leisurelylifestyle.com Open in urlscan Pro
162.159.135.42 Public Scan

Software

ESF /

Resource Hash

9eeaafbc348c33f8f38cf1566b7984e0fce148a388caba181949e1b76a10dc17

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Sep 2022 05:31:40 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 12 Sep 2022 05:31:40 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Sep 2022 05:31:40 GMT

GET
H3 200 mai-theme.min.css
leisurelylifestyle.com/wp-content/plugins/mai-theme-engine/assets/css/ 74 KB
15 KB 340ms
338ms Stylesheet
text/css 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://leisurelylifestyle.com/wp-content/plugins/mai-theme-engine/assets/css/mai-theme.min.css?ver=1.13.1

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3c9181e83a24ce8fd1aedc13a573daded27c8677a50cf879fbee552798158be

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:39 GMT
content-encoding: br
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,69cc49307b52aa5de7ecd4e7fe9cfa541d7e65459f57bc5f7645132830112367
cf-cache-status: HIT
ki-edge: v=17.8
age: 17700
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
ki-cf-cache-status: HIT
last-modified: Fri, 22 Jul 2022 22:00:57 GMT
server: cloudflare
etag: W/"62db1e19-1264a"
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rrglmS3%2BNPxK5MwJmYMgF45kYxKZNgk%2FJbLaGedweTUHizxbWuwHNJQeu0PNw0yZDVSL0t%2BKq0qzGf%2BpSuHuUgLXMdSq%2BDTUsSy91GzNdqDMStMnP7jM%2BX83DHrp42UZtHEle%2F7vPWo%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
ki-cache-type: CDN
cf-ray: 749642159d575ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:39 GMT

GET
H3 200 flexington.min.css
leisurelylifestyle.com/wp-content/plugins/mai-theme-engine/assets/css/ 93 KB
8 KB 147ms
145ms Stylesheet
text/css 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://leisurelylifestyle.com/wp-content/plugins/mai-theme-engine/assets/css/flexington.min.css?ver=2.5.0

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

18dd8449dd7bd05b1b1a8a1640218993802b7e73a218b75c05acf5c9b47d6082

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:39 GMT
content-encoding: br
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,bb3f37c094610c2199e07cf262821821691b8fe09289b160c186751213a1ae12
cf-cache-status: HIT
ki-edge: v=17.8
age: 17700
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
ki-cf-cache-status: HIT
last-modified: Fri, 22 Jul 2022 22:00:57 GMT
server: cloudflare
etag: W/"62db1e19-174c5"
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=apv4B5Dc6c%2BtVvRoELIWlXh2zNrVMy0xGPTcUJwk8KLxsFsopBy%2BclZSHZllqGQ837pHtYkQnaV6sQK6JjYRp%2BloYe2b%2BtyAQcxv79%2FaD5uoNtBimSUGb7kuI%2Bf1Evy%2BmpQbGDKQLtg%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
ki-cache-type: CDN
cf-ray: 749642159d585ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:39 GMT

GET
H3 200 style.css
leisurelylifestyle.com/wp-content/themes/mai-lifestyle-pro/ 3 KB
2 KB 248ms
246ms Stylesheet
text/css 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://leisurelylifestyle.com/wp-content/themes/mai-lifestyle-pro/style.css?ver=1.1.0.11120191807

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

197104879c552a13746f7d5cb630c2cb5da93474b0523d00522c8b4b09bd5809

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:39 GMT
content-encoding: br
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,27a45934a82288d30205738abd92809416bd2c696789487651d68e93fdc3576e
cf-cache-status: HIT
ki-edge: v=17.8
age: 17700
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
ki-cf-cache-status: HIT
last-modified: Fri, 01 Nov 2019 18:07:37 GMT
server: cloudflare
etag: W/"5dbc7469-a86"
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FvUOAYUoRAV%2F3EmUOde8l9tGZ37jQeLOsiyuYn%2BZSxv%2Fj6AWieUjLDY3ehwkgYr1g9iDu8vD3wkJ%2FifUMEsAZrm4iHEyZbwi93tvDE2783xdpZ2l8m1sVMCufusWPTP91cPbDzDficw%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
ki-cache-type: CDN
cf-ray: 749642159d5a5ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:39 GMT

GET
H3 200 jquery.min.js Show response
leisurelylifestyle.com/wp-includes/js/jquery/ 87 KB
32 KB 152ms
151ms Script
application/javascript 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://leisurelylifestyle.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:39 GMT
content-encoding: br
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,c6b24937805e79aa879abb348a168f9de5cb059acc120ad080b2c4b17313ec6a
cf-cache-status: HIT
ki-edge: v=17.8
age: 272254
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
ki-cf-cache-status: HIT
last-modified: Sat, 24 Jul 2021 00:42:36 GMT
server: cloudflare
etag: W/"60fb61fc-15db1"
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FD45Q1M0Sc3VdxLlQ%2B0Enc9hUu69cEsy41cIppkOW81KrsdAygr23J4VI9u3IwX48P6AhBrn8n0LhrjzhFpswG%2BQ4lJx975DTaAgydyhTB8oj250YkxaVYOwYVSbqwh0vxnwoJZpB6A%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
ki-cache-type: CDN
cf-ray: 749642159d5b5ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:39 GMT

GET
H3 200 jquery-migrate.min.js Show response
leisurelylifestyle.com/wp-includes/js/jquery/ 11 KB
5 KB 346ms
345ms Script
application/javascript 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://leisurelylifestyle.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:39 GMT
content-encoding: br
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,c9789f825a7690b7bb84ea1fd2124203e5f4740041115f4af506498055c86f25
cf-cache-status: HIT
ki-edge: v=17.8
age: 3355019
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
ki-cf-cache-status: HIT
last-modified: Wed, 09 Dec 2020 17:53:19 GMT
server: cloudflare
etag: W/"5fd10f0f-2bd8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GXXTZ4U%2FBfgRttqz%2BOcpJX462Di4On8j3CSp7IqOkH18RA0l9NtD7NDmgFc8pSrU1uAfvjhijd7dw7qSeJcQ4DWaZpv%2FKfgjJuCq1yQMyThLzOhLRAEHc5AoFOkUm7XnYN94EX0k5Yw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
ki-cache-type: CDN
cf-ray: 749642159d5e5ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:39 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 108 KB
42 KB 526ms
184ms Script
application/javascript 142.251.10.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-132784684-1

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

0d1d756b4d36cf4eb3f7f5afe8cc5eea1d84aeea9e43aa8ff8b8a14fee3d982b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42994
x-xss-protection: 0
expires: Mon, 12 Sep 2022 05:31:40 GMT

GET
H3 200 leisurely-lifestyle-logo-font-only.png
leisurelylifestyle.com/wp-content/uploads/2022/09/ 3 KB
4 KB 182ms
180ms Image
image/png 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/09/leisurely-lifestyle-logo-font-only.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

62c7e3ec1d2b27c9ad44b2c300d08140138e12b4bb31491c2b1c070f804f26a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,878944e3a8c1e42c5d7063933253e75fc767a19c0498a41f7435136dfd07d68e
cf-cache-status: HIT
ki-edge: v=17.8
age: 105004
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3230
ki-cf-cache-status: HIT
last-modified: Sat, 10 Sep 2022 11:20:02 GMT
server: cloudflare
etag: "631c72e2-c9e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i1v0zIGvEP23TymlZM0n7Au2RyKsWDtsy4RyVzoE6b2GXD6x6x8Bc%2BEBpToqOV%2FWsh99Lcok8RQzAKIZ54NjpyxGJgXnIw5G7GoyncnNpwWfTes%2FOZq1iKLeHk383TUALdz4I0ezyg0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 74964218fd235ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 hoverIntent.min.js Show response
leisurelylifestyle.com/wp-includes/js/ 1 KB
1 KB 186ms
185ms Script
application/javascript 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://leisurelylifestyle.com/wp-includes/js/hoverIntent.min.js?ver=1.10.2

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ed5b5df9ceacfe76857ac51964972b0b417a215b2f50e837fd6b64bad7339c40

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
content-encoding: br
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,aa99d7b91f3dff4bda4e2aee89b95f6341d3ab8ee1373ecad4e1f80b7d98e6b6
cf-cache-status: HIT
ki-edge: v=17.8
age: 2663552
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
ki-cf-cache-status: HIT
last-modified: Wed, 25 May 2022 00:02:03 GMT
server: cloudflare
etag: W/"628d71fb-5db"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lrlxssUbkb88IyaW9D9OVfhKsvcVhR99IARWw3jN3iqc%2BrtWOqx%2BhSmrZIir0PJU3PN4aDrkSpkaLixOkwdrBaheyZWtXsSvySMpyrfbUL%2F%2FF%2BljFY42ZpkuPxAC8c5BmAMik6q0%2B18%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
ki-cache-type: CDN
cf-ray: 74964218eccf5ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 superfish.min.js Show response
leisurelylifestyle.com/wp-content/themes/genesis/lib/js/menu/ 4 KB
3 KB 160ms
159ms Script
application/javascript 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://leisurelylifestyle.com/wp-content/themes/genesis/lib/js/menu/superfish.min.js?ver=1.7.10

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ece565a1f66a32347dfed83562c428ff7736648de72b0027dd8f0e0f27e0c327

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
content-encoding: br
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,7901d83655b91313f2683ff59141e0aa90c0ea2be928ff3286bc8f67286200d4
cf-cache-status: HIT
ki-edge: v=17.8
age: 2663552
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
ki-cf-cache-status: HIT
last-modified: Tue, 10 Aug 2021 16:28:30 GMT
server: cloudflare
etag: W/"6112a92e-1193"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6h7x6n6NsCUFns2ITNvxUc4NSkarcAabJjAQnui%2Fa%2FElq3Qjhb1FnX4kO2gbia%2BURNxmreEuVrBe3VB8wJk2Qp1mrS%2FHsw4JJtm48syvFe5%2FNcgdSu8gzxORfEQKDgJYUEolJ8tkhdg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
ki-cache-type: CDN
cf-ray: 74964218fd0d5ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 skip-links.min.js Show response
leisurelylifestyle.com/wp-content/themes/genesis/lib/js/ 386 B
887 B 567ms
564ms Script
application/javascript 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://leisurelylifestyle.com/wp-content/themes/genesis/lib/js/skip-links.min.js?ver=3.4.0

