cdnquality.com
URL: https://cdnquality.com/script/su.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:481e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e2778d4aa6e69d5502e588c3ee022d8b4fcd5be1c43321e8b0d7d7d70353d25

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://sportsonline.to/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1448
x-guploader-uploadid: ADPycdtXiwuEZKxlkdnF70Q7tOtirCFyY1ARugtp_YUJKherQ7TvQwvzdP49N8jymcWUQsJTqdno8YGYWhVGIsTcwdo6tQnxiw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-type: text/javascript
last-modified: Thu, 28 Oct 2021 10:36:11 GMT
server: cloudflare
etag: W/"920480645047c2b282a048acb85f9df3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=pSNYBg==, md5=kgSAZFBHwrKCoEisuF+d8w==
x-goog-generation: 1635417371100027
access-control-allow-origin: *
cache-control: public, max-age=14400
x-goog-stored-content-length: 15242
cf-ray: 6d4b72772d964bd1-YUL
expires: Fri, 28 Jan 2022 20:02:47 GMT

GET
H2 200 suurl4.php Show response
youradexchange.com/script/ Frame 1579 970 B
867 B 152ms
109ms Fetch
application/json 35.190.41.116
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://youradexchange.com/script/suurl4.php?r=4827899&cbur=0.7071958188678982&cbiframe=1&cbWidth=730&cbHeight=460&cbtitle=&cbref=&cbdescription=&cbkeywords=&cbcdn=cdnquality.com&aggr=0
Requested by: Host: cdnquality.com
URL: https://cdnquality.com/script/su.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.41.116 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 116.41.190.35.bc.googleusercontent.com
Software: openresty /
Resource Hash: e480cf06b4720198f35cf495ec817d12f3f3526b13bb1708523eaa4643445f9e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://sportsonline.to/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 28 Jan 2022 16:02:47 GMT
content-encoding: gzip
server: openresty
alt-svc: clear
via: 1.1 google
content-type: application/json; charset=utf-8

GET
H2 200 xsezbh3muyxz Show response
jl8719qvcj4pkm.njstream.net/embed/ Frame 314F 9 KB
5 KB 329ms
261ms Document
text/html 172.67.221.175
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jl8719qvcj4pkm.njstream.net/embed/xsezbh3muyxz
Requested by: Host: sportsonline.to
URL: https://sportsonline.to/channels/hd/hd7.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.221.175 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1156cf203de3026fd7d08a067c934680e96ecaa81ba6f45e9af68a60a237d992

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://sportsonline.to/

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
content-type: text/html; charset=UTF-8
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iCtLTq299yFLyHF7ETy8eEN%2BgqvNYoFr8xc73TthLxS%2FBpPgOV2cT792TSwwXIKfhhP%2F9fs7yjlGxUSMxv8zSXf5R7PlpClTFkvIjLjlONk%2FD%2Fha9dwz%2BAWQM2Sf%2BUMTo96jzD5mrsAaR6rr99Y%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6d4b72778d61e6b4-EWR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 EU Show response
onetag-geo-grouping.s-onetag.com/regionalbloc/ 1 KB
838 B 80ms
21ms Fetch
application/json 13.226.31.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://onetag-geo-grouping.s-onetag.com/regionalbloc/EU
Requested by: Host: get.s-onetag.com
URL: https://get.s-onetag.com/f0c84061-4182-4398-8e37-5ff5b5698a6f/tag.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.31.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-31-79.ewr53.r.cloudfront.net
Software: restify /
Resource Hash: 6088012dda2274a27fa40ed153d9e3a6c96a22af1b177f8a2916368eb3e88bb0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 02:55:33 GMT
content-encoding: gzip
server: restify
age: 47234
vary: Accept-Encoding,origin
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: http://to.xrivonet.info
access-control-expose-headers: api-version, content-length, content-md5, content-type, date, request-id, response-time
cache-control: max-age=86400
x-amz-cf-pop: EWR53-C2
x-amz-cf-id: PNfmMnfmhv--3-bl09B6F2yumGDiPoylSHx0vr5DpSkZmJmG-HUbyA==
via: 1.1 8e7c396366d89944c10dfabcfcb15b3c.cloudfront.net (CloudFront)

GET
H/1.1 200
OK t_.js Show response
t.sharethis.com/1.825.22807/a/CA/ Frame 8E55 20 KB
9 KB 29ms
29ms Script
text/javascript 23.192.50.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://t.sharethis.com/1.825.22807/a/CA/t_.js?cid=c010&cls=C

Requested by

Host: t.sharethis.com
URL: https://t.sharethis.com/a/t_.htm?ver=1.825.22807&cid=c010&cls=C

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.192.50.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

ec2-3-129-201-32.us-east-2.compute.amazonaws.com

Software

Resource Hash

03cc80b72954259a734b4beca35fca811c57ee695756eb84270f5e36ad6263d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=2628000 ; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://t.sharethis.com/a/t_.htm?ver=1.825.22807&cid=c010&cls=C
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=2628000 ; includeSubDomains
Content-Type: text/javascript
Cache-Control: max-age=604800
Connection: keep-alive
X-Robots-Tag: noindex, nofollow
Content-Length: 8767
Expires: Fri, 04 Feb 2022 16:02:47 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ Frame 1579 49 KB
20 KB 21ms
20ms Script
text/javascript 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-202511892-1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://sportsonline.to/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 6056
date: Fri, 28 Jan 2022 14:21:51 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Fri, 28 Jan 2022 16:21:51 GMT

POST
H/1.1 200
OK p Show response
adsco.re/ 363 B
864 B 60ms
60ms XHR
text/html 162.252.214.5
TUT-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://adsco.re/p
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Server: 162.252.214.5 , United States, ASN53334 (TUT-AS, US),
Reverse DNS
Software: /
Resource Hash: 0d2bc4d260093043593cfe87b73c9e80e90cb4e9a1aa255561e62f90f74702fa

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

AS-P-G: OK
Date: Fri, 28 Jan 2022 16:02:47 GMT
AS-P-7: OK
AS-P-9: OK
AS-P-C: OK
Transfer-Encoding: chunked
AS-P-5: OK
AS-P-F: OK
Connection: keep-alive
Content-Encoding: gzip
AS-P-2: OK
AS-P-D: OK
AS-P-6: OK
AS-P-B: OK
AS-P-H: OK
AS-P-4: OK
AS-P-A: OK
Access-Control-Max-Age: 2592000
AS-P-1: OK nyc124
Access-Control-Allow-Origin: http://to.xrivonet.info
Cache-Control: no-transform
Access-Control-Allow-Credentials: true
AS-P-8: OK
Content-Type: text/html; charset=UTF-8
AS-P-E: OK
AS-P-3: OK

GET
H3 200 analytics.js Show response
www.google-analytics.com/ Frame 7474 49 KB
20 KB 18ms
18ms Script
text/javascript 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: st.chatango.com
URL: https://st.chatango.com/h5/gz/r1101210814/id.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://st.chatango.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 6056
date: Fri, 28 Jan 2022 14:21:51 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Fri, 28 Jan 2022 16:21:51 GMT

GET
H/1.1 200
OK test_oracle Show response
pd.sharethis.com/pd/ Frame 9CE5 438 B
675 B 35ms
34ms Script
application/javascript 3.129.201.32
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://pd.sharethis.com/pd/test_oracle

Requested by

Host: t.sharethis.com
URL: https://t.sharethis.com/a/t_.htm?ver=1.825.22807&cid=c010&cls=C

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.129.201.32 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

28a6755f16df988bac82985b96143083f4916e6634104c8e4d844f7da0fb1c8d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://t.sharethis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Connection: keep-alive
X-Robots-Tag: noindex, nofollow
Content-Length: 438
Strict-Transport-Security: max-age=63072000; includeSubDomains;
Content-Type: application/javascript

GET
H/1.1

200
OK

ttd
sync.sharethis.com/ Frame 8E55
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=1h1y1a7&ttd_tpi=1&gdpr=0&gdpr_consent=
https://sync.sharethis.com/ttd?uid=dbbc26c1-e300-4981-b31d-6ed65ba41a6e&gdpr=0&gdpr_consent=

42 B
297 B

157ms
40ms

Image
image/gif

3.129.242.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.sharethis.com/ttd?uid=dbbc26c1-e300-4981-b31d-6ed65ba41a6e&gdpr=0&gdpr_consent=

Requested by

Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html

Protocol

HTTP/1.1

Server

3.129.242.122 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://t.sharethis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Strict-Transport-Security: max-age=63072000; includeSubDomains;
Connection: keep-alive
X-Robots-Tag: noindex, nofollow
Date: Fri, 28 Jan 2022 16:02:47 GMT
Content-Length: 42
Stid: ZHIABWH0E6cAAAAIGLpiAw==
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:47 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://sync.sharethis.com/ttd?uid=dbbc26c1-e300-4981-b31d-6ed65ba41a6e&gdpr=0&gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 215

GET
H/1.1

200
OK

nlsn
sync.sharethis.com/ Frame 8E55
Redirect Chain

https://loadus.exelator.com/load/?p=847&g=001&j=0&gdpr=0&gdpr_consent=
https://sync.sharethis.com/nlsn?uid=a61cb36d27e8cfc1ac00162a4ddc6f45

42 B
297 B

155ms
37ms

Image
image/gif

3.129.242.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.sharethis.com/nlsn?uid=a61cb36d27e8cfc1ac00162a4ddc6f45