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ade38136058fcd75880d3673855aff859ee377d5915e59cccf24a973d418bebb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
content-encoding: br
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,49d55508212846940a18731ffe2379db0c478caa86eb953fc2862465f836b55c
cf-cache-status: HIT
ki-edge: v=17.8
age: 406933
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
ki-cf-cache-status: HIT
last-modified: Wed, 07 Sep 2022 10:51:02 GMT
server: cloudflare
etag: W/"63187796-182"
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Oz8yeLiv1pO36cgmJsZZfs4Y7vUIHYqVHHkpz7fwAVg0RjmH7IfYKjDmiwM%2BgKsKcyfWQJgbgwgeJqUYcXWKy9dX7xHIuvbImVzj4BNgptx8GrlboaNQw%2BYFLTFFei5rVlQZci4WcYo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
ki-cache-type: CDN
cf-ray: 74964218fd145ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 mai-theme.min.js Show response
leisurelylifestyle.com/wp-content/plugins/mai-theme-engine/assets/js/ 10 KB
4 KB 180ms
177ms Script
application/javascript 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://leisurelylifestyle.com/wp-content/plugins/mai-theme-engine/assets/js/mai-theme.min.js?ver=1.13.1

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cdef9d92aa1c5e9d8e409303f5ee38caceeecf3c1bdbf6e2f7bec8fe273dd596

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
content-encoding: br
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,81f63a2c922b54a9d01b3117294887622d8cb5c9e5587c274b1222ce7a815f26
cf-cache-status: HIT
ki-edge: v=17.8
age: 300547
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
ki-cf-cache-status: HIT
last-modified: Fri, 22 Jul 2022 22:00:57 GMT
server: cloudflare
etag: W/"62db1e19-27d5"
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xsbmw4NL3vHqc1TwmDwBKiF9xREl3AL5usANehImiOziHsbaCr2KS5FlpIHfk5QLqMDA1FuCOBCyRzDlk6%2FmwnMf%2B2MgEF9meOvpyxekYb2mnYP5cry1acBk0nBEzr4828OJGX9Cntg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
ki-cache-type: CDN
cf-ray: 74964218fd175ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 basic-scroll.min.js Show response
leisurelylifestyle.com/wp-content/plugins/mai-theme-engine/assets/js/ 10 KB
4 KB 568ms
565ms Script
application/javascript 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://leisurelylifestyle.com/wp-content/plugins/mai-theme-engine/assets/js/basic-scroll.min.js?ver=3.0.2

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

508c6c8665bb4da4b211a97cdc3b2e791109204f82265d6af2eb79c51b61e014

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
content-encoding: br
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,91ef3a7a07ace8ef83a11eb839a1b23a939e45222ca65ec6401b017715978fec
cf-cache-status: HIT
ki-edge: v=17.8
age: 2663552
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
ki-cf-cache-status: HIT
last-modified: Fri, 22 Jul 2022 22:00:57 GMT
server: cloudflare
etag: W/"62db1e19-27d6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jkdxFHmTde%2BfGtLph5cYArUcpQxuVT0afhRi48DZ6Wz3D6L4Iuus0Wx4%2BSSIohjgsb6T3oApykzFbQIq0SUmvTGUivcDugP2vJWz286n5JSwRRAkv9b36PB3RQIjmz3fO17HuBgT%2FD8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
ki-cache-type: CDN
cf-ray: 74964218fd185ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 mai-scroll.min.js Show response
leisurelylifestyle.com/wp-content/plugins/mai-theme-engine/assets/js/ 4 KB
2 KB 537ms
535ms Script
application/javascript 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://leisurelylifestyle.com/wp-content/plugins/mai-theme-engine/assets/js/mai-scroll.min.js?ver=1.13.1

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c6e7fcc13e9fa0b4541bf314c25c54bf91807667df0a57d7cf30a554a7c00cae

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
content-encoding: br
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,7dbafb61f1b67c1d349086ac24c292668d16c7627fa42e6c3401219b1b35dc77
cf-cache-status: HIT
ki-edge: v=17.8
age: 2663551
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
ki-cf-cache-status: HIT
last-modified: Fri, 22 Jul 2022 22:00:57 GMT
server: cloudflare
etag: W/"62db1e19-1036"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NWJ2tkqMLrz2%2B7gqolUMPfbca81vwktPPCwrLA2E0%2FQPmIBilmKoyoATdzv%2FxKaFsX1xWt8ftvjkQKdedULt%2BQZiwhc1Pu%2F207wCNY9LoT0lRAnQbZhgNgr4WqtwD5lEcN6D1mxFPl0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
ki-cache-type: CDN
cf-ray: 74964218fd1d5ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 fitvids.min.js Show response
leisurelylifestyle.com/wp-content/plugins/mai-theme-engine/assets/js/ 2 KB
1 KB 182ms
180ms Script
application/javascript 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://leisurelylifestyle.com/wp-content/plugins/mai-theme-engine/assets/js/fitvids.min.js?ver=1.2.0

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

150cbe5c514aa70efcd179127476f4f5451db2ed4d033c0608afabdf9d18ec92

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
content-encoding: br
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,a775ee6d6e6a126b9c6e7c84bad57c17db0bbb382807295da1b279a05b2ab6fe
cf-cache-status: HIT
ki-edge: v=17.8
age: 2663551
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
ki-cf-cache-status: HIT
last-modified: Fri, 22 Jul 2022 22:00:57 GMT
server: cloudflare
etag: W/"62db1e19-6f6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RnaO6F2kRbb4EvOlR1nXFoPvZNa82q3CPpv5tFcnvyRAH492CHzOsxw6%2BZ8TQl2t5v2%2BLH4useZoyXPy499FFEnDq8cuq%2BK7g%2FiVCM67s5EiX6bIO0N4RsEQXlTSKR%2F3N2n7LeIx6D0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
ki-cache-type: CDN
cf-ray: 74964218fd1f5ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 fitvids-init.min.js Show response
leisurelylifestyle.com/wp-content/plugins/mai-theme-engine/assets/js/ 68 B
725 B 175ms
173ms Script
application/javascript 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://leisurelylifestyle.com/wp-content/plugins/mai-theme-engine/assets/js/fitvids-init.min.js?ver=1.13.1

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1414a599611253b31746e91b77f168573dbb42cc13a705fd72104a7eaca15e93

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
content-encoding: br
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,115708ca103ad9233ce0b67cc22b4664154d3d9c9d30ddd7f809a5c1139b37d4
cf-cache-status: HIT
ki-edge: v=17.8
age: 890687
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
ki-cf-cache-status: HIT
last-modified: Fri, 22 Jul 2022 22:00:57 GMT
server: cloudflare
etag: W/"62db1e19-44"
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qi7FoxzxyJUetELtXHRCZkwFOfIm7nlv0jq6mg5NU%2FUwXbB03egGKbl%2Bl8bINetDoqBwvsa%2FU1it0ep6t32LfqFiSzyizkalmrUgG6mn1iyMu8T8wljYG5c09oD8ny5NnvuFgsZ2LEQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
ki-cache-type: CDN
cf-ray: 74964218fd225ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 lines.png
leisurelylifestyle.com/wp-content/uploads/2019/10/ 130 B
841 B 179ms
179ms Image
image/png 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2019/10/lines.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b8e7f85e772a43827ac2fa6640ca208aa7a8ee826b3e0e183c4d5f3b06f87ae0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,7f0eea048ec19664d5e936c7667220f7139a682f2a237ac312ed0c66960f6bbf
cf-cache-status: HIT
ki-edge: v=17.8
age: 13773182
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 130
ki-cf-cache-status: HIT
last-modified: Fri, 03 Jan 2020 21:45:03 GMT
server: cloudflare
etag: "5e0fb5df-82"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VLmoblxA5716Smpour5mTQww4wKIgHdqTmil1uDvE0mJYCXlWV9qnqI6c10v3mEJKGU6nQ%2BmxphKWZ95yjfHJ21qOn6DD3IXkAkrOkmJ4BsHyqyXoJUyi5W7SL4X5duCqheD2E2lyJ4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 74964218fd255ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ 44 KB
44 KB 571ms
229ms Font
font/woff2 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Muli%3A200%2C200i%7COpen+Sans%3A300%2C300i%2C400%2C400i%2C700%2C700i%7CPlayfair+Display%3A700%2C700i&ver=1.1.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://leisurelylifestyle.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 09:46:31 GMT
x-content-type-options: nosniff
age: 503109
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44856
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Sep 2023 09:46:31 GMT

GET
H2 200 7Aulp_0qiz-aVz7u3PJLcUMYOFlOkEk30eg.woff2
fonts.gstatic.com/s/muli/v28/ 16 KB
17 KB 815ms
475ms Font
font/woff2 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/muli/v28/7Aulp_0qiz-aVz7u3PJLcUMYOFlOkEk30eg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Muli%3A200%2C200i%7COpen+Sans%3A300%2C300i%2C400%2C400i%2C700%2C700i%7CPlayfair+Display%3A700%2C700i&ver=1.1.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b39c72b6e04582a47117c4a7468d85b7ac661c6bb51c4fa0fca7b67a807210a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://leisurelylifestyle.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 22:01:21 GMT
x-content-type-options: nosniff
age: 113419
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16864
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 20:43:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 10 Sep 2023 22:01:21 GMT

GET
H3 200 Hot-Springs-in-California-960x533.jpg
leisurelylifestyle.com/wp-content/uploads/2022/04/ 138 KB
138 KB 230ms
222ms Image
image/jpeg 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/04/Hot-Springs-in-California-960x533.jpg

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aa1f3c2481f6d4967b9e733e7542bf07d12b0dda85865df2958e270fb117f398

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,8c0fd77b8fecb49ae6d9ba38c6ab5e19f7901e811959aa2dbc93a54c124afbd1
cf-cache-status: HIT
ki-edge: v=17.8
age: 45970
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 140870
ki-cf-cache-status: HIT
last-modified: Wed, 06 Apr 2022 04:21:43 GMT
server: cloudflare
etag: "624d1557-22646"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RXupNyoMcWThVjGxM%2BUPv5jpy%2FwMzGIvRD59U6OdBEbCw4rs%2BplRc9K9fZlchd7r9Zvpdp7v1Qditu2PEO0WPC%2F4e3yhvKbj44OnXpVkfSXakROZY5TCq6GtatLbCkchTZN8R93RdMc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642194dad5ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Benton-Hot-Springs-350x263.png
leisurelylifestyle.com/wp-content/uploads/2022/05/ 50 KB
51 KB 599ms
591ms Image
image/png 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/05/Benton-Hot-Springs-350x263.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7e4fb8d89dd0ba1d9d148160e02b2420446f0023b38fdbbc966de7d87889915d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,ed27999a0fb8e63a835a60e15b58e958b13e0396b3bd9f33a1a7739434ff9e4c
cf-cache-status: HIT
ki-edge: v=17.8
age: 45969
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 51231
ki-cf-cache-status: HIT
last-modified: Sat, 07 May 2022 12:47:51 GMT
server: cloudflare
etag: "62766a77-c81f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hQBZWlVPqHEKi76OHHsSMcy4XbDmlayT5bkrE9zZGyhoOj5RicZ9w3GYX7LtEloiEfzutJD1WXnVkprmZah9fdQmei9SJ63S8WMffvyWHLJi2MpOhTjkaKnMGiWPqj5AJ%2FMHeI2keYI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642194db55ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Buckeye-%E2%80%8BHot-Springs-350x263.png
leisurelylifestyle.com/wp-content/uploads/2022/04/ 60 KB
61 KB 566ms
557ms Image
image/png 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/04/Buckeye-%E2%80%8BHot-Springs-350x263.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce416c3a8cb7fdfc953cd8e4bc9427e3bf43a3c29b40d2397793346a032e40a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,1558340d1e58a84836283d7c356004dd06f140908436cae822178a3a244b4f14
cf-cache-status: HIT
ki-edge: v=17.8
age: 45969
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 61446
ki-cf-cache-status: HIT
last-modified: Sun, 01 May 2022 00:38:16 GMT
server: cloudflare
etag: "626dd678-f006"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SuFe2qeLuXtRPEDxV1G%2F3RKT9Pv57369aWgA7tb0DxH5Vr9snxKp8TkGzNP89GXqH6wDHNw%2BtUiNNJwF6o663M183X9OPARzNo1EXbpj9KaRsHyhvtlTMl%2BUrbOpGJoNEXIDGQicpr8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642194dbd5ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Delongegha-Hot-Springs-1-350x263.jpg
leisurelylifestyle.com/wp-content/uploads/2022/05/ 18 KB
19 KB 559ms
550ms Image
image/jpeg 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/05/Delongegha-Hot-Springs-1-350x263.jpg