Requested by

Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html

Protocol

HTTP/1.1

Server

3.129.242.122 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://t.sharethis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Strict-Transport-Security: max-age=63072000; includeSubDomains;
Connection: keep-alive
X-Robots-Tag: noindex, nofollow
Date: Fri, 28 Jan 2022 16:02:47 GMT
Content-Length: 42
Stid: ZHIABWH0E6cAAAAIGLpiAw==
Content-Type: image/gif

Redirect headers

date: Fri, 28 Jan 2022 16:02:47 GMT
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location: https://sync.sharethis.com/nlsn?uid=a61cb36d27e8cfc1ac00162a4ddc6f45
cache-control: no-cache
access-control-allow-credentials: true
content-type: image/gif
content-length: 0

GET
H/1.1

200
OK

eyeota
sync.sharethis.com/ Frame 8E55
Redirect Chain

https://ps.eyeota.net/pixel?pid=1mpb5m0&t=gif&gdpr=0&gdpr_consent=
https://ps.eyeota.net/pixel/bounce/?pid=1mpb5m0&t=gif&gdpr=0&gdpr_consent=
https://sync.sharethis.com/eyeota?uid=26NO1UMTD9kH8rso6CDHYvPxGE5wiV777pJlhDOX7TNI&gdpr=0&gdpr_consent=

42 B
297 B

39ms
38ms

Image
image/gif

3.129.242.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.sharethis.com/eyeota?uid=26NO1UMTD9kH8rso6CDHYvPxGE5wiV777pJlhDOX7TNI&gdpr=0&gdpr_consent=

Requested by

Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html

Protocol

HTTP/1.1

Server

3.129.242.122 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://t.sharethis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Strict-Transport-Security: max-age=63072000; includeSubDomains;
Connection: keep-alive
X-Robots-Tag: noindex, nofollow
Date: Fri, 28 Jan 2022 16:02:48 GMT
Content-Length: 42
Stid: ZHIABWH0E6cAAAAIGLpiAw==
Content-Type: image/gif

Redirect headers

Location: https://sync.sharethis.com/eyeota?uid=26NO1UMTD9kH8rso6CDHYvPxGE5wiV777pJlhDOX7TNI&gdpr=0&gdpr_consent=
Date: Fri, 28 Jan 2022 16:02:48 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET
H/1.1

200
OK

csync.ashx
ml314.com/ Frame 8E55
Redirect Chain

https://ml314.com/utsync.ashx?eid=50131&et=13&cid=lr&fp=ZHIABWH0E6cAAAAIGLpiAw%3D%3D&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fidsync.rlcdn.com%2F395886.gif%3Fpartner_uid%3D%5BPersonID%5D
https://idsync.rlcdn.com/395886.gif?partner_uid=3624742848256540733
https://ml314.com/csync.ashx?fp=6f0c079df43063ee32e04b69ae8fc2f743eae4bfe1c94d35898f80c98849a7e0f4cb09cee1a4f8eb&person_id=3624742848256540733&eid=50082

43 B
312 B

26ms
26ms

Image
image/gif

54.85.224.115
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=6f0c079df43063ee32e04b69ae8fc2f743eae4bfe1c94d35898f80c98849a7e0f4cb09cee1a4f8eb&person_id=3624742848256540733&eid=50082
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 54.85.224.115 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-224-115.compute-1.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://t.sharethis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Sat, 29 Jan 2022 11:02:47 GMT

Redirect headers

date: Fri, 28 Jan 2022 16:02:47 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ml314.com/csync.ashx?fp=6f0c079df43063ee32e04b69ae8fc2f743eae4bfe1c94d35898f80c98849a7e0f4cb09cee1a4f8eb&person_id=3624742848256540733&eid=50082
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

oracle
sync.sharethis.com/ Frame 8E55
Redirect Chain

https://tags.bluekai.com/site/59574?id=ZHIABWH0E6cAAAAIGLpiAw%3D%3D&redir=https%3A%2F%2Fsync.sharethis.com%2Foracle%3Fuid%3D%24_BK_UUID%26BK_SWAP_DEST%3D5957
https://sync.sharethis.com/oracle?uid=$_BK_UUID&BK_SWAP_DEST=5957

42 B
297 B

146ms
35ms

Image
image/gif

3.129.242.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.sharethis.com/oracle?uid=$_BK_UUID&BK_SWAP_DEST=5957

Requested by

Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html

Protocol

HTTP/1.1

Server

3.129.242.122 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

a104-100-135-248.deploy.static.akamaitechnologies.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://t.sharethis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Strict-Transport-Security: max-age=63072000; includeSubDomains;
Connection: keep-alive
X-Robots-Tag: noindex, nofollow
Date: Fri, 28 Jan 2022 16:02:47 GMT
Content-Length: 42
Stid: ZHIABWH0E6cAAAAIGLpiAw==
Content-Type: image/gif

Redirect headers

Location: https://sync.sharethis.com/oracle?uid=$_BK_UUID&BK_SWAP_DEST=5957
Date: Fri, 28 Jan 2022 16:02:47 GMT
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET
H2 200 dataBeacons.min.js Show response
data-beacons.s-onetag.com/ 6 KB
2 KB 97ms
17ms Script
text/javascript 54.230.162.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://data-beacons.s-onetag.com/dataBeacons.min.js
Requested by: Host: get.s-onetag.com
URL: https://get.s-onetag.com/f0c84061-4182-4398-8e37-5ff5b5698a6f/tag.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.162.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-162-76.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31e12a7a30e633b99dc01daa1c2064b8b78098f5d9cccfe3aad2d2904125a775

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: syrhL4HxyQ94RzTlcl0y8HYCMGvvMWLr
content-encoding: gzip
last-modified: Wed, 07 Jul 2021 16:31:37 GMT
server: AmazonS3
age: 2049
etag: W/"5ff42869b876a4eddafd981cab0b8818"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 29cdae592cbcdf154c4515153175497e.cloudfront.net (CloudFront)
cache-control: max-age=3600
date: Fri, 28 Jan 2022 15:28:39 GMT
x-amz-cf-pop: EWR53-C3
x-amz-cf-id: BLYFI1LlfnS9K52i7TSfB9xPedJpvxplCw8Eww2hkEQ4nxJOHMPdKQ==

GET
H/1.1 200
OK gprofile.xml Show response
ust.chatango.com/groupinfo/r/i/rivosport/ Frame 7474 46 B
351 B 552ms
81ms XHR
text/xml 208.93.230.28
CHATANGO

General

Check archive.org

Show headers Download Go to

Full URL: https://ust.chatango.com/groupinfo/r/i/rivosport/gprofile.xml
Requested by: Host: st.chatango.com
URL: https://st.chatango.com/h5/gz/r1101210814/id.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.93.230.28 , United States, ASN29893 (CHATANGO, US),
Reverse DNS
Software: nginx /
Resource Hash: 2bf0b59a7518f8b73db880ecb0e510763231b2a8ef3a789504c9ab98e549904a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://st.chatango.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:48 GMT
Last-Modified: Sun, 25 Aug 2013 07:09:52 GMT
Server: nginx
Content-Type: text/xml
Access-Control-Allow-Origin: *
Cache-Control: max-age=0
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 46
Expires: Fri, 28 Jan 2022 16:02:48 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16311/ Frame F52F 23 KB
8 KB 18ms
17ms Script
text/javascript 54.230.162.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16311/sync.min.js
Requested by: Host: cdn-tc.33across.com
URL: https://cdn-tc.33across.com/lotame-sync.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.162.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-162-121.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5640e2177d8a24c6aef1d923c981591689205237b9c2fcba5215d10aa7bcf52e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn-tc.33across.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Fri, 28 Jan 2022 04:30:36 GMT
content-encoding: gzip
last-modified: Tue, 23 Nov 2021 20:35:46 GMT
server: AmazonS3
age: 41532
etag: W/"01cacbace375528e9789d3b3ed3804c2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 e3fb879a67c14c7a96059b2b777ccbc8.cloudfront.net (CloudFront)
cache-control: max-age: 86400
x-amz-cf-pop: EWR53-C3
x-amz-cf-id: 1hPSXmOHXh9BU2gL1zVThbT90JjR92CbYluc8AkH1UFyq7yYgVk6kg==

GET
H/1.1 200
OK bk-coretag.js Show response
tags.bkrtx.com/js/ Frame 9CE5 51 KB
16 KB 173ms
38ms Script
application/javascript 104.100.135.248
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tags.bkrtx.com/js/bk-coretag.js

Requested by

Host: pd.sharethis.com
URL: https://pd.sharethis.com/pd/test_oracle

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.100.135.248 Lithia Springs, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx/1.15.8 /

Resource Hash

88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://t.sharethis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15724800; includeSubDomains
Content-Encoding: gzip
Last-Modified: Fri, 21 May 2021 19:14:21 GMT
Server: nginx/1.15.8
ETag: W/"60a8068d-cbc2"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=604800
Date: Fri, 28 Jan 2022 16:02:47 GMT
Connection: keep-alive
Content-Length: 16078
Expires: Fri, 04 Feb 2022 16:02:47 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ Frame F52F 423 B
1 KB 132ms
70ms XHR
application/json 54.89.1.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16311/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.89.1.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-89-1-168.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 28d09a51a6b174c7eb87c24a5c4e65e46f2c29b8754d5de1d1a2e1e3f391b898

Request headers

Referer: https://cdn-tc.33across.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:47 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://cdn-tc.33across.com
cache-control: no-cache
x-server: 10.40.35.242
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 423
expires: 0