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a7cc6e34018871472b6d64c8631e15b0e052df5f65f39c77f7cfb742223de662

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,1f3398bd68d1058e190a287f53e72b0ffed785d9b7e01cd6de6e4d65e406a520
cf-cache-status: HIT
ki-edge: v=17.8
age: 45970
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 18315
ki-cf-cache-status: HIT
last-modified: Wed, 11 May 2022 15:20:02 GMT
server: cloudflare
etag: "627bd422-478b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VFmmJ1g4mgCVUDjez5FzfsQ%2BgNG80VnRLGSyGGTGAgvsN3UEXh5gXYqzQfahG6LXz8lDAtqcAkTYD1CA3T2JX0JB7BoOd4IGockQZacDSomgQC2M%2BPPgfyq4jzi8%2FLQMWOWPX8OM%2BDU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642194dc15ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Fales-Hot-Springs-350x263.png
leisurelylifestyle.com/wp-content/uploads/2022/05/ 71 KB
71 KB 168ms
159ms Image
image/png 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/05/Fales-Hot-Springs-350x263.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84749e36d43950eb28fcb9fc012be426a8bacb83cf6bf3014ed3a706b3604437

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,a1903222aee5a585e83d22bb47b71fb37fd25b9770f5a677f2a07627801e9ed2
cf-cache-status: HIT
ki-edge: v=17.8
age: 45969
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 72295
ki-cf-cache-status: HIT
last-modified: Thu, 12 May 2022 02:02:38 GMT
server: cloudflare
etag: "627c6abe-11a67"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d0sqyKVhk7bDNPB%2FvUTu5lvM5GXaDbn26GZReyG867zEDohsoegXEbo3hIZPP9UuKeihnuaTMYwi9BW1nm2hjdYBwJXQEUqxLCtXZ48veNthpo6Jhk6sFnFpm3SGNGnEaHOb6%2B0UZN4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642194dc55ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Hunt-Hot-Springs-350x263.png
leisurelylifestyle.com/wp-content/uploads/2022/05/ 69 KB
70 KB 534ms
526ms Image
image/png 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/05/Hunt-Hot-Springs-350x263.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

90eda9d7f1a3586df22f5f73e6ba5ca9289cfcc850c22c837e3a0c7c23f2369b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,7a75c73ea9456fac47e5c19b042452e1c2388b7309181fd79bdc9585ea825b44
cf-cache-status: HIT
ki-edge: v=17.8
age: 45968
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 70558
ki-cf-cache-status: HIT
last-modified: Sun, 01 May 2022 20:53:30 GMT
server: cloudflare
etag: "626ef34a-1139e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BCMKLN6dfOfRLpthwMv9Bd7J0Gc4aIJNdXd2Nvj1FvwQbiMbZ%2FfL574%2FBJxFICBAEyVqYGptayAB4YJjM14fhCg3QFDNHIyGwycQpMvuREvZ56YoByK3QyFtTkuhR7HiOj4GhHwSgmw%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642194dc65ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Lake-Isabella-Hot-Springs-350x263.png
leisurelylifestyle.com/wp-content/uploads/2022/05/ 52 KB
53 KB 555ms
547ms Image
image/png 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/05/Lake-Isabella-Hot-Springs-350x263.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cd642b32922fe8e95a45471e4ff0236bb7495421b7877054e499fd5887a31582

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,9a2a7c9824563aa9ebfb560655488940a8d16fa011c4725dfeea22e33dda409f
cf-cache-status: HIT
ki-edge: v=17.8
age: 45968
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 53592
ki-cf-cache-status: HIT
last-modified: Mon, 02 May 2022 02:25:58 GMT
server: cloudflare
etag: "626f4136-d158"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GYBvwIzCGz6bmQGVuCZdwoaz%2FcP%2FaEKY8f0vlLm3xF7h5b5JLq8KqpehjhRdnxDBRcWGmjJhL%2B%2Bq%2F5dI4%2FVYfkI%2B5te4Oj%2B3pEEwQ0QTQjGGhl8yWTVyS6g2BoYTI6dNyuMWNZY7FHQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642194dcc5ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Miracle-Hot-Springs-California-350x263.jpg
leisurelylifestyle.com/wp-content/uploads/2022/04/ 31 KB
31 KB 531ms
523ms Image
image/jpeg 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/04/Miracle-Hot-Springs-California-350x263.jpg

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

93f57b4fdee2414d7e9be5e73f20915f12b697875ae681ed38d3dde8bc30185d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,0f56b225dfb5a51e247d875713e31d28f8ccecb7e8c2cee449ec021f67903198
cf-cache-status: HIT
ki-edge: v=17.8
age: 45969
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 31232
ki-cf-cache-status: HIT
last-modified: Sun, 10 Apr 2022 15:02:24 GMT
server: cloudflare
etag: "6252f180-7a00"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w5%2BYOrD3CWkN6H%2Bd3xae782GecQghUukHZbpuBQowi9xlQHqNAY1OXRO4gqAsThi5wZomyCTr%2BNEKXvUHTIFST5czLpLjRNGrJmpLtzY0j8GeiApFLD%2FtE7Az%2F6VkOC5eNkvWOnoaOM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642194dcd5ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Monarch-Hot-Springs-Pool-350x263.jpg
leisurelylifestyle.com/wp-content/uploads/2022/05/ 18 KB
19 KB 532ms
524ms Image
image/jpeg 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/05/Monarch-Hot-Springs-Pool-350x263.jpg

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

41868bbd1723ded7f920670ad043cce474d739cee05176d020e3e78e0c8d3be8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,859679a2b05218e6a77507e982f1acfd0ae9a5f1c93898b392d2887da093d245
cf-cache-status: HIT
ki-edge: v=17.8
age: 45969
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 18515
ki-cf-cache-status: HIT
last-modified: Mon, 09 May 2022 02:11:19 GMT
server: cloudflare
etag: "62787847-4853"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AaS%2FRZn3M%2Fx%2FWIgkdAbgv%2Fv9tkRIZSJCk5Uw1HY94On3AEJzNjdmOU1B5IvhhtQ2VeX29aL5DOU6nXpZ6APd3hcIc%2F14aQAjZNTi83cb5tdnOQvGacLw8ESI3oQ8juJBWNn%2BAzzkV08%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642194dd25ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Montecito-Hot-Springs-350x263.jpg
leisurelylifestyle.com/wp-content/uploads/2022/04/ 21 KB
22 KB 626ms
618ms Image
image/jpeg 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/04/Montecito-Hot-Springs-350x263.jpg

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c850f3a258c7725270a99c46e0e9f0ea0a6249b4e28b8380360a7ef8539f6ffe

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,d71427a25db6fb88d7fad4e1e1ea4e0693b24771cd0c9063e9395216167de28d
cf-cache-status: HIT
ki-edge: v=17.8
age: 45967
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 21854
ki-cf-cache-status: HIT
last-modified: Tue, 05 Apr 2022 22:47:51 GMT
server: cloudflare
etag: "624cc717-555e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yU6tcOCPVhSfVuACT0na4SCEUC3LwaAsA46WNXXLjoyY1I6PubIxkt6iB90RRAaw65kvEkQkMZf5K%2BeVMGsdyui1SIeCD7PTCXMyUuFlLx%2Bg5wcC1kBdZsCrTO0xX1zK4qAqUimilLQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642194dd45ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Mt-Shasta-Hot-Springs-350x263.png
leisurelylifestyle.com/wp-content/uploads/2022/05/ 73 KB
73 KB 500ms
493ms Image
image/png 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/05/Mt-Shasta-Hot-Springs-350x263.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b2cb3b870f62f5efa64ed9d74ff48fbc0a4e2523486a68547d0fd60ea37841b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,bb5f67fa7b68eed5f80f5825d2e38840fe3f72ee7c5dde25304adf6d8ff827cd
cf-cache-status: HIT
ki-edge: v=17.8
age: 45966
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 74478
ki-cf-cache-status: HIT
last-modified: Wed, 04 May 2022 03:09:43 GMT
server: cloudflare
etag: "6271ee77-122ee"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hQsBJ1FkEW67p84PgPRi2RIF0fGEdrq5agOPmSvFFCekJi4rXMdmmAtCvFqtGSyMS74ubRT6%2Bfk%2BPHBydZFUtkvhHA4GCQnLW7Td1rNmJZkQ6nr9hnzkWD4aPAIGgFyW63rcpPfwBNw%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642194dd85ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Murrieta-Hot-Springs-350x263.png
leisurelylifestyle.com/wp-content/uploads/2018/10/ 60 KB
60 KB 462ms
455ms Image
image/png 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2018/10/Murrieta-Hot-Springs-350x263.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

37939d6d4133cf79630b0c6574754caf735e5ae478b97ca847e928cfbe9edeb6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,b6ff27abc67dabf3b96facd607d8571e88bc56254a65dbed21d574cb97aaf0e1
cf-cache-status: HIT
ki-edge: v=17.8
age: 45966
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 61198
ki-cf-cache-status: HIT
last-modified: Sun, 01 May 2022 00:00:00 GMT
server: cloudflare
etag: "626dcd80-ef0e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eBuhVVRj%2BeNxhQwTjW3f6tFzqjCmT7EpFapaLHLw5E3eHYdObW%2FSRvdZ%2B9dsuApPB3uVxcgA0YE325hrgsfsLcBn5HPr5VT4AKhjg5xoq3dPmt8DNFJMPv2Y%2FDNqf2ISpoK0B%2Fl9DS8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642194ddd5ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Ojai-Hot-Spring-1-350x263.jpg
leisurelylifestyle.com/wp-content/uploads/2022/04/ 28 KB
28 KB 463ms
456ms Image
image/jpeg 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/04/Ojai-Hot-Spring-1-350x263.jpg