GET
H/1.1

200
OK

v2 Show response
ap.lijit.com/readerinfo/
Redirect Chain

https://ap.lijit.com/readerinfo/v2
https://ap.lijit.com/readerinfo/v2?sovrn_retry=true

41 B
463 B

63ms
20ms

Fetch
application/json

23.92.190.69
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/readerinfo/v2?sovrn_retry=true
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 23.92.190.69 , United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: /
Resource Hash: 17b5304a0dc8a2abfaf242ef9b6d22e20c0c9f5da97211511355a8a735f93351

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: http://to.xrivonet.info
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 61

Redirect headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Access-Control-Allow-Origin: http://to.xrivonet.info
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://ap.lijit.com/readerinfo/v2?sovrn_retry=true
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap3ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H/1.1

200
OK

v2 Show response
ap.lijit.com/readerinfo/
Redirect Chain

https://ap.lijit.com/readerinfo/v2
https://ap.lijit.com/readerinfo/v2?sovrn_retry=true

41 B
463 B

64ms
22ms

Fetch
application/json

23.92.190.69
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/readerinfo/v2?sovrn_retry=true
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 23.92.190.69 , United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: /
Resource Hash: 17b5304a0dc8a2abfaf242ef9b6d22e20c0c9f5da97211511355a8a735f93351

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: http://to.xrivonet.info
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 61

Redirect headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Access-Control-Allow-Origin: http://to.xrivonet.info
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://ap.lijit.com/readerinfo/v2?sovrn_retry=true
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap3ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H/1.1

200
OK

v2 Show response
ap.lijit.com/readerinfo/
Redirect Chain

https://ap.lijit.com/readerinfo/v2
https://ap.lijit.com/readerinfo/v2?sovrn_retry=true

41 B
463 B

64ms
21ms

Fetch
application/json

23.92.190.69
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/readerinfo/v2?sovrn_retry=true
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 23.92.190.69 , United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: /
Resource Hash: 17b5304a0dc8a2abfaf242ef9b6d22e20c0c9f5da97211511355a8a735f93351

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: http://to.xrivonet.info
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 61

Redirect headers

Date: Fri, 28 Jan 2022 16:02:47 GMT
Access-Control-Allow-Origin: http://to.xrivonet.info
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://ap.lijit.com/readerinfo/v2?sovrn_retry=true
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap3ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H/1.1 200
OK c Show response
serve.popads.net/ 44 B
277 B 127ms
79ms Script
text/javascript 216.21.13.16
TUT-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://serve.popads.net/c?_=BAoAYfQTpwFh9BOngAGBAsAAIH3SZsErL7C2g1O6IQgCp-IsANndgQ7J_7u0PlPJKvwowQBHMEUCIQDRHMoTJpm0G8v4A7Mu0bidb0a_CHO5hYqml5VZberz5QIgYZf_dvlGXN0QaLvOYSbMj9dTNdf0oqt5JB4qd59P69zCACAwD3GQO_lcZxScHcGZp_QR3SYfPsvwS8YJnepe6rNFlcQAECYHUwAAYHhnAAAAAAAAABPFABDJEel05iYOFIpbsgcdO36EwwBHMEUCIHJFK3LTetEZ7F42933IbfpvPaRkkavh-hUYyrmWpFBCAiEA2ThYg_5N6zCpapQ4MCLbIfOc3bV9Mva0LXVpdUNe98Q&v=4&siteId=2082502&minBid=&popundersPerIP=0,0&blockedCountries=&documentRef=&s=1600,1200,1,1600,1200,0
Requested by: Host: c1.popads.net
URL: http://c1.popads.net/pop.js
Protocol: HTTP/1.1
Server: 216.21.13.16 , United States, ASN53334 (TUT-AS, US),
Reverse DNS
Software: /
Resource Hash: 9d781128a8ece413b003d5612b8398bf9340ef7f5b751d12bd125ba523d3ceb5

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
asf: 9
access-control-allow-origin: *
content-type: text/javascript;charset=UTF-8
popads-ec: ASB
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-length: 44

GET
H3 200 embed.min.css
jl8719qvcj4pkm.njstream.net/css/ Frame 314F 1 KB
1 KB 78ms
27ms Stylesheet
text/css 172.67.221.175
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jl8719qvcj4pkm.njstream.net/css/embed.min.css?v=0.3
Requested by: Host: jl8719qvcj4pkm.njstream.net
URL: https://jl8719qvcj4pkm.njstream.net/embed/xsezbh3muyxz
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.221.175 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d2556e6fe39f0adea7f7b90515e482645f702c89ff7206bae2514daed52b397

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://jl8719qvcj4pkm.njstream.net/embed/xsezbh3muyxz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 09 Nov 2020 18:05:02 GMT
server: cloudflare
age: 86
etag: W/"5fa984ce-484"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DRE75ml9TbqENQUuVcx36aRDgqwOgFd9mboun%2BFIxBDPSkcTk7OZm%2FD%2BbykI8TfHFvPT16NFf42HE5%2F%2BM%2FTH0shTN5srJlYI5aLPDcElhnqdMsVPpVjmXGs8ZvVO760vDOIyh83IwdB9VyPttiI%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6d4b7279cda70cd5-EWR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 jquery.min.js Show response
jl8719qvcj4pkm.njstream.net/js/ Frame 314F 85 KB
31 KB 85ms
35ms Script
application/javascript 172.67.221.175
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jl8719qvcj4pkm.njstream.net/js/jquery.min.js
Requested by: Host: jl8719qvcj4pkm.njstream.net
URL: https://jl8719qvcj4pkm.njstream.net/embed/xsezbh3muyxz
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.221.175 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://jl8719qvcj4pkm.njstream.net/embed/xsezbh3muyxz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 09 Nov 2020 18:05:02 GMT
server: cloudflare
age: 74
etag: W/"5fa984ce-15283"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6%2FAEbj8PoPdqG4ZxOHzPsD9oU6Oc%2BL5KiIh3VpJ7YIHKShPVSQIH6iWzRmjouIphkqHj5WwfQtDxqYBlx659i1dNBjB5Vn%2BtElr2yO4hBoDH7J8F4vCh6bhzwoBbAezZVIeNdUlB8ZFB6ONUXR4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6d4b7279cda80cd5-EWR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 wigistream.js Show response
swarm.video/ Frame 314F 506 KB
128 KB 101ms
42ms Script
application/javascript 2606:4700:3031::6815:33a1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://swarm.video/wigistream.js?version=0.0.80
Requested by: Host: jl8719qvcj4pkm.njstream.net
URL: https://jl8719qvcj4pkm.njstream.net/embed/xsezbh3muyxz
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:33a1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 0e8714e1c7ce6159f6bff5085163212294c59e411ed4b10ad956ae0b2800d03d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://jl8719qvcj4pkm.njstream.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 226762
x-powered-by: Express
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 28 Jun 2021 22:53:39 GMT
server: cloudflare
etag: W/"7ee26-17a54d407d3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QY3gVhaSxagW8lix0K%2FNlNr6svsd1GI7DQO5Z3ehWyaCOXWt6i0PFZzFjyMTk7YfnhXMi16ZJmuhlX4jn0ygo3g9D6R8ZEfGnIXGHqItD8wi9%2FE87vc2%2F2cuuS%2FzmSqwMSBaGKkYFkl09g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000
cf-polished: origSize=519718
cf-ray: 6d4b7279da004bd6-YUL
cf-bgj: minify

GET
H2 200 clappr.min.js Show response
cdn.jsdelivr.net/npm/clappr@latest/dist/ Frame 314F 513 KB
139 KB 93ms
42ms Script
application/javascript 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/clappr@latest/dist/clappr.min.js

Requested by

Host: jl8719qvcj4pkm.njstream.net
URL: https://jl8719qvcj4pkm.njstream.net/embed/xsezbh3muyxz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db7ce4b1edd2c3701c3f2585f7cbd70857173195489a99703ab39de16fa45b6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://jl8719qvcj4pkm.njstream.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 12604
x-jsd-version: 0.3.13
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19128-FRA, cache-yyz4561-YYZ
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"80319-k2KF+cjIWnSaHvjPxNXoS36ivIk"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 6d4b7279c9f54bd6-YUL

GET
H2 200 su.js Show response
cdnquality.com/script/ Frame 314F 24 KB
7 KB 37ms
33ms Script
text/javascript 2606:4700::6811:481e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdnquality.com/script/su.js
Requested by: Host: jl8719qvcj4pkm.njstream.net
URL: https://jl8719qvcj4pkm.njstream.net/embed/xsezbh3muyxz
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:481e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c0a97a9799bba7cbaca2ff35b43daaef3ac0c679ba39a90df166c39aad65bea3

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://jl8719qvcj4pkm.njstream.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 517
x-guploader-uploadid: ADPycdvVO27XuYoeZ9xBphnspOZmoEu1sTZywr6g7-8Aj-lzxT9KmML-0r4zbbS9i6c67NcJgTIt-T7zo0e2uDClei0diE9fug
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-type: text/javascript
last-modified: Thu, 28 Oct 2021 10:36:10 GMT
server: cloudflare
etag: W/"765a50e18db5bdc3badf43040834c22a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=ZIf5+A==, md5=dlpQ4Y21vcO630MECDTCKg==
x-goog-generation: 1635417370397478
access-control-allow-origin: *
cache-control: public, max-age=14400
x-goog-stored-content-length: 24244
cf-ray: 6d4b72798a4d4bd1-YUL
expires: Fri, 28 Jan 2022 20:02:47 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 314F 90 KB
35 KB 43ms
40ms Script
application/javascript 2607:f8b0:4006:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-184968220-1

Requested by

Host: jl8719qvcj4pkm.njstream.net
URL: https://jl8719qvcj4pkm.njstream.net/embed/xsezbh3muyxz

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

86c4bdc1e2a2b58b3480bead4410df29fedb9f6ec9c6eb5b82a4fa75188fc551

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://jl8719qvcj4pkm.njstream.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36114
x-xss-protection: 0
last-modified: Fri, 28 Jan 2022 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 28 Jan 2022 16:02:47 GMT

GET
H2

200

/
widgets.amung.us/draw/ Frame 314F
Redirect Chain

https://whos.amung.us/cwidget/y7opzyrraw/000000ffffff.png
https://widgets.amung.us/draw/?w=colored&n=3710&c=000000ffffff&p=

2 KB
2 KB

24ms
24ms

Image
image/png

2606:4700:10::6816:4aab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.amung.us/draw/?w=colored&n=3710&c=000000ffffff&p=
Requested by: Host: jl8719qvcj4pkm.njstream.net
URL: https://jl8719qvcj4pkm.njstream.net/embed/xsezbh3muyxz
Protocol: H2
Server: 2606:4700:10::6816:4aab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca9ac545f21288ac2529efe377574e6c630e5375d405f4d07129f2b20ad1d6b8

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://jl8719qvcj4pkm.njstream.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:47 GMT
cf-cache-status: HIT
last-modified: Thu, 27 Jan 2022 12:06:25 GMT
server: cloudflare
age: 100582
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=432000
content-disposition: filename=wau-widget.png
cf-ray: 6d4b7279c9e14bd0-YUL
expires: Fri, 28 Jan 2022 12:06:25 GMT

Redirect headers

location: https://widgets.amung.us/draw/?w=colored&n=3710&c=000000ffffff&p=
date: Fri, 28 Jan 2022 16:02:47 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8

GET
H/1.1

200
OK

merge
ce.lijit.com/
Redirect Chain

https://um.simpli.fi/lj_match?r=53600
https://ce.lijit.com/merge?pid=2&3pid=5EEB6C5CE7194E90B17CA488D4E3BA96

43 B
670 B

61ms
19ms

Image
image/gif

23.92.190.69
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=5EEB6C5CE7194E90B17CA488D4E3BA96
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 23.92.190.69 , United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 28 Jan 2022 16:02:48 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date: Fri, 28 Jan 2022 16:02:48 GMT
x-content-type-options: nosniff
server: nginx
location: https://ce.lijit.com/merge?pid=2&3pid=5EEB6C5CE7194E90B17CA488D4E3BA96
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Thu, 27 Jan 2022 16:02:48 GMT

GET
H/1.1

200
OK

sync
x.bidswitch.net/ul_cb/
Redirect Chain

https://i.liadm.com/s/57333?bidder_id=204553&bidder_uuid=a0f6d2235356c54a5a74190b
https://i.liadm.com/s/57333?bidder_id=204553&bidder_uuid=a0f6d2235356c54a5a74190b&_li_chk=true&previous_uuid=bd7dbf9b649643d590977c27bf11e43a
https://x.bidswitch.net/sync?dsp_id=42&user_id=
https://x.bidswitch.net/ul_cb/sync?dsp_id=42&user_id=

43 B
510 B

35ms
35ms

Image
image/gif

35.211.178.172
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?dsp_id=42&user_id=
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 35.211.178.172 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 172.178.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:48 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Location: https://x.bidswitch.net/ul_cb/sync?dsp_id=42&user_id=
Date: Fri, 28 Jan 2022 16:02:48 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

59074
i6.liadm.com/s/
Redirect Chain

https://i.liadm.com/s/59074?bidder_id=204553&bidder_uuid=a0f6d2235356c54a5a74190b
https://i.liadm.com/s/59074?bidder_id=204553&bidder_uuid=a0f6d2235356c54a5a74190b&_li_chk=true&previous_uuid=906d9691d81d42549e0e96d90e6a8793
https://i6.liadm.com/s/59074?bidder_id=204553&bidder_uuid=a0f6d2235356c54a5a74190b

43 B
419 B

79ms
26ms

Image
image/gif

2600:1f18:444a:4602:9c05:7f25:f6a5:7205
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i6.liadm.com/s/59074?bidder_id=204553&bidder_uuid=a0f6d2235356c54a5a74190b

Requested by

Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html

Protocol

HTTP/1.1

Server

2600:1f18:444a:4602:9c05:7f25:f6a5:7205 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:48 GMT
Cache-Control: no-store
Connection: keep-alive
Content-Length: 43
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/gif

Redirect headers

Location: https://i6.liadm.com/s/59074?bidder_id=204553&bidder_uuid=a0f6d2235356c54a5a74190b
Date: Fri, 28 Jan 2022 16:02:47 GMT
Connection: keep-alive
Content-Length: 0
Strict-Transport-Security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

merge
ce.lijit.com/
Redirect Chain

https://p.adsymptotic.com/d/px/?_pid=15697&_psign=0a885fb568701ac53478d88866a10345&_pu&_puuid=a0f6d2235356c54a5a74190b&_redirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D5014%263pid%3D${UUID}&_ra...
https://p.adsymptotic.com/d/px/?_pid=15697&_psign=0a885fb568701ac53478d88866a10345&_pu&_puuid=a0f6d2235356c54a5a74190b&_redirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D5014%263pid%3D${UUID}&_ra...
https://ce.lijit.com/merge?pid=5014&3pid=4f08a20a7462d74dfb47202c600d3a00

43 B
673 B

61ms
20ms

Image
image/gif

23.92.190.69
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=5014&3pid=4f08a20a7462d74dfb47202c600d3a00
Requested by: Host: to.xrivonet.info
URL: http://to.xrivonet.info/am7.html
Protocol: HTTP/1.1
Server: 23.92.190.69 , United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 28 Jan 2022 16:02:48 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date: Fri, 28 Jan 2022 16:02:48 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP='NON DSP COR CONi OUR BUS CNT'
location: https://ce.lijit.com/merge?pid=5014&3pid=4f08a20a7462d74dfb47202c600d3a00
cf-ray: 6d4b727a6afb3fdf-YYZ
content-length: 0

GET
H2 204 ProfilesEngineServlet
api.intentiq.com/profiles_engine/ Frame CE6A 0
0 96ms
27ms Document
text/plain 13.226.31.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=15&eid=19&aw=468&ah=60&pagePos=1&vip=true&secure=1&sub_eid=15052&maxed=1&rnd=25094
Requested by: Host: data-beacons.s-onetag.com
URL: https://data-beacons.s-onetag.com/dataBeacons.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.31.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-31-87.ewr53.r.cloudfront.net
Software: Apache-Coyote/1.1 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/

Response headers

date: Fri, 28 Jan 2022 16:02:48 GMT
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
x-cache: Miss from cloudfront
via: 1.1 2755a65ada03bcb40dcec9e77a7c9160.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C2
x-amz-cf-id: Jas4yjpQ1prMio2SbWxZBI9D4pD65IKxpB10XVEdITyLLuyRLgfYTA==

GET
H/1.1 200
OK 59574 Show response
stags.bluekai.com/site/ Frame F9EF 753 B
1 KB 133ms
84ms Document
text/html 173.223.56.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://stags.bluekai.com/site/59574?ret=html&phint=id%3DZHIABWH0E6cAAAAIGLpiAw%3D%3D&phint=__bk_k%3D&phint=__bk_l%3Dhttps%3A%2F%2Ft.sharethis.com%2Fa%2Ft_.htm%3Fver%3D1.825.22807%26cid%3Dc010%26cls%3DC&phint=__bk_v%3D3.1.10&limit=5&r=18429853
Requested by: Host: tags.bkrtx.com
URL: https://tags.bkrtx.com/js/bk-coretag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 173.223.56.123 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a173-223-56-123.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 097ef117f92e4ead19e789323c55eb34e9d838c0af08c879bc250b1ec077fa21

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://t.sharethis.com/

Response headers

Content-Type: text/html
Content-Length: 753
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Date: Fri, 28 Jan 2022 16:02:48 GMT
Connection: keep-alive

GET
H2 200 css
fonts.googleapis.com/ Frame 314F 1 KB
898 B 95ms
42ms Stylesheet
text/css 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:400,700

Requested by

Host: jl8719qvcj4pkm.njstream.net
URL: https://jl8719qvcj4pkm.njstream.net/css/embed.min.css?v=0.3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e05625072af3c4d3ca3bcef620cecc11cad888a0441600f3c43d04c3334d2c64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://jl8719qvcj4pkm.njstream.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 28 Jan 2022 14:17:56 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 28 Jan 2022 16:02:48 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 28 Jan 2022 16:02:48 GMT

GET
H2 200 ut.js Show response
cdnquality.com/script/ Frame 314F 15 KB
5 KB 35ms
33ms Script
text/javascript 2606:4700::6811:481e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdnquality.com/script/ut.js?cb=1643385768181
Requested by: Host: cdnquality.com
URL: https://cdnquality.com/script/su.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:481e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e2778d4aa6e69d5502e588c3ee022d8b4fcd5be1c43321e8b0d7d7d70353d25