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b25658cf27c1d9edc8fabf6e32acc7182f30a774b7cbfd55fca26a2366a1b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,5edd9d1656b13d1eacdc2bebb09657a2fb06c45df0be4467f35de2dabaebcb12
cf-cache-status: HIT
ki-edge: v=17.8
age: 45967
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 28328
ki-cf-cache-status: HIT
last-modified: Mon, 11 Apr 2022 20:53:49 GMT
server: cloudflare
etag: "6254955d-6ea8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BU6jm57MQvtrMgrl62Z78mAzUbpxUp9vUcSuq5PbdjLUZPWXRTnjzkC6tcUBwiava8cxjIAc8hDC9UUX6JBjTE9UnAEa4y%2Bybq7Rd5P7zqxu%2FXqtb9A8rS6nn0RjKXpKlz9uEyH1Gu4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642194ddf5ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H2 200 7Aujp_0qiz-afTfcIyoiGtm2P0wG0xFz4eqVww.woff2
fonts.gstatic.com/s/muli/v28/ 17 KB
17 KB 485ms
179ms Font
font/woff2 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/muli/v28/7Aujp_0qiz-afTfcIyoiGtm2P0wG0xFz4eqVww.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Muli%3A200%2C200i%7COpen+Sans%3A300%2C300i%2C400%2C400i%2C700%2C700i%7CPlayfair+Display%3A700%2C700i&ver=1.1.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fec6a3de07a5a7f2c4a9b0b6af9747172d396bf90adf1ad81e51c6cf683d804e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://leisurelylifestyle.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 11:14:07 GMT
x-content-type-options: nosniff
age: 65853
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17148
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 21:01:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 11 Sep 2023 11:14:07 GMT

GET
H2 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v34/ 47 KB
47 KB 836ms
530ms Font
font/woff2 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Muli%3A200%2C200i%7COpen+Sans%3A300%2C300i%2C400%2C400i%2C700%2C700i%7CPlayfair+Display%3A700%2C700i&ver=1.1.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84161c46238fff2c6920ebc28f02cddd7b710cf3d1107853f540b084320f6afd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://leisurelylifestyle.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 02:17:08 GMT
x-content-type-options: nosniff
age: 11672
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47952
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:22:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 12 Sep 2023 02:17:08 GMT

GET
H3 200 Remington-Hot-Springs-350x263.png
leisurelylifestyle.com/wp-content/uploads/2022/04/ 56 KB
56 KB 377ms
375ms Image
image/png 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/04/Remington-Hot-Springs-350x263.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

da8cec125fb4f15eb126a7dba0fb7cdc424e246384c82cd0d87127d865260db9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,6f82995b057d9b02222f6df571625a42d615e25468ef98b3b004464f000bc51a
cf-cache-status: HIT
ki-edge: v=17.8
age: 45966
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 57165
ki-cf-cache-status: HIT
last-modified: Sun, 17 Apr 2022 15:24:30 GMT
server: cloudflare
etag: "625c312e-df4d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8%2F5%2Fud4HGPfIa9joOerAJ3moCfEeDAFfzSeQhfGDO5OY5n8YHQRv9tBLLvSJftGPamYgb49mMfWN3M%2FWZ5nghz7VJ1pKYX2p7J6XQNRwqnS1bvhHZ30MFMc%2B3Wz8p2jNfigH2dY1VYA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642199e795ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Saline-Valley-Hot-Springs-Death-Valley-350x263.png
leisurelylifestyle.com/wp-content/uploads/2022/05/ 68 KB
68 KB 333ms
331ms Image
image/png 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/05/Saline-Valley-Hot-Springs-Death-Valley-350x263.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

018850a4d7a48cb65d33a8a9279ad7065f0ef792aa9df15c9fb45c7fc2048a77

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,fde7763ed8ec64502b4ca5b10d271faccf194f3879bda6f88b311aa149765a0f
cf-cache-status: HIT
ki-edge: v=17.8
age: 45966
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 69134
ki-cf-cache-status: HIT
last-modified: Sat, 07 May 2022 19:00:15 GMT
server: cloudflare
etag: "6276c1bf-10e0e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e7eaiFPr4cqh3P0tAG3mVHCTuauYeuaNwLoNU9O3h%2F4GBaaYQROqB0AUp4YRfPcPAmt80xidwNRvCxs4YBXgnqNcPNuXVSaHGPIDsrAzFvtkD0p84TjjPAJlkm1fwIzz19ksFBHWkuw%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642199e7b5ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Sespe-Hot-Springs-350x263.png
leisurelylifestyle.com/wp-content/uploads/2022/05/ 65 KB
66 KB 334ms
331ms Image
image/png 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/05/Sespe-Hot-Springs-350x263.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c3be2be40773062f57eca1bedd49df7488522b87b21e93ef14aa94da18510f4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,3216870c2e99e9ac512ebf0e3c6876559f313ea72bbd742e66f1b1317555177b
cf-cache-status: HIT
ki-edge: v=17.8
age: 45966
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 66584
ki-cf-cache-status: HIT
last-modified: Mon, 02 May 2022 03:06:57 GMT
server: cloudflare
etag: "626f4ad1-10418"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P8ePPUHaJ5HUcSA0opvRq1pOJUJlj9JKsyWZOo821OsUU25ByLnWm92O5%2F0%2Fcomx4Gh0MM2jkD95Qn5USw5XS8mH7rdzJOEPmADCOoQ6gsw2laNPnCdP6K6vmVhG4EC0OXDrF%2F7XwqY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642199e7c5ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Slate-Hot-Springs-350x263.jpg
leisurelylifestyle.com/wp-content/uploads/2022/04/ 24 KB
24 KB 598ms
595ms Image
image/jpeg 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/04/Slate-Hot-Springs-350x263.jpg

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

934b87cc50bd147af1c977069c80b5cd2193558a21982c1b3fb8c21de624110a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,b7b367fbd06122a10785dae3a982bf23e4b2672d31a8867e0e7a91e7d94a38d3
cf-cache-status: HIT
ki-edge: v=17.8
age: 45966
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 24285
ki-cf-cache-status: HIT
last-modified: Sun, 01 May 2022 02:07:47 GMT
server: cloudflare
etag: "626deb73-5edd"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=evKjel7Ci05d6Ts1hNMj%2F9lphzfvWiXQcPgc%2BTEMuwD%2FpVQcX1vmW6XhIYbgE2XwDhZrnurMGg2vt%2BhRoqyPp65%2FZX1LhqM6KNc7TAJ%2F45KrS8fxBwbPF%2FnGhxCIfV3y99bWDJMTB3I%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642199e835ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Surprise-Valley-Hot-Springs-350x263.png
leisurelylifestyle.com/wp-content/uploads/2022/05/ 45 KB
46 KB 599ms
596ms Image
image/png 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/05/Surprise-Valley-Hot-Springs-350x263.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

da8adab5d3273f6e0320abd63f9c126f56d6550b17a052e58b7be04809d2bcb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,6bf04a16a60b7f32ded331f426ae364cdb06fd572fa292adbb6055c9b174e080
cf-cache-status: HIT
ki-edge: v=17.8
age: 45966
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 46518
ki-cf-cache-status: HIT
last-modified: Sun, 01 May 2022 14:26:45 GMT
server: cloudflare
etag: "626e98a5-b5b6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E1w61o608a6wyuyY8cgNzS%2FBfMsArAUR3u5JQiTcJmDIEuf2HTGElyw3Olyv6PYjaatxGblhZeVhZThuxB2XBPgOKvUKOCuOfg34U%2Bn%2F8u%2Fqx8NalgK8u7qoUFge3hft2pA%2F4%2Fnxuew%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642199e865ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Tassajara-Hot-Springs-350x263.png
leisurelylifestyle.com/wp-content/uploads/2022/05/ 47 KB
48 KB 600ms
597ms Image
image/png 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/05/Tassajara-Hot-Springs-350x263.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

885cde3b26a6aad5770f123d97f1b734ce53bef0408cae35c609dc3de3fd202a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,aac2c5eb1508d096d726df5b0842d8082fa0f2aaa1995ff5b2842193b2cc6158
cf-cache-status: HIT
ki-edge: v=17.8
age: 45966
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 48547
ki-cf-cache-status: HIT
last-modified: Mon, 09 May 2022 12:02:24 GMT
server: cloudflare
etag: "627902d0-bda3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GVRC80xC5KmTiLwTww7R%2F8Do3hxA4Wh6O6XeEfcILYLle2O9PvVRSU%2FlmCr4EPdqroqlC1RxMNa2bmx1B%2BvL%2BjgABdvA8pKMuSU1RIjCg3jp2B0E12S3g%2F1PB73W9TeCwYYb1UJz79Y%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642199e885ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Tecopa-Hot-Spring-350x263.png
leisurelylifestyle.com/wp-content/uploads/2022/05/ 45 KB
46 KB 602ms
599ms Image
image/png 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/05/Tecopa-Hot-Spring-350x263.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8a748900e6d85c4c15f072d0a259ef19b94a3f53ee32f538ac1ebe1d2719bdd5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,d14b0ae1fd008902aeef2d609b07d283baf57f96dfda92c1b2206e8ab031318d
cf-cache-status: HIT
ki-edge: v=17.8
age: 45966
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 46302
ki-cf-cache-status: HIT
last-modified: Wed, 04 May 2022 02:33:15 GMT
server: cloudflare
etag: "6271e5eb-b4de"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=POQeCWwV0%2BNXFbheLL80xZ3D%2BQCBhomfLaFY%2Fh6sTCronXwj3ogL4KMiGGOwsSrxDY5Alo%2BZuRQ03Oinq%2BAYIQqQYTy5BirVRneoOCKDx8vUD17ENtxOvhNCSQdYxi%2FTsGC1g81r4Co%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642199e895ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Travertine-Hot-Springs-350x263.png
leisurelylifestyle.com/wp-content/uploads/2022/04/ 56 KB
57 KB 635ms
632ms Image
image/png 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/04/Travertine-Hot-Springs-350x263.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66bb2d0fc6816b579f53eba9224c7ce2393d91dfea2431566f08578ebad5a7b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,dd312c698f3917c3d90aeced3343f9e664029beb68d83726debb1354d14898ab
cf-cache-status: HIT
ki-edge: v=17.8
age: 45965
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 57765
ki-cf-cache-status: HIT
last-modified: Sat, 30 Apr 2022 23:32:54 GMT
server: cloudflare
etag: "626dc726-e1a5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gYTmPWF4%2FecT8TSnSLANSEwk7evmq1Zdz1Jmtzn4EWQ5zoyOnMlyfGRNnOmXMKKPmRLQcwwLwnawhF7vP%2BFIk%2F0dAg4oqez3%2F2RstgJHTZsOmAvN58kbM2GgWnAiz%2FmHs6UCR54PZFM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642199e8a5ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Wild-Willys-Hot-Springs-350x263.png
leisurelylifestyle.com/wp-content/uploads/2022/04/ 27 KB
28 KB 636ms
634ms Image
image/png 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/04/Wild-Willys-Hot-Springs-350x263.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c07d6c44ca17f8286a67fa1e34bb24c848e20e6d128810528cc73131929c7d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,ac3f6f834d8f97ca559477508dd891a61facd65cacdef8109fc553dd6b3a2080
cf-cache-status: HIT
ki-edge: v=17.8
age: 45966
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27704
ki-cf-cache-status: HIT
last-modified: Sun, 17 Apr 2022 21:52:47 GMT
server: cloudflare
etag: "625c8c2f-6c38"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pPlRWClsM%2BLuqWunYhOdj4agswinBi8Ecn4udlb%2FHK99jgqTCVSM%2Bw7KidxpD58kqW459dsI7qHhLIbW%2BdUXnDRLxj5W7eF3m2vjqRzHmV41p2%2FfH8f9QQ8XunrSdTZ6r%2FQxkSOCv2w%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642199e905ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H3 200 Wonder-Valley-Hot-Springs-350x263.jpg
leisurelylifestyle.com/wp-content/uploads/2022/05/ 12 KB
13 KB 637ms
634ms Image
image/jpeg 162.159.135.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leisurelylifestyle.com/wp-content/uploads/2022/05/Wonder-Valley-Hot-Springs-350x263.jpg

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f9867fbfd019245d95cddb7872b34a57bb66854c67d10903743d928e9d2db7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/hot-springs-in-california/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:40 GMT
ki-cache-tag: 8244323b-3140-44df-a372-f813ea936e93,a2f49360be4e86b0b789a52e03a823c667f3d0545ef895ce6d277ffccd5f0fbe
cf-cache-status: HIT
ki-edge: v=17.8
age: 45965
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 12401
ki-cf-cache-status: HIT
last-modified: Sun, 08 May 2022 12:36:28 GMT
server: cloudflare
etag: "6277b94c-3071"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zK3%2FCgfNMZ%2BTvyuRGqBHm%2B8QlDxOcOyV%2BXm%2BZcQP2ov8h%2BfGSRtave3FkDX9nFEzIk7poGAVxl0FKeeXKR1XIj9m1GEb9GBPcybE0LpYIihFq2c3sAByxaGx0yKv0WPbmLQhnwx%2FnuA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 749642199e915ab0-MEL
x-content-type-options: nosniff
x-edge-location-klb: 1
expires: Tue, 12 Sep 2023 05:31:40 GMT

GET
H2 200 abd.js Show response
ads.adthrive.com/abd/ 1 KB
1 KB 515ms
173ms XHR
application/javascript 13.224.250.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adthrive.com/abd/abd.js
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.250.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-250-11.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 73e8fdebeab4f384cac905005edbc1b1cc6c9fcbd18c111103d5066401abdded

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: os8MwQFHVWjrrk14iP4Ip4gSDo8pMj4I
content-encoding: br
etag: W/"1a1900d242621b126237113a25ab0ab3"
age: 2800
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Tue, 06 Sep 2022 21:10:57 GMT
server: AmazonS3
date: Mon, 12 Sep 2022 05:31:41 GMT
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 501f8f2b34478d387447d1479e77dfd2.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN52-C2
x-amz-cf-id: Zq6kjba19s_dCDi-A3b-hl1kKU3cd67w8EzLhuBXvvMpMoSo38KWDA==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 209 KB
73 KB 489ms
188ms Script
application/javascript 142.251.10.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-B943GC8X73&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-132784684-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

655e15175d0e3e8e564e6e24c91fa16531350a995e48f83343b649062a44852a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:41 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 74729
x-xss-protection: 0
expires: Mon, 12 Sep 2022 05:31:41 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 522ms
180ms Script
text/javascript 74.125.200.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-132784684-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sa-in-f102.1e100.net

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 3872
date: Mon, 12 Sep 2022 04:27:09 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Mon, 12 Sep 2022 06:27:09 GMT

GET
H2 200 marmalade Show response
ads.adthrive.com/api/v1/ 5 KB
1 KB 650ms
567ms Fetch
application/json 13.224.250.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adthrive.com/api/v1/marmalade?siteid=61d877f7514b73001b093e34&url=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&experiments=amazonLoad,prebidLoad,gptLoad,rubiconFloors
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/sites/61d877f7514b73001b093e34/ads.min.js?referrer=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&cb=62
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.250.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-250-11.sin52.r.cloudfront.net
Software: /
Resource Hash: 9140e387388e9002a2be5ced5685dd8044a2625f945850930802520a78e466e0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:41 GMT
adthrive-is-ios: 0
x-amz-cf-pop: SIN52-C2
x-amzn-requestid: 9df1d9e9-e0a6-48a1-a688-5ecdf0cc345c
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-amzn-trace-id: Root=1-631ec43d-599cd62a7d6c72ec689c31f5;Sampled=0
x-cache: Miss from cloudfront
content-encoding: br
x-amz-apigw-id: YVOZoEutoAMFeQg=
x-amz-cf-id: CxG6tgg0kskySsxQYfIrpnuY9KUxD3ufjgS294z6ki_8hR2JYWFT2A==
via: 1.1 501f8f2b34478d387447d1479e77dfd2.cloudfront.net (CloudFront)
adthrive-is-chrome: 1

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 166 KB
43 KB 547ms
195ms Script
application/javascript 13.225.2.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/sites/61d877f7514b73001b093e34/ads.min.js?referrer=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&cb=62
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.2.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-2-118.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8efa950be6d28aa1103053638a776ab8f2dcda011254bab316bc409018714e33

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Mon, 12 Sep 2022 05:30:04 GMT
via: 1.1 57441ee201b6bfb8ff8be48f8e002574.cloudfront.net (CloudFront), 1.1 a6f10891bf05ce2d27b04a152b14cf00.cloudfront.net (CloudFront)
last-modified: Thu, 01 Sep 2022 20:50:56 GMT
server: AmazonS3
age: 98
etag: W/"350e165fc9b88312c43a9ba90eba4e3d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=3600
x-amz-cf-pop: SIN2-P2, SIN52-C2
content-encoding: gzip
x-amz-cf-id: nzs0XMmGgbKgqN-wUYqjaruZhmO3CZ_yG7AV5kdhIlPh-HmaSolCUg==

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 84 KB
29 KB 530ms
188ms Script
text/javascript 74.125.68.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/sites/61d877f7514b73001b093e34/ads.min.js?referrer=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&cb=62

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c457c08c9cf2d5307adfbaf4c73b92db8c93fb456aa87c3d66dc559a763afaf8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28678
x-xss-protection: 0
server: sffe
etag: "1331 / 32 of 1000 / last-modified: 1662761167"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 12 Sep 2022 05:31:41 GMT

GET
H2 200 prebid.min.js Show response
ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/ 473 KB
121 KB 391ms
390ms Script
application/javascript 13.224.250.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/sites/61d877f7514b73001b093e34/ads.min.js?referrer=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&cb=62
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.250.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-250-11.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4a77c1885bb1ad44d7bb61d6e27fa3f4e029a441e5152a653f937c6284cacbe4

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: 5rBe_JyePQQL.5BUq__uq9FhHtzYDEN4
content-encoding: br
last-modified: Tue, 06 Sep 2022 19:18:23 GMT
server: AmazonS3
age: 23
etag: W/"b2f15b13cbd392aaa973b20b18015bae"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 f524a7fd984e15aeceb1c8903b4e45c2.cloudfront.net (CloudFront)
cache-control: max-age=86400
date: Mon, 12 Sep 2022 05:31:19 GMT
x-amz-cf-pop: SIN52-C2
x-amz-cf-id: U6HGjqT9-Tk1QX1auBk_t4nYXKHRnd_bTT70QGPBdCYIlQSP7PnSgA==

GET
H2 200 leisurelylifestyle.com Show response
ads.adthrive.com/api/v2/host/floors/ 1 KB
689 B 257ms
175ms XHR
application/json 13.224.250.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adthrive.com/api/v2/host/floors/leisurelylifestyle.com
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/sites/61d877f7514b73001b093e34/ads.min.js?referrer=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&cb=62
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.250.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-250-11.sin52.r.cloudfront.net
Software: /
Resource Hash: b2c3441c9166895687672fc365d7c07aef15d78ad2e17f020ff5eac3049f81c0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:45:01 GMT
content-encoding: br
age: 2800
x-amzn-requestid: 01aa4373-18b8-46e3-b10e-908dc0335402
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-amzn-trace-id: Root=1-631eb94d-73de3c0034940ba900cfb616;Sampled=0
x-cache: Hit from cloudfront
x-amz-cf-pop: SIN52-C2
x-amz-apigw-id: YVHkEHTaoAMFphg=
x-amz-cf-id: kWtdTIrfSgvAQ1zpF0eewe51kX9DHVhhfniXJJhKplJpH7GDCh2_Eg==
via: 1.1 501f8f2b34478d387447d1479e77dfd2.cloudfront.net (CloudFront)

GET
H2 200 adthrive.min.js Show response
ads.adthrive.com/builds/core/f56a6a1/es2018/js/ 450 KB
111 KB 177ms
176ms Script
application/javascript 13.224.250.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adthrive.com/builds/core/f56a6a1/es2018/js/adthrive.min.js?deployment=2022-09-06-5:ade-249:pr2618:f56a6a1&experiments=amazonLoad,prebidLoad,gptLoad,rubiconFloors
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/sites/61d877f7514b73001b093e34/ads.min.js?referrer=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&cb=62
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.250.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-250-11.sin52.r.cloudfront.net
Software: CloudFront /
Resource Hash: 9d1f4a5734e644ccd0c99ef3c5f8558147c6003c9d1e518d1f38335b5a36a362

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 17:44:07 GMT
content-encoding: gzip
server: CloudFront
age: 42454
etag: "4289640e12b5c5dec1267c7c133465f4"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 f524a7fd984e15aeceb1c8903b4e45c2.cloudfront.net (CloudFront)
cache-control: max-age=3600, s-maxage=86400
x-amz-cf-pop: SIN52-C2
content-length: 113278
x-amz-cf-id: ZQd1AGhN2z53nLqtSRMIAVlD6fUtOBoOmEBlHiO7Bo4e8zBwR6RpPQ==