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://jl8719qvcj4pkm.njstream.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:48 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1449
x-guploader-uploadid: ADPycdtXiwuEZKxlkdnF70Q7tOtirCFyY1ARugtp_YUJKherQ7TvQwvzdP49N8jymcWUQsJTqdno8YGYWhVGIsTcwdo6tQnxiw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-type: text/javascript
last-modified: Thu, 28 Oct 2021 10:36:11 GMT
server: cloudflare
etag: W/"920480645047c2b282a048acb85f9df3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=pSNYBg==, md5=kgSAZFBHwrKCoEisuF+d8w==
x-goog-generation: 1635417371100027
access-control-allow-origin: *
cache-control: public, max-age=14400
x-goog-stored-content-length: 15242
cf-ray: 6d4b727b3e3b4bd1-YUL
expires: Fri, 28 Jan 2022 20:02:48 GMT

GET
H2 200 suurl4.php Show response
youradexchange.com/script/ Frame 314F 986 B
823 B 101ms
100ms Fetch
application/json 35.190.41.116
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://youradexchange.com/script/suurl4.php?r=3939411&cbur=0.3829854465246907&cbiframe=1&cbWidth=730&cbHeight=460&cbtitle=&cbref=&cbdescription=&cbkeywords=&cbcdn=cdnquality.com&aggr=0
Requested by: Host: cdnquality.com
URL: https://cdnquality.com/script/su.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.41.116 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 116.41.190.35.bc.googleusercontent.com
Software: openresty /
Resource Hash: a431ec820e04d986181367c0a337b64e0547e6fa1c7645ad01e45f085758a35b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://jl8719qvcj4pkm.njstream.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 28 Jan 2022 16:02:48 GMT
content-encoding: gzip
server: openresty
alt-svc: clear
via: 1.1 google
content-type: application/json; charset=utf-8

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v22/ Frame 314F 23 KB
23 KB 68ms
20ms Font
font/woff2 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v22/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://jl8719qvcj4pkm.njstream.net
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 19:30:05 GMT
x-content-type-options: nosniff
age: 160363
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23040
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 19:21:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 26 Jan 2023 19:30:05 GMT

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v22/ Frame 314F 23 KB
23 KB 87ms
39ms Font
font/woff2 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v22/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://jl8719qvcj4pkm.njstream.net
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 19:30:02 GMT
x-content-type-options: nosniff
age: 160366
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23580
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 19:14:03 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 26 Jan 2023 19:30:02 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ Frame 314F 49 KB
20 KB 19ms
18ms Script
text/javascript 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-184968220-1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://jl8719qvcj4pkm.njstream.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 6057
date: Fri, 28 Jan 2022 14:21:51 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Fri, 28 Jan 2022 16:21:51 GMT

GET
H/1.1

200
OK

4413
tags.bluekai.com/site/ Frame F9EF
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
https://tags.bluekai.com/site/5386?id=dbbc26c1-e300-4981-b31d-6ed65ba41a6e&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/upi/pid/2j4ke5f0?redir=https%3A%2F%2Ftags.bluekai.com%2Fsite%2F4413%3Fid%3D%24%7BUSER_ID%7D&r=123
https://sync-tm.everesttech.net/ct/upi/pid/2j4ke5f0?redir=https%3A%2F%2Ftags.bluekai.com%2Fsite%2F4413%3Fid%3D%24%7BUSER_ID%7D&r=123&_test=YfQTqAAB_be8rgBB
https://tags.bluekai.com/site/4413?id=YfQTqAAB_be8rgBB&r=123&_test=YfQTqAAB_be8rgBB

62 B
421 B

153ms
152ms

Image
image/gif

173.223.56.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/4413?id=YfQTqAAB_be8rgBB&r=123&_test=YfQTqAAB_be8rgBB
Requested by: Host: stags.bluekai.com
URL: https://stags.bluekai.com/site/59574?ret=html&phint=id%3DZHIABWH0E6cAAAAIGLpiAw%3D%3D&phint=__bk_k%3D&phint=__bk_l%3Dhttps%3A%2F%2Ft.sharethis.com%2Fa%2Ft_.htm%3Fver%3D1.825.22807%26cid%3Dc010%26cls%3DC&phint=__bk_v%3D3.1.10&limit=5&r=18429853
Protocol: HTTP/1.1
Server: 173.223.56.123 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a173-223-56-123.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://stags.bluekai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:48 GMT
Connection: keep-alive
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Content-Length: 62
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:48 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1643385768.446327,VS0,VE0
x-served-by: cache-yul12834-YUL
x-cache: HIT
location: https://tags.bluekai.com/site/4413?id=YfQTqAAB_be8rgBB&r=123&_test=YfQTqAAB_be8rgBB
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

2981
tags.bluekai.com/site/ Frame F9EF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=bluekai&google_cm&google_sc&google_hm=QitheUIyb1E5OTlZc3dIQw%3D%3D
https://tags.bluekai.com/site/2981?id=&google_gid=CAESEOeTT_u2Sq5B0LF3ASh-tWk&google_cver=1

62 B
770 B

154ms
154ms

Image
image/gif

173.223.56.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/2981?id=&google_gid=CAESEOeTT_u2Sq5B0LF3ASh-tWk&google_cver=1
Requested by: Host: stags.bluekai.com
URL: https://stags.bluekai.com/site/59574?ret=html&phint=id%3DZHIABWH0E6cAAAAIGLpiAw%3D%3D&phint=__bk_k%3D&phint=__bk_l%3Dhttps%3A%2F%2Ft.sharethis.com%2Fa%2Ft_.htm%3Fver%3D1.825.22807%26cid%3Dc010%26cls%3DC&phint=__bk_v%3D3.1.10&limit=5&r=18429853
Protocol: HTTP/1.1
Server: 173.223.56.123 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a173-223-56-123.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://stags.bluekai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 28 Jan 2022 16:02:48 GMT
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 62
BK-Server: a433
Expires: Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://tags.bluekai.com/site/2981?id=&google_gid=CAESEOeTT_u2Sq5B0LF3ASh-tWk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 296
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

19505
tags.bluekai.com/site/ Frame F9EF
Redirect Chain

https://cms.analytics.yahoo.com/cms?partner_id=BLKAI
https://tags.bluekai.com/site/19505?id=y-GrU7UJ9E2pL9Mim9gtS6xQSiE3OnxbVoufc-~A

62 B
495 B

92ms
91ms

Image
image/gif

173.223.56.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/19505?id=y-GrU7UJ9E2pL9Mim9gtS6xQSiE3OnxbVoufc-~A
Requested by: Host: stags.bluekai.com
URL: https://stags.bluekai.com/site/59574?ret=html&phint=id%3DZHIABWH0E6cAAAAIGLpiAw%3D%3D&phint=__bk_k%3D&phint=__bk_l%3Dhttps%3A%2F%2Ft.sharethis.com%2Fa%2Ft_.htm%3Fver%3D1.825.22807%26cid%3Dc010%26cls%3DC&phint=__bk_v%3D3.1.10&limit=5&r=18429853
Protocol: HTTP/1.1
Server: 173.223.56.123 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a173-223-56-123.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://stags.bluekai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:48 GMT
Connection: keep-alive
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Content-Length: 62
Content-Type: image/gif

Redirect headers

date: Fri, 28 Jan 2022 16:02:48 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: text/html;charset=utf-8
location: https://tags.bluekai.com/site/19505?id=y-GrU7UJ9E2pL9Mim9gtS6xQSiE3OnxbVoufc-~A
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000
content-length: 0
x-content-type-options: nosniff

GET
H/1.1

200
OK

4448
stags.bluekai.com/site/ Frame F9EF
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=10002&redir=https%3A%2F%2Fstags.bluekai.com%2Fsite%2F4448%3Fid%3D%5BMM_UUID%5D
https://stags.bluekai.com/site/4448?id=c24861f4-13a8-4300-8d9b-7c1b6b2fe07a

62 B
495 B

107ms
107ms

Image
image/gif

173.223.56.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stags.bluekai.com/site/4448?id=c24861f4-13a8-4300-8d9b-7c1b6b2fe07a
Requested by: Host: stags.bluekai.com
URL: https://stags.bluekai.com/site/59574?ret=html&phint=id%3DZHIABWH0E6cAAAAIGLpiAw%3D%3D&phint=__bk_k%3D&phint=__bk_l%3Dhttps%3A%2F%2Ft.sharethis.com%2Fa%2Ft_.htm%3Fver%3D1.825.22807%26cid%3Dc010%26cls%3DC&phint=__bk_v%3D3.1.10&limit=5&r=18429853
Protocol: HTTP/1.1
Server: 173.223.56.123 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a173-223-56-123.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://stags.bluekai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:48 GMT
Connection: keep-alive
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Content-Length: 62
Content-Type: image/gif

Redirect headers

Date: Fri, 28 Jan 2022 16:02:48 GMT
Server: MT3 4133 baa842e master iad-pixel-x22 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://stags.bluekai.com/site/4448?id=c24861f4-13a8-4300-8d9b-7c1b6b2fe07a
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 28 Jan 2022 16:02:47 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame F9EF
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=825dc896-34e2-49b2-8823-60c90dd536b1&id=KNPyB84A99Ow7wHC&cb=1436305485
https://s.amazon-adsystem.com/dcm?pid=825dc896-34e2-49b2-8823-60c90dd536b1&id=KNPyB84A99Ow7wHC&cb=1436305485&dcc=t

43 B
932 B

45ms
44ms

Image
image/gif

209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=825dc896-34e2-49b2-8823-60c90dd536b1&id=KNPyB84A99Ow7wHC&cb=1436305485&dcc=t