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
211 B 482ms
180ms XHR
text/plain 74.125.200.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=335300354&t=pageview&_s=1&dl=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&ul=en-us&de=UTF-8&dt=Hot%20Springs%20in%20California%20%7C%20Details%20and%20Map%20Information%20on%20Natural%20Warm%20Pools&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=925425147&gjid=1851848341&cid=1266557791.1662960702&tid=UA-132784684-1&_gid=1504249267.1662960702&_r=1&gtm=2ou970&z=3788705

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sa-in-f102.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:42 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 432ms
179ms Ping
text/plain 74.125.200.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-B943GC8X73&gtm=2oe970&_p=335300354&cid=1266557791.1662960702&ul=en-us&sr=1600x1200&_z=ccd.v9B&_s=1&sid=1662960701&sct=1&seg=0&dl=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&dt=Hot%20Springs%20in%20California%20%7C%20Details%20and%20Map%20Information%20on%20Natural%20Warm%20Pools&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-B943GC8X73&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.200.102 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sa-in-f102.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:42 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 orcqQ1vr Show response
cdn.jwplayer.com/v2/playlists/ 174 B
518 B 1052ms
419ms Fetch
application/json 13.227.254.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jwplayer.com/v2/playlists/orcqQ1vr
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/es2018/js/adthrive.min.js?deployment=2022-09-06-5:ade-249:pr2618:f56a6a1&experiments=amazonLoad,prebidLoad,gptLoad,rubiconFloors
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-12.sin52.r.cloudfront.net
Software: openresty /
Resource Hash: 42a5b9b5c875c2248d83ac839e6ce3a19ed758ebab2c6289106eb0c2250d0a08

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:42 GMT
content-encoding: gzip
server: openresty
x-amz-cf-pop: SIN52-C3
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=180, max-stale=180
content-length: 168
via: 1.1 5157dedfe33ef5a309f236599901abe2.cloudfront.net (CloudFront)
x-amz-cf-id: w6PgmmOTBzgkLYJxrFpJMDU1Lcl9w40SbpPho4Z4c04jbuJ-Dr569A==
expires: Mon, 12 Sep 2022 05:34:42

GET
H2 200 beacon.js Show response
sb.scorecardresearch.com/ 4 KB
2 KB 769ms
172ms Script
application/javascript 13.227.254.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/es2018/js/adthrive.min.js?deployment=2022-09-06-5:ade-249:pr2618:f56a6a1&experiments=amazonLoad,prebidLoad,gptLoad,rubiconFloors
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-126.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ee54b51af15f1f68f707da981f3c135c249a25e9293871e1e0cbd2c24c7b6117

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 17:59:01 GMT
content-encoding: gzip
etag: W/"eaf85c1c6758e84acfe134efd70e9373"
last-modified: Tue, 28 Jun 2022 13:19:23 GMT
server: AmazonS3
age: 41571
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-amz-cf-pop: SIN52-C3
x-amz-cf-id: TsJgNfQy8YGk7nGScHIUEp1qkoT9duHJjDw3D4mv6BVFV2JO7HfvcA==

GET
H/1.1 200
OK config.js Show response
confiant-integrations.global.ssl.fastly.net/mOinGM9MTu5v-Lto835XLhlrSPY/gpt_and_prebid/ 362 KB
73 KB 263ms
85ms Script
text/javascript 151.101.65.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://confiant-integrations.global.ssl.fastly.net/mOinGM9MTu5v-Lto835XLhlrSPY/gpt_and_prebid/config.js
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/es2018/js/adthrive.min.js?deployment=2022-09-06-5:ade-249:pr2618:f56a6a1&experiments=amazonLoad,prebidLoad,gptLoad,rubiconFloors
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 536892261ba214482b331262eb678ecb0798191bb57dd28cdc2910478a1f33a2

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 12 Sep 2022 05:31:42 GMT
Content-Encoding: gzip
Age: 764
X-Cache: HIT
Connection: keep-alive
Content-Length: 74143
x-amz-id-2: g1uqCXEQGwEkyYZgzPLQjqBb2+UyLwdCxUZfv0/xt/L653qaW4ckLfUe1kQ72QjvhXmXsoMHdEc=
X-Served-By: cache-mel11222-MEL
Last-Modified: Mon, 12 Sep 2022 00:41:48 GMT
Server: AmazonS3
X-Timer: S1662960702.064491,VS0,VE0
ETag: "058953d79ac4b05623e7f1d79d52dfc9"
x-amz-request-id: SPZ0V89FYGREFDJF
Via: 1.1 varnish
Cache-Control: public, max-age=900, stale-while-revalidate=3600
Accept-Ranges: bytes
Content-Type: text/javascript
X-Cache-Hits: 121

GET
H2 200 event Show response
logger.adthrive.com/ 21 B
486 B 764ms
171ms XHR
application/json 13.227.254.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://logger.adthrive.com/event?siteId=61d877f7514b73001b093e34&siteName=Leisurely%20Lifestyle&bucket=flex-30&branch=f56a6a1&deployment=2022-09-06-5%3Aade-249%3Apr2618%3Af56a6a1&message=BaseDynamicAdsInjector%3A%3A_logDensityInfo&pageurl=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&body=%5B%7B%22onePerViewport%22%3Afalse%2C%22combinedMax%22%3A16%2C%22targetDensityUnits%22%3A11%2C%22targetDensityPercentage%22%3A0.3%2C%22mainContentHeight%22%3A6787%2C%22recipeCount%22%3A0%2C%22numberOfEls%22%3A31%7D%2C%7B%22abgroup%22%3A%7B%22wvtls%22%3A%22off%22%2C%22amzn_hold_load%22%3A%22on%22%2C%22rfii%22%3A%22off%22%2C%22flr%22%3A%22cm%22%2C%22lzflr%22%3A%22off%22%2C%22ebho%22%3A%22sharethrough_ebda%22%2C%22loglevel%22%3A%22off%22%2C%22idho%22%3A%22off%22%2C%22lzhb%22%3A%22on%22%2C%22lzcvp%22%3A%221.25%22%2C%22lzbpvp%22%3A%220.75%22%2C%22tripleliftdr%22%3A%22both%22%2C%22magnitedr%22%3A%22both%22%2C%22pbs2s_appnexus%22%3A%22off%22%2C%22pbs2s_grid%22%3A%22on%22%2C%22pbs2s_gumgum%22%3A%22off%22%2C%22pbs2s_openx%22%3A%22off%22%2C%22adt%22%3A%220%22%2C%22ito_ds%22%3A%222800%22%2C%223pho%22%3A%22none%22%2C%22vebho%22%3A%22off%22%2C%22cbt%22%3A%222s%22%2C%22vast_to%22%3A%2210s%22%2C%22proto%22%3A%22nv1%22%2C%22pbm%22%3A%22on%22%2C%22reqTo%22%3A%2215%22%2C%22vadv%22%3A%22on%22%2C%22smhd100%22%3A%22off%22%2C%22smad300%22%3A%22on%22%2C%22s2sbuff%22%3A%22300%22%2C%22rmos1%22%3A%22off%22%2C%22socon%22%3A%221%22%2C%22sab%22%3A%22on%22%2C%22dco%22%3A%22relaxed%22%2C%22mxrpog%22%3A%225%22%2C%22dajto%22%3A%22off%22%2C%22jwb%22%3A%22on%22%2C%22vpred%22%3A%22on%22%2C%22crtvmon%22%3A%22off%22%2C%22pba%22%3A%22none%22%2C%22amzn_hold_disp%22%3A%22off%22%2C%22bmetrics%22%3A%22on%22%2C%22confiant%22%3A%22prod%22%2C%22cnfep%22%3A%22on%22%2C%22refflr2%22%3A%221.2%22%2C%22socbe%22%3A%22sovpct2%22%2C%22logcls%22%3A%22off%22%2C%22tpcapi%22%3A%22on%22%2C%22sidp%22%3A%22off%22%2C%22rebuildslot%22%3A%22on%22%2C%22upl%22%3A%22off%22%2C%22sekho%22%3A%22off%22%2C%22sospp%22%3A%22on%22%2C%22rmosnv1%22%3A%22off%22%7D%2C%22sess%22%3A%2201GCR2X4B72666RTK6J7CQK4KF%22%2C%22pvk%22%3A%2201GCR2X4B7FJF6KKGKM2Y5KPHN%22%2C%22hbho%22%3A%5B%22nativo%22%2C%22sharethrough%22%5D%2C%22vbho%22%3A%5B%22none%22%5D%2C%22lmdv%22%3A%221.7.0%22%2C%22clsBranch%22%3A%22484004f%22%2C%22clsBucket%22%3A%22prod%22%7D%5D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/es2018/js/adthrive.min.js?deployment=2022-09-06-5:ade-249:pr2618:f56a6a1&experiments=amazonLoad,prebidLoad,gptLoad,rubiconFloors
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.254.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-57.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9a14b700bc2581383cfae352c91f00fc65439392344a2f823a9645e8546a3bde

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 05:54:20 GMT
via: 1.1 75c2742886aa426af3e0688fa2a8677a.cloudfront.net (CloudFront)
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age: 85042
x-cache: Hit from cloudfront
content-length: 21
last-modified: Thu, 12 Nov 2020 16:10:14 GMT
server: AmazonS3
etag: "711ef07ada64abbd94e9099392aa8d74"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-amz-cf-pop: SIN52-C3
accept-ranges: bytes
x-amz-cf-id: B4lngG0SiqfHD-qyAsYG25vXE5cdIfRraV7ZCRa2GSBS-NI8dt9bTQ==

GET
H2 200 ads.min.css
ads.adthrive.com/sites/61d877f7514b73001b093e34/ 199 B
454 B 174ms
173ms Stylesheet
text/css 13.224.250.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adthrive.com/sites/61d877f7514b73001b093e34/ads.min.css
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/es2018/js/adthrive.min.js?deployment=2022-09-06-5:ade-249:pr2618:f56a6a1&experiments=amazonLoad,prebidLoad,gptLoad,rubiconFloors
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.250.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-250-11.sin52.r.cloudfront.net
Software: CloudFront /
Resource Hash: 943867fcf3d16376a663f0ce2487ce337317a331e2e966dc33a60a719f86b5de

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:45:01 GMT
content-encoding: gzip
server: CloudFront
age: 2800
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 f524a7fd984e15aeceb1c8903b4e45c2.cloudfront.net (CloudFront)
cache-control: max-age=3600, s-maxage=86400
x-amz-cf-pop: SIN52-C2
content-length: 142
x-amz-cf-id: 5fonk2joZfBL_nWM9BR9JpCzI1C6y3NYSbmBkduWutfrUGqNWiD0cw==

GET
H2 200 pubads_impl_2022090601.js Show response
securepubads.g.doubleclick.net/gpt/ 382 KB
130 KB 468ms
167ms Script
text/javascript 74.125.68.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce67b0786f14c7c1861eebd94f6557072e99e50ab95176a2f23d7444c4dc2741

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 10:31:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 500389
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 133157
x-xss-protection: 0
last-modified: Tue, 06 Sep 2022 08:35:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 06 Sep 2023 10:31:53 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 131 B
121 B 512ms
172ms XHR
application/json 74.125.68.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=leisurelylifestyle.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-220-232-15.ap-southeast-1.compute.amazonaws.com

Software

cafe /

Resource Hash

f4ad9994ea97613abb5413259e61d354dc1aa56e548c6f41c2b69729fad18ca0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 96
x-xss-protection: 0
expires: Mon, 12 Sep 2022 05:31:42 GMT

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 385 B
739 B 384ms
382ms XHR
application/json 13.225.2.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fleisurelylifestyle.com&pubid=4fbba76f-7987-4fa2-9733-c27eb3a2170b
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.2.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-2-118.sin52.r.cloudfront.net
Software: Server /
Resource Hash: a63506fb420990f57b718352691d603bd8c4574bd1182dd2f274fe276b83493d

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:41 GMT
via: 1.1 a6f10891bf05ce2d27b04a152b14cf00.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SIN52-C2
x-cache: Miss from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 385
x-amz-cf-id: kGeGCRg5mFi64Tvzzzkf6oxt06oQ6o5OxAVRNgNqCbknz-ig4VEOsw==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 520ms
176ms XHR
application/javascript 13.225.2.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.2.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-2-118.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: tKimXuvhjexkvOlm5D.ynBWfUtiJgbbH
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 39024
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Wed, 24 Aug 2022 19:06:24 GMT
server: AmazonS3
date: Sun, 11 Sep 2022 18:41:19 GMT
vary: Accept-Encoding,Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 e7dacb0efeeed58e9fdd0c9cd774981a.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: SIN52-C2
x-amz-cf-id: L8qhmOAgnkp7_VaBZ1ebTHc_syRsMpXgxdUTwE9TVRtb9_n7MRdcIA==

GET
H/1.1 200
OK wrap.js Show response
confiant-integrations.global.ssl.fastly.net/gptprebidnative/202205091138/ 194 KB
62 KB 87ms
85ms Script
application/javascript 151.101.65.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202205091138/wrap.js
Requested by: Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/mOinGM9MTu5v-Lto835XLhlrSPY/gpt_and_prebid/config.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 468718a583ec98edb242b85a424558fd63ceac3a8c1ff6a76bbf473b857481c4

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 12 Sep 2022 05:31:42 GMT
Content-Encoding: gzip
Age: 864
X-Cache: HIT
Connection: keep-alive
Content-Length: 63033
x-amz-id-2: JH81llHr03eLsRRnACpVMUbGgoBWJOOVEtBK3KRZXlKDil+fvy4Fu2b3bGIpNM4CBGhncTMTZiE=
X-Served-By: cache-mel11222-MEL
Last-Modified: Mon, 09 May 2022 15:39:37 GMT
Server: AmazonS3
X-Timer: S1662960702.279645,VS0,VE0
ETag: "ecf02ff527b0ed563b40adaa835278b3"
x-amz-request-id: 5W4Z9AEKJADSZM6Q
Via: 1.1 varnish
Cache-Control: public, max-age=900, stale-while-revalidate=3600
Accept-Ranges: bytes
Content-Type: application/javascript; charset=utf-8
X-Cache-Hits: 122

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 48 KB
14 KB 325ms
118ms Script
text/javascript 104.22.53.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.22.53.86 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e85815908064ec7977f13468af609ac980317a21b5b519cfa107948cf76b8ce9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Mon, 12 Sep 2022 05:31:42 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 31 Aug 2022 11:00:45 GMT
server: cloudflare
age: 1900
etag: W/"b17c28d6fd88a6b12feea5c52e9a7485"
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-ray: 749642271d0f5a61-MEL
x-amz-request-id: W75N2EZVPQ7N58F2
x-amz-id-2: qmLvBiO5OKanfn3AgSoOkc/J14cNYKLVlQv4d9V1HQtSnomUpLnhyB9K/rtxLHNTt8buwydrb9A=

GET
H2

204

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=20567959&cs_it=b3&cv=3.8.0.210223&ns__t=1662960702615&ns_c=UTF-8&c7=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&c8=Hot%20Springs%2...
https://sb.scorecardresearch.com/b2?c1=2&c2=20567959&cs_it=b3&cv=3.8.0.210223&ns__t=1662960702615&ns_c=UTF-8&c7=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&c8=Hot%20Springs%...

0
190 B

491ms
491ms

Image
text/plain

13.227.254.126
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=20567959&cs_it=b3&cv=3.8.0.210223&ns__t=1662960702615&ns_c=UTF-8&c7=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&c8=Hot%20Springs%20in%20California%20%7C%20Details%20and%20Map%20Information%20on%20Natural%20Warm%20Pools&c9=
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Server: 13.227.254.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-254-126.sin52.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN52-C3
x-amz-cf-id: 6QpDyI9eTzHjWBlaDh4LTjOdeMtLzZstfhWlzLWPpuKsofkF2krgwA==
x-cache: Miss from cloudfront

Redirect headers

location: /b2?c1=2&c2=20567959&cs_it=b3&cv=3.8.0.210223&ns__t=1662960702615&ns_c=UTF-8&c7=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&c8=Hot%20Springs%20in%20California%20%7C%20Details%20and%20Map%20Information%20on%20Natural%20Warm%20Pools&c9=
date: Mon, 12 Sep 2022 05:31:42 GMT
via: 1.1 db75d9999621c662b2eccf4f496b12aa.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN52-C3
content-length: 0
x-amz-cf-id: WNi2ji_RcDGHcLp3k10AYjoHwXjywu5yUov09joIpiLGs5CSxx9cdw==
x-cache: Miss from cloudfront

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
336 B 1114ms
368ms XHR
application/json 141.95.98.70
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://lb.eu-1-id5-sync.com/lb/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 141.95.98.70 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3216620.ip-141-95-98.eu
Software: /
Resource Hash: 07339db35e81e76dfef82f6246dfeea73ceabef2d7f8dd9c072370c252dbcfa1

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://leisurelylifestyle.com
date: Mon, 12 Sep 2022 05:31:42 GMT
transfer-encoding: chunked
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 64 B
417 B 394ms
394ms XHR
text/javascript 13.225.2.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&pid=KpQQqzf01toc9&cb=0&ws=1600x1200&v=22.8.252032&t=2600&slots=%5B%7B%22sd%22%3A%22AdThrive_Footer_1_desktop%22%2C%22s%22%3A%5B%22728x90%22%2C%22320x50%22%2C%22970x90%22%2C%22300x50%22%2C%22320x100%22%2C%22468x60%22%2C%221x1%22%5D%2C%22sn%22%3A%22%2F18190176%2FAdThrive_Footer_1%2F61d877f7514b73001b093e34%22%7D%5D&schain=1.0%2C1!cafemedia.com%2C61d877f7514b73001b093e34%2C1%2C%2C%2C&pubid=4fbba76f-7987-4fa2-9733-c27eb3a2170b&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.2.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-2-118.sin52.r.cloudfront.net
Software: Server /
Resource Hash: d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
via: 1.1 a6f10891bf05ce2d27b04a152b14cf00.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SIN52-C2
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 64
x-amz-cf-id: VMjLE8XhqmpGZajfNl-XPN8frZJBEPXHBusrIb8HgAYAQ6k48-5G1A==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 64 B
418 B 398ms
397ms XHR
text/javascript 13.225.2.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&pid=KpQQqzf01toc9&cb=1&ws=1600x1200&v=22.8.252032&t=2600&slots=%5B%7B%22sd%22%3A%22AdThrive_Sidebar_1_desktop%22%2C%22s%22%3A%5B%22300x250%22%2C%22320x50%22%2C%22300x50%22%2C%22320x100%22%2C%22250x250%22%2C%22120x240%22%2C%221x1%22%5D%2C%22sn%22%3A%22%2F18190176%2FAdThrive_Sidebar_1%2F61d877f7514b73001b093e34%22%7D%5D&schain=1.0%2C1!cafemedia.com%2C61d877f7514b73001b093e34%2C1%2C%2C%2C&pubid=4fbba76f-7987-4fa2-9733-c27eb3a2170b&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.2.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-2-118.sin52.r.cloudfront.net
Software: Server /
Resource Hash: 8db22950b3f47f686f4bad6b6d21386f03a4b0b24320c6715436424e41dcda09

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
via: 1.1 a6f10891bf05ce2d27b04a152b14cf00.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SIN52-C2
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 64
x-amz-cf-id: NwAYPNmErj-oNcBPLNpUx9EPCUZrxBG7vdrHyZQXWLYbajgbYribJA==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 64 B
415 B 398ms
398ms XHR
text/javascript 13.225.2.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&pid=KpQQqzf01toc9&cb=2&ws=1600x1200&v=22.8.252032&t=2600&slots=%5B%7B%22sd%22%3A%22AdThrive_Sidebar_9_desktop%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%2C%22320x50%22%2C%22160x600%22%2C%22300x1050%22%2C%22300x50%22%2C%22320x100%22%2C%22250x250%22%2C%22120x240%22%2C%221x1%22%2C%22300x420%22%5D%2C%22sn%22%3A%22%2F18190176%2FAdThrive_Sidebar_9%2F61d877f7514b73001b093e34%22%7D%5D&schain=1.0%2C1!cafemedia.com%2C61d877f7514b73001b093e34%2C1%2C%2C%2C&pubid=4fbba76f-7987-4fa2-9733-c27eb3a2170b&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.2.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-2-118.sin52.r.cloudfront.net
Software: Server /
Resource Hash: f0fe7e69e970311a87c3b57b217e6fc19f0a65b25813ad64426169712f61e402