Requested by

Host: stags.bluekai.com
URL: https://stags.bluekai.com/site/59574?ret=html&phint=id%3DZHIABWH0E6cAAAAIGLpiAw%3D%3D&phint=__bk_k%3D&phint=__bk_l%3Dhttps%3A%2F%2Ft.sharethis.com%2Fa%2Ft_.htm%3Fver%3D1.825.22807%26cid%3Dc010%26cls%3DC&phint=__bk_v%3D3.1.10&limit=5&r=18429853

Protocol

HTTP/1.1

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://stags.bluekai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 28 Jan 2022 16:02:48 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: SNKVC6EHVRBGYDS0NB7K
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 28 Jan 2022 16:02:48 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 6M5GP39PNDC2056ZYJEC
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=825dc896-34e2-49b2-8823-60c90dd536b1&id=KNPyB84A99Ow7wHC&cb=1436305485&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 optimus_rules.json Show response
tags.crwdcntrl.net/lt/c/3825/ 4 KB
1 KB 58ms
20ms XHR
application/json 54.230.162.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/3825/optimus_rules.json
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/3825/lt.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.162.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-162-121.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9933d7066a22669cd5d48d0051aa5f2d7ea91bad0a9223f3d7884e93c3ca8a28

Request headers

Referer: http://to.xrivonet.info/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 27 Jan 2022 21:10:27 GMT
content-encoding: gzip
age: 67942
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Mon, 10 Jan 2022 15:33:32 GMT
server: AmazonS3
etag: W/"6db43f44304c37d76768275ee4f01ba4"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
via: 1.1 2435a43ad9e6173e7352a49a09dd01b0.cloudfront.net (CloudFront)
cache-control: max-age: 86400
x-amz-cf-pop: EWR53-C3
x-amz-cf-id: mDJTdfKnn_KqxIKzLnpeI6lUjU0FRtmjfaK0zyJEMGqIoeaqG0Rduw==

POST
H2 200 data Show response
bcp.crwdcntrl.net/6/ 235 B
1 KB 78ms
78ms XHR
application/json 54.89.1.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/data
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/3825/lt.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.89.1.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-89-1-168.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 08959153bb4bc50a143fa51197c50ac969c94041691ef23b38e4e825019a09a6

Request headers

Referer: http://to.xrivonet.info/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:48 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: http://to.xrivonet.info
cache-control: no-cache
x-server: 10.40.14.201
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 235
expires: 0

GET
H2 200 lt.iframe.html Show response
tags.crwdcntrl.net/lt/shared/2/ Frame 9BCA 2 KB
1 KB 23ms
23ms Document
text/html 54.230.162.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/shared/2/lt.iframe.html?c=3825
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/3825/lt.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.162.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-162-121.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 63cf7a38baaaaebc012cfc355797544949b60c040b5da57560f26d88502d1372

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: http://to.xrivonet.info/

Response headers

content-type: text/html
date: Fri, 28 Jan 2022 12:59:45 GMT
last-modified: Mon, 01 Feb 2021 20:35:17 GMT
etag: W/"6fcf4f5197ab24c92d090f6ac8d87e01"
x-amz-server-side-encryption: AES256
cache-control: max-age: 86400
server: AmazonS3
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 e3fb879a67c14c7a96059b2b777ccbc8.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C3
x-amz-cf-id: ebN8WsyHQkyKBWc39hbswhIQsdZJWlNPAg7Vm_YQXfI2mf7g8OMVXA==
age: 10984

GET
H2 200 pixels Show response
bcp.crwdcntrl.net/ Frame 10A9 3 KB
3 KB 24ms
24ms Document
text/html 54.89.1.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/shared/2/lt.iframe.html?c=3825
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.89.1.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-89-1-168.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: da0c506402ad61096ca05b596e705e9173f3f4b41d977c1658277720cc632fda

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://tags.crwdcntrl.net/

Response headers

date: Fri, 28 Jan 2022 16:02:48 GMT
content-type: text/html
content-length: 3209
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
cache-control: no-cache
pragma: no-cache
expires: 0
x-server: 10.40.4.211
server: Jetty(9.4.38.v20210224)

GET
H2

200

gdpr_consent=
sync.crwdcntrl.net/map/c=10620/tp=TRAD/tpid=dbbc26c1-e300-4981-b31d-6ed65ba41a6e/gdpr=0/ Frame 10A9
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=lotame&ttd_tpi=1&gdpr=0
https://sync.crwdcntrl.net/map/c=10620/tp=TRAD/tpid=dbbc26c1-e300-4981-b31d-6ed65ba41a6e/gdpr=0/gdpr_consent=

49 B
266 B

81ms
28ms

Image
image/gif

52.4.54.89
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=10620/tp=TRAD/tpid=dbbc26c1-e300-4981-b31d-6ed65ba41a6e/gdpr=0/gdpr_consent=
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Protocol: H2
Server: 52.4.54.89 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-54-89.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:48 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.47.154
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:48 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://sync.crwdcntrl.net/map/c=10620/tp=TRAD/tpid=dbbc26c1-e300-4981-b31d-6ed65ba41a6e/gdpr=0/gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 249

GET
H/1.1 200
OK ltm
audex.userreport.com/sync/put/ Frame 10A9 43 B
433 B 167ms
117ms Image
image/gif 13.226.31.11
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://audex.userreport.com/sync/put/ltm?ltmid=bfdd2a8c33d4e2b6c8fe6a6b0cc2b448
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.31.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-31-11.ewr53.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:48 GMT
Via: 1.1 96d147941ae6bca8fe66457104d07bb6.cloudfront.net (CloudFront)
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx/1.18.0
X-Amz-Cf-Pop: EWR53-C2
X-Cache: Miss from cloudfront
Content-Type: image/gif
Connection: keep-alive
Content-Length: 43
X-Amz-Cf-Id: S-LMmMWyVQSnFyHWyQrgyj-dXL3JSxPEL8d-cw-LmfLh_t3IJX3pmQ==

GET
H2

200

tpid=d5a576c2-c8e3-4a42-9390-f757b648aaf1
sync.crwdcntrl.net/map/c=10158/tp=TPAD/ Frame 10A9
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=LOTAME&partner_device_id=bfdd2a8c33d4e2b6c8fe6a6b0cc2b448&gdpr=0&partner_url=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D10158%2Ftp%3DTPAD%2Ftp...
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3Dd5a576c2-c8e3-4a42-9390-f757b648aaf1%252Chttps%253A...
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=8396142445851402393&pt=d5a576c2-c8e3-4a42-9390-f757b648aaf1%2Chttps%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D10158%2Ftp...
https://sync.crwdcntrl.net/map/c=10158/tp=TPAD/tpid=d5a576c2-c8e3-4a42-9390-f757b648aaf1

49 B
264 B

31ms
31ms

Image
image/gif

52.4.54.89
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=10158/tp=TPAD/tpid=d5a576c2-c8e3-4a42-9390-f757b648aaf1
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Protocol: H2
Server: 52.4.54.89 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-54-89.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:48 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.8.200
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

location: https://sync.crwdcntrl.net/map/c=10158/tp=TPAD/tpid=d5a576c2-c8e3-4a42-9390-f757b648aaf1
date: Fri, 28 Jan 2022 16:02:48 GMT
via: 1.1 google
alt-svc: clear
content-length: 0
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H2 204 /
loadm.exelator.com/load/ Frame 10A9 0
604 B 78ms
24ms Image
text/plain 34.229.3.43
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadm.exelator.com/load/?p=204&g=260&buid=bfdd2a8c33d4e2b6c8fe6a6b0cc2b448&j=0
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.229.3.43 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-229-3-43.compute-1.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:48 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA

GET
H2

403

tpid=338589ec-b295-4667-b0e8-7977cf5692e5
sync.crwdcntrl.net/map/c=10492/tp=AVCT/ Frame 10A9
Redirect Chain

https://ads.avocet.io/getuid?url=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D10492%2Ftp%3DAVCT%2Ftpid%3D%7B%7BUUID%7D%7D
https://ads.avct.cloud/getuid?r=1&url=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D10492%2Ftp%3DAVCT%2Ftpid%3D%7B%7BUUID%7D%7D
https://ads.avct.cloud/getuid?bounce=true&r=1&url=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D10492%2Ftp%3DAVCT%2Ftpid%3D%7B%7BUUID%7D%7D
https://sync.crwdcntrl.net/map/c=10492/tp=AVCT/tpid=338589ec-b295-4667-b0e8-7977cf5692e5

49 B
268 B

25ms
24ms

Image
image/gif

52.4.54.89
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=10492/tp=AVCT/tpid=338589ec-b295-4667-b0e8-7977cf5692e5
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Protocol: H2
Server: 52.4.54.89 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-54-89.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:49 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.43.19
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

location: https://sync.crwdcntrl.net/map/c=10492/tp=AVCT/tpid=338589ec-b295-4667-b0e8-7977cf5692e5
date: Fri, 28 Jan 2022 16:02:48 GMT
p3p: policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 111
content-type: text/html; charset=utf-8

GET
H2

200

tpid=8c0f1a40-f93c-9735-55c6-e1f843346936
bcp.crwdcntrl.net/map/c=10098/tp=SRVT/ Frame 10A9
Redirect Chain

https://px.surveywall-api.survata.com/t
https://bcp.crwdcntrl.net/map/c=10098/tp=SRVT/tpid=8c0f1a40-f93c-9735-55c6-e1f843346936

49 B
264 B

27ms
26ms

Image
image/gif

54.89.1.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/c=10098/tp=SRVT/tpid=8c0f1a40-f93c-9735-55c6-e1f843346936
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Protocol: H2
Server: 54.89.1.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-89-1-168.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:48 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.8.102
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

Date: Fri, 28 Jan 2022 16:02:48 GMT
ETag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
Server: nginx/1.19.2
X-Powered-By: Express
Content-Type: image/gif; charset=utf-8
Location: https://bcp.crwdcntrl.net/map/c=10098/tp=SRVT/tpid=8c0f1a40-f93c-9735-55c6-e1f843346936
Referer: px.surveywall-api.survata.com, px.surveywall-api.survata.com, px.surveywall-api.survata.com
Connection: keep-alive
Content-Length: 0

GET
H2

200

tpid=67056841134482556493381626961617211010
sync.crwdcntrl.net/map/c=9828/tp=ADBE/ Frame 10A9
Redirect Chain

https://dpm.demdex.net/ibs:dpid=121998&dpuuid=bfdd2a8c33d4e2b6c8fe6a6b0cc2b448&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D9828%2Ftp%3DADBE%2Ftpid%3D%24%7BDD_UUID%7D
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=121998&dpuuid=bfdd2a8c33d4e2b6c8fe6a6b0cc2b448&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D9828%2Ftp%3DADBE%2Ftpid%3D%24%7BDD_UUID%7D
https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/tpid=67056841134482556493381626961617211010

49 B
263 B

28ms
28ms

Image
image/gif

52.4.54.89
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/tpid=67056841134482556493381626961617211010
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Protocol: H2
Server: 52.4.54.89 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-54-89.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:49 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.3.91
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

DCS: dcs-prod-usw2-1-v024-061f7ef17.edge-usw2.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: ntOp2rN1T90=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/tpid=67056841134482556493381626961617211010
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET sync
sync.tag.clrstm.com/lotame/ Frame 10A9 0
0

GET
H/1.1 200
OK lotame
sync.sharethis.com/ Frame 10A9 42 B
297 B 40ms
36ms Image
image/gif 3.129.242.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.sharethis.com/lotame?uid=bfdd2a8c33d4e2b6c8fe6a6b0cc2b448&gdpr=0

Requested by

Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.129.242.122 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Strict-Transport-Security: max-age=63072000; includeSubDomains;
Connection: keep-alive
X-Robots-Tag: noindex, nofollow
Date: Fri, 28 Jan 2022 16:02:48 GMT
Content-Length: 42
Stid: ZHIABWH0E6cAAAAIGLpiAw==
Content-Type: image/gif

GET
H2 204 usermatch.gif
beacon.krxd.net/ Frame 10A9 0
337 B 28ms
24ms Image
text/plain 54.209.75.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=lotame&partner_uid=bfdd2a8c33d4e2b6c8fe6a6b0cc2b448
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.75.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-75-74.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 16:02:48 GMT
cache-control: private, no-cache, no-store
x-request-time: D=22 t=1643385768
x-served-by: beacon-n012-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET

pixel
cm.g.doubleclick.net/ Frame 10A9
Redirect Chain

https://aorta.clickagy.com/pixel.gif?ch=120&cm=bfdd2a8c33d4e2b6c8fe6a6b0cc2b448
https://pixel-sync.sitescout.com/connectors/clickagy/usersync?redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D
https://pixel-sync.sitescout.com/connectors/clickagy/usersync?cookieQ=1&redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=5&cm=559e5d8d-ece1-4a16-95c5-d2f8d4788911-61f413a9-4341
https://idsync.rlcdn.com/420246.gif?partner_uid=c:5a4b023959421b5a5a2e9b1c479f109d
https://aorta.clickagy.com/pixel.gif?ch=114&cm=3a4b4a11a8b46df19066aec65c61479ff93f2f702474e218cfeca1eec580794825abae5358c0e7bc
https://cm.g.doubleclick.net/pixel?google_nid=clickagy&google_sc&google_cm&google_hm=Yzo1YTRiMDIzOTU5NDIxYjVhNWEyZTliMWM0NzlmMTA5ZA
https://aorta.clickagy.com/pixel.gif?ch=8&cm=CAESEOi9ZaAnKX0lvLKw7KhalXg&google_cver=1
https://stags.bluekai.com/site/51557?id=c:5a4b023959421b5a5a2e9b1c479f109d&redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D122%26cm%3D$_BK_UUID&BKUUID=$_BK_UUID&limit=1
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=122&cm=2CByBh3i99eYtFHC
https://aa.agkn.com/adscores/g.pixel?sid=9212289188&_puid=c:5a4b023959421b5a5a2e9b1c479f109d&_redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D128%26cm%3D
https://d.agkn.com/pixel/10751/?che=1643385769455&ip=2607:5300:60:7867::13&l1=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D128%26cm%3D163850504045007532772
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=128&cm=163850504045007532772
https://pixel-sync.sitescout.com/connectors/clickagy/usersync?redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=5&cm=f805299c-3fb5-4600-88f5-70bf34823016-61f413a9-4341
https://aa.agkn.com/adscores/g.pixel?sid=9212289188&_puid=c:5a4b023959421b5a5a2e9b1c479f109d&_redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D128%26cm%3D
https://d.agkn.com/pixel/10751/?che=1643385769805&ip=2607:5300:60:7867::13&l1=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D128%26cm%3D163850504045007532772
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=128&cm=163850504045007532772
https://dpm.demdex.net/ibs:dpid=79908&dpuuid=c:5a4b023959421b5a5a2e9b1c479f109d&redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D124%26cm%3D%24%7BDD_UUID%7D
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=124&cm=67056841134482556493381626961617211010
https://cm.g.doubleclick.net/pixel?google_nid=clickagy&google_sc&google_cm&google_hm=Yzo1YTRiMDIzOTU5NDIxYjVhNWEyZTliMWM0NzlmMTA5ZA

0
0

GET
H/1.1

200
OK

image.sbxx
ib.mookie1.com/ Frame 10A9
Redirect Chain

https://global.ib-ibi.com/image.sbxx?go=262106&pid=420&xid=bfdd2a8c33d4e2b6c8fe6a6b0cc2b448
https://ib.mookie1.com/image.sbxx?go=262106&pid=420&xid=bfdd2a8c33d4e2b6c8fe6a6b0cc2b448

120 B
992 B

408ms
89ms

Image
image/png

64.58.232.180
ASN-VINS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.mookie1.com/image.sbxx?go=262106&pid=420&xid=bfdd2a8c33d4e2b6c8fe6a6b0cc2b448
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Protocol: HTTP/1.1
Server: 64.58.232.180 , United States, ASN13649 (ASN-VINS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 42b601bc0d93dfca6e350b46d113bf8e7ff9e40a87a0c57ab9b3c9c219062423

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 28 Jan 2022 16:02:48 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
p3p: CP=\"DSP COR ADM DEV PSA PSD OUR\", CP="DSP COR ADM DEV PSA PSD OUR"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
X-Server: LAS10
Content-Type: image/png
Content-Length: 120
Expires: -1

Redirect headers

Date: Fri, 28 Jan 2022 16:02:48 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Location: https://ib.mookie1.com:443/image.sbxx?go=262106&pid=420&xid=bfdd2a8c33d4e2b6c8fe6a6b0cc2b448
p3p: CP="DSP COR ADM DEV PSA PSD OUR"
Access-Control-Allow-Origin: *
Cache-Control: private
X-Server: LAS12
Content-Type: text/html; charset=utf-8
Content-Length: 217

GET
H2

200

tpid=163850504045007532772
bcp.crwdcntrl.net/5/c=368/tp=NEUS/ Frame 10A9
Redirect Chain

https://aa.agkn.com/adscores/g.pixel?sid=9202276048
https://bcp.crwdcntrl.net/5/c=368/tp=NEUS/tpid=163850504045007532772

49 B
800 B

181ms
181ms

Image
image/gif

54.89.1.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/5/c=368/tp=NEUS/tpid=163850504045007532772
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Protocol: H2
Server: 54.89.1.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-89-1-168.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:49 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.38.218
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:48 GMT
via: 1.1 03e4d3b42a136dd5df035a167106f808.cloudfront.net (CloudFront)
server: AAWebServer
x-amz-cf-pop: EWR50-C1
location: https://bcp.crwdcntrl.net/5/c=368/tp=NEUS/tpid=163850504045007532772
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-cache: Miss from cloudfront
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
x-amz-cf-id: dfPIk5qBQHIj_outQQtgu1L9_gyWXvlMrn8Xh74R3RpQeKRlUkcr5A==
expires: 0

GET
H2

200

tpid=0-a568bb8b-d52a-4e3c-544d-c9dbf28be2e1$ip$149.56.153.183
bcp.crwdcntrl.net/map/c=6569/tp=STKA/ Frame 10A9
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=lotame
https://bcp.crwdcntrl.net/map/c=6569/tp=STKA/tpid=0-a568bb8b-d52a-4e3c-544d-c9dbf28be2e1$ip$149.56.153.183

49 B
264 B

39ms
38ms

Image
image/gif

54.89.1.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/c=6569/tp=STKA/tpid=0-a568bb8b-d52a-4e3c-544d-c9dbf28be2e1$ip$149.56.153.183
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Protocol: H2
Server: 54.89.1.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-89-1-168.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:49 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.8.151
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