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
via: 1.1 a6f10891bf05ce2d27b04a152b14cf00.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SIN52-C2
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 64
x-amz-cf-id: 0f_x5bDG1ZutrYYP1j7mZH0nQ90tnHDgDT4Bo-A8tXDJH8V93e6MIA==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 64 B
415 B 397ms
395ms XHR
text/javascript 13.225.2.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&pid=KpQQqzf01toc9&cb=3&ws=1600x1200&v=22.8.252032&t=2600&slots=%5B%7B%22sd%22%3A%22AdThrive_Content_1_desktop%22%2C%22s%22%3A%5B%22728x90%22%2C%22300x250%22%2C%22320x50%22%2C%22336x280%22%2C%22300x50%22%2C%22320x100%22%2C%22468x60%22%2C%22250x250%22%2C%22120x240%22%2C%221x1%22%2C%22300x300%22%2C%22552x334%22%2C%22728x250%22%5D%2C%22sn%22%3A%22%2F18190176%2FAdThrive_Content_1%2F61d877f7514b73001b093e34%22%7D%5D&schain=1.0%2C1!cafemedia.com%2C61d877f7514b73001b093e34%2C1%2C%2C%2C&pubid=4fbba76f-7987-4fa2-9733-c27eb3a2170b&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.2.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-2-118.sin52.r.cloudfront.net
Software: Server /
Resource Hash: e74fc9882fd1b046474630282635991e5aa59cb761302f13d7a304c1a3bae89b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
via: 1.1 a6f10891bf05ce2d27b04a152b14cf00.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SIN52-C2
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 64
x-amz-cf-id: c-T5GzxhqGp0rtuclrVWqUF1-F62_oUGT6zTtxWynuWz2CWI27e3sw==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 64 B
416 B 1115ms
1114ms XHR
text/javascript 13.225.2.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&pid=KpQQqzf01toc9&cb=4&ws=1600x1200&v=22.8.252032&t=2600&slots=%5B%7B%22sd%22%3A%22AdThrive_Content_2_desktop%22%2C%22s%22%3A%5B%22728x90%22%2C%22300x250%22%2C%22320x50%22%2C%22336x280%22%2C%22300x50%22%2C%22320x100%22%2C%22468x60%22%2C%22250x250%22%2C%22120x240%22%2C%221x1%22%2C%22300x300%22%2C%22552x334%22%2C%22728x250%22%5D%2C%22sn%22%3A%22%2F18190176%2FAdThrive_Content_2%2F61d877f7514b73001b093e34%22%7D%5D&schain=1.0%2C1!cafemedia.com%2C61d877f7514b73001b093e34%2C1%2C%2C%2C&pubid=4fbba76f-7987-4fa2-9733-c27eb3a2170b&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.2.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-2-118.sin52.r.cloudfront.net
Software: Server /
Resource Hash: 13ca66cf6767366a16dcab079a022ab7efaff7ad1f44fe904543916d56bb2d9b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
via: 1.1 a6f10891bf05ce2d27b04a152b14cf00.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SIN52-C2
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 64
x-amz-cf-id: c3KGSkAJ3vqwwac_yiBZZV6qe53PPH9P8Cp5oUb7gTrBFzMe8_r1Eg==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 64 B
416 B 1109ms
1109ms XHR
text/javascript 13.225.2.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&pid=KpQQqzf01toc9&cb=5&ws=1600x1200&v=22.8.252032&t=2600&slots=%5B%7B%22sd%22%3A%22AdThrive_Content_3_desktop%22%2C%22s%22%3A%5B%22728x90%22%2C%22300x250%22%2C%22320x50%22%2C%22336x280%22%2C%22300x50%22%2C%22320x100%22%2C%22468x60%22%2C%22250x250%22%2C%22120x240%22%2C%221x1%22%2C%22300x300%22%2C%22552x334%22%2C%22728x250%22%5D%2C%22sn%22%3A%22%2F18190176%2FAdThrive_Content_3%2F61d877f7514b73001b093e34%22%7D%5D&schain=1.0%2C1!cafemedia.com%2C61d877f7514b73001b093e34%2C1%2C%2C%2C&pubid=4fbba76f-7987-4fa2-9733-c27eb3a2170b&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.2.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-2-118.sin52.r.cloudfront.net
Software: Server /
Resource Hash: 0f790bdfb9c12c83da88b657a00be6b9aee3d14d167002faaa9562bc74404325

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
via: 1.1 a6f10891bf05ce2d27b04a152b14cf00.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SIN52-C2
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 64
x-amz-cf-id: VTApoWzHXGXGpDemsbKe77usDBhY6acq5GBHycT-3JdUJ27G1Egu5w==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 64 B
415 B 1107ms
1106ms XHR
text/javascript 13.225.2.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&pid=KpQQqzf01toc9&cb=6&ws=1600x1200&v=22.8.252032&t=2600&slots=%5B%7B%22sd%22%3A%22AdThrive_Content_4_desktop%22%2C%22s%22%3A%5B%22728x90%22%2C%22300x250%22%2C%22320x50%22%2C%22336x280%22%2C%22300x50%22%2C%22320x100%22%2C%22468x60%22%2C%22250x250%22%2C%22120x240%22%2C%221x1%22%2C%22300x300%22%2C%22552x334%22%2C%22728x250%22%5D%2C%22sn%22%3A%22%2F18190176%2FAdThrive_Content_4%2F61d877f7514b73001b093e34%22%7D%5D&schain=1.0%2C1!cafemedia.com%2C61d877f7514b73001b093e34%2C1%2C%2C%2C&pubid=4fbba76f-7987-4fa2-9733-c27eb3a2170b&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.2.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-2-118.sin52.r.cloudfront.net
Software: Server /
Resource Hash: 94c29c48fb53ccdc63a2b56d1a26802861de27934ab7263bbe897964df99a29a

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
via: 1.1 a6f10891bf05ce2d27b04a152b14cf00.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SIN52-C2
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 64
x-amz-cf-id: HiftfJs2NXeWWvu0vTAJT19gg2Wtjzqwz0o2nuuLx6YZICTz2XW0mg==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 64 B
416 B 1106ms
1106ms XHR
text/javascript 13.225.2.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&pid=KpQQqzf01toc9&cb=7&ws=1600x1200&v=22.8.252032&t=2600&slots=%5B%7B%22sd%22%3A%22AdThrive_Content_5_desktop%22%2C%22s%22%3A%5B%22728x90%22%2C%22300x250%22%2C%22320x50%22%2C%22336x280%22%2C%22300x50%22%2C%22320x100%22%2C%22468x60%22%2C%22250x250%22%2C%22120x240%22%2C%221x1%22%2C%22300x300%22%2C%22552x334%22%2C%22728x250%22%5D%2C%22sn%22%3A%22%2F18190176%2FAdThrive_Content_5%2F61d877f7514b73001b093e34%22%7D%5D&schain=1.0%2C1!cafemedia.com%2C61d877f7514b73001b093e34%2C1%2C%2C%2C&pubid=4fbba76f-7987-4fa2-9733-c27eb3a2170b&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.2.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-2-118.sin52.r.cloudfront.net
Software: Server /
Resource Hash: 6ad64bf64d7ef760e814445e08d04619c0bf54ea696a75bfdd9cccc619a7e070

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
via: 1.1 a6f10891bf05ce2d27b04a152b14cf00.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SIN52-C2
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 64
x-amz-cf-id: TZZZnK6ysuM9-6GoF0XHmPoiehlcvOqmRH3LRFHvFml3fOKLolg-Fw==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 64 B
417 B 1103ms
1101ms XHR
text/javascript 13.225.2.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&pid=KpQQqzf01toc9&cb=8&ws=1600x1200&v=22.8.252032&t=2600&slots=%5B%7B%22sd%22%3A%22AdThrive_Content_6_desktop%22%2C%22s%22%3A%5B%22728x90%22%2C%22300x250%22%2C%22320x50%22%2C%22336x280%22%2C%22300x50%22%2C%22320x100%22%2C%22468x60%22%2C%22250x250%22%2C%22120x240%22%2C%221x1%22%2C%22300x300%22%2C%22552x334%22%2C%22728x250%22%5D%2C%22sn%22%3A%22%2F18190176%2FAdThrive_Content_6%2F61d877f7514b73001b093e34%22%7D%5D&schain=1.0%2C1!cafemedia.com%2C61d877f7514b73001b093e34%2C1%2C%2C%2C&pubid=4fbba76f-7987-4fa2-9733-c27eb3a2170b&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.2.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-2-118.sin52.r.cloudfront.net
Software: Server /
Resource Hash: e037b729782246abdbae33c715af88164396dde1654c5b4f3d379dc058af8ab0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
via: 1.1 a6f10891bf05ce2d27b04a152b14cf00.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SIN52-C2
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 64
x-amz-cf-id: zMQIT2XcYm2-LUGyFgEuyG7FTDlRVwgq3hLLYwe5u81RPu17dZzc8g==

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 530ms
170ms Preflight 13.250.192.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.250.192.86 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-250-192-86.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://leisurelylifestyle.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://leisurelylifestyle.com
access-control-max-age: 600
age: 0
content-length: 0
date: Mon, 12 Sep 2022 05:31:43 GMT
server: ATS/9.1.10.25

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 530ms
170ms Preflight 13.250.192.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.250.192.86 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-250-192-86.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://leisurelylifestyle.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://leisurelylifestyle.com
access-control-max-age: 600
age: 0
content-length: 0
date: Mon, 12 Sep 2022 05:31:43 GMT
server: ATS/9.1.10.25

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 529ms
171ms Preflight 13.250.192.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.250.192.86 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-250-192-86.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://leisurelylifestyle.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://leisurelylifestyle.com
access-control-max-age: 600
age: 0
content-length: 0
date: Mon, 12 Sep 2022 05:31:43 GMT
server: ATS/9.1.10.25

POST
H2 200 cookie_sync Show response
prebid-server.rubiconproject.com/ 3 KB
870 B 1803ms
243ms XHR
application/json 52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/cookie_sync
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: ff59ee155203ce953186813567ab5b9716efdb78b0eea6cb4cb51802b869869b

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:44 GMT
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 650
expires: 0

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 354 B
514 B 2273ms
717ms XHR
application/json 52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 08323c6f38ce903bc13e30d908025a57ffaac7a8307d5c023b08d3d86d0db62c

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:44 GMT
content-encoding: gzip
x-prebid: pbs-java/1.97.0
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 275
expires: 0

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
368 B 833ms
297ms XHR
application/json 23.195.153.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.195.153.54 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-195-153-54.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Mon, 12 Sep 2022 05:31:43 GMT

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 37 B
313 B 806ms
609ms XHR
application/json 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=185770&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%2221d783c63e60ad6%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%3F%23PD%3Adesktop%23Source%3Adirect%23Browser%3AChrome%23Topic%3ATravel%23MCMP%3AAO_DATE%23MCMP%3ABA_WSKW20%23MCMP%3AAO_CHLD%23Sens%3Aalc%23Sens%3Aast%23Sens%3Acbd%23Sens%3Aconl%23Sens%3Acosm%23Sens%3Adat%23Sens%3Adlu%23Sens%3Adrg%23Sens%3Agamc%23Sens%3Agamv%23Sens%3Agrq%23Sens%3Apol%23Sens%3Arel%23Sens%3Asst%23Sens%3Assr%23Sens%3Asrh%23Sens%3