Location: https://bcp.crwdcntrl.net/map/c=6569/tp=STKA/tpid=0-a568bb8b-d52a-4e3c-544d-c9dbf28be2e1$ip$149.56.153.183
Date: Fri, 28 Jan 2022 16:02:49 GMT
Connection: keep-alive
Content-Length: 129
Content-Type: text/html; charset=utf-8

GET
H2

200

tpid=c580ebb6-f936-494c-8e0a-7b2c801df006
bcp.crwdcntrl.net/map/c=6584/tp=VIDO/ Frame 10A9
Redirect Chain

https://sync.tidaltv.com/GenericUserSync.ashx?dpid=1695
https://sync.tidaltv.com/genericusersync.ashx?dpid=1695&s_h=1
https://bcp.crwdcntrl.net/map/c=6584/tp=VIDO/tpid=c580ebb6-f936-494c-8e0a-7b2c801df006

49 B
265 B

46ms
46ms

Image
image/gif

54.89.1.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/c=6584/tp=VIDO/tpid=c580ebb6-f936-494c-8e0a-7b2c801df006
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Protocol: H2
Server: 54.89.1.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-89-1-168.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:49 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.32.141
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:49 GMT
server: Apache-Coyote/1.1
location: https://bcp.crwdcntrl.net/map/c=6584/tp=VIDO/tpid=c580ebb6-f936-494c-8e0a-7b2c801df006
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
x-xss-protection: 1; mode=block
expires: 0

GET
H2

200

tpid=bd76cea4-8053-11ec-8743-3609c7f2b18d
sync.crwdcntrl.net/map/c=363/tp=ADGR/ Frame 10A9
Redirect Chain

https://cm.adgrx.com/bridge?AG_SETCOOKIE&AG_PID=lotame&AG_REDIR=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D363%2Ftp%3DADGR%2Ftpid%3D__AG_UID__
https://cm.adgrx.com/bridge.gif?AG_PID=lotame&AG_REDIR=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D363%2Ftp%3DADGR%2Ftpid%3D__AG_UID__
https://sync.crwdcntrl.net/map/c=363/tp=ADGR/tpid=bd76cea4-8053-11ec-8743-3609c7f2b18d

49 B
265 B

28ms
28ms

Image
image/gif

52.4.54.89
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=363/tp=ADGR/tpid=bd76cea4-8053-11ec-8743-3609c7f2b18d
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Protocol: H2
Server: 52.4.54.89 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-54-89.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:49 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.11.182
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 28 Jan 2022 16:02:49 GMT
server: Cowboy
Location: https://sync.crwdcntrl.net/map/c=363/tp=ADGR/tpid=bd76cea4-8053-11ec-8743-3609c7f2b18d
P3P: CP="NOI OTC OTP OUR NOR"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
X-RealServer-NX: lga-delivery-6
Content-Length: 0
Expires: Thu, 23 Sep 2004 17:42:04 GMT

GET
H2

200

qmap
sync.crwdcntrl.net/ Frame 10A9
Redirect Chain

https://sync.mathtag.com/sync/img?sync=auto&mt_exid=10040&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D4735%26tp%3DMDMA%26tpid%3D%5BMM_UUID%5D
https://sync.crwdcntrl.net/qmap?c=4735&tp=MDMA&tpid=c24861f4-13a8-4300-8d9b-7c1b6b2fe07a

49 B
264 B

31ms
30ms

Image
image/gif

52.4.54.89
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=4735&tp=MDMA&tpid=c24861f4-13a8-4300-8d9b-7c1b6b2fe07a
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Protocol: H2
Server: 52.4.54.89 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-54-89.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:49 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.15.60
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

Date: Fri, 28 Jan 2022 16:02:49 GMT
Server: MT3 4133 baa842e master iad-pixel-x28 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://sync.crwdcntrl.net/qmap?c=4735&tp=MDMA&tpid=c24861f4-13a8-4300-8d9b-7c1b6b2fe07a
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 28 Jan 2022 16:02:48 GMT

GET
H2

200

tpid=f805299c-3fb5-4600-88f5-70bf34823016-61f413a9-4341
sync.crwdcntrl.net/map/c=1389/tp=STSC/ Frame 10A9
Redirect Chain

https://pixel-sync.sitescout.com/connectors/lotame/usersync?redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D1389%2Ftp%3DSTSC%2Ftpid%3D%24UUID
https://pixel-sync.sitescout.com/connectors/lotame/usersync?cookieQ=1&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D1389%2Ftp%3DSTSC%2Ftpid%3D%24UUID
https://sync.crwdcntrl.net/map/c=1389/tp=STSC/tpid=f805299c-3fb5-4600-88f5-70bf34823016-61f413a9-4341

49 B
265 B

29ms
28ms

Image
image/gif

52.4.54.89
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=1389/tp=STSC/tpid=f805299c-3fb5-4600-88f5-70bf34823016-61f413a9-4341
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Protocol: H2
Server: 52.4.54.89 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-54-89.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:49 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.40.246
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:48 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://sync.crwdcntrl.net/map/c=1389/tp=STSC/tpid=f805299c-3fb5-4600-88f5-70bf34823016-61f413a9-4341
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2

200

tpid=YfQTqAAB_be8rgBB
sync.crwdcntrl.net/map/c=1811/tp=TBMG/ Frame 10A9
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/bsTd8NdE?redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D1811%2Ftp%3DTBMG%2Ftpid%3D%24%7BTM_USER_ID%7D
https://sync.crwdcntrl.net/map/c=1811/tp=TBMG/tpid=YfQTqAAB_be8rgBB

49 B
265 B

96ms
35ms

Image
image/gif

52.4.54.89
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=1811/tp=TBMG/tpid=YfQTqAAB_be8rgBB
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Protocol: H2
Server: 52.4.54.89 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-54-89.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:48 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.46.110
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:48 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1643385769.855412,VS0,VE0
x-served-by: cache-yul12834-YUL
x-cache: HIT
location: https://sync.crwdcntrl.net/map/c=1811/tp=TBMG/tpid=YfQTqAAB_be8rgBB
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 10A9 170 B
188 B 37ms
35ms Image
image/png 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lotame_dmp&google_hm=${base64_profileid}

Requested by

Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK 5907
tags.bluekai.com/site/ Frame 10A9 62 B
421 B 91ms
90ms Image
image/gif 173.223.56.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/5907?limit=0&id=89ac6f235f9acbfc76e4f57b0f564a9f
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 173.223.56.123 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a173-223-56-123.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 28 Jan 2022 16:02:49 GMT
Connection: keep-alive
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Content-Length: 62
Content-Type: image/gif

GET
H2

200

tpid=2346857161986540181
sync.crwdcntrl.net/map/c=10915/tp=TRNN/ Frame 10A9
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMzQ4ODM4MC90LzI/dpuid/bfdd2a8c33d4e2b6c8fe6a6b0cc2b448/url/https://sync.crwdcntrl.net/map/c=10915/tp=TRNN/tpid=$!%7BTURN_UUID%7D
https://sync.crwdcntrl.net/map/c=10915/tp=TRNN/tpid=2346857161986540181

49 B
264 B

28ms
28ms

Image
image/gif

52.4.54.89
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=10915/tp=TRNN/tpid=2346857161986540181
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Protocol: H2
Server: 52.4.54.89 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-54-89.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:49 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.38.25
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

location: https://sync.crwdcntrl.net/map/c=10915/tp=TRNN/tpid=2346857161986540181
pragma: no-cache
date: Fri, 28 Jan 2022 16:02:48 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

tp=ANXS
sync.crwdcntrl.net/map/c=281/rand=572717888/tpid=8396142445851402393/ Frame 10A9
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc=281%2Frand=572717888%2Ftpid%3D%24UID%2Ftp%3DANXS
https://sync.crwdcntrl.net/map/c=281/rand=572717888/tpid=8396142445851402393/tp=ANXS

49 B
264 B

28ms
28ms

Image
image/gif

52.4.54.89
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=281/rand=572717888/tpid=8396142445851402393/tp=ANXS
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=116%2C115%2C106%2C100%2C97%2C95%2C94%2C90%2C81%2C80%2C79%2C78%2C65%2C54%2C50%2C42%2C38%2C33%2C26%2C22%2C12%2C3%2C2&c=3825
Protocol: H2
Server: 52.4.54.89 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-54-89.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jan 2022 16:02:49 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.9.215
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 28 Jan 2022 16:02:49 GMT
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 669.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 7925bfe9-8deb-4176-af9c-121b3bec36cf
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://sync.crwdcntrl.net/map/c=281/rand=572717888/tpid=8396142445851402393/tp=ANXS
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 204
No Content a.gif
t.sharethis.com/d/ Frame 8E55 0
289 B 20ms
20ms Image
text/plain 23.192.50.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.sharethis.com/d/a.gif?cid=c010&cls=C&stid=ZHIABWH0E6cAAAAIGLpiAw%253D%253D&tt=t.dhj&dhjLcy=1643385767418&lbl=pxcel&flbl=pxcel&ll=d&ver=1.825.22807&ell=d&cck=__stid&dmn=to.xrivonet.info&pn=%2Fam7.html&qs=na&rdn=to.xrivonet.info&rpn=%2Fam7.html&rqs=na&cc=CA&cont=NA&evid=wbMbh6XA8QQAot9W8_Ho&urls=!1!249!b-13j,!1!248!b-13h,!1!551!b-14s,!1!0!b-14t,!1!238!b-150,!1!276!b-16f&rnd=1643385770677&cid=c010&version=1.825.22807&cc=CA&cont=NA&cls=C&repeat=0&htmLcy=102

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.192.50.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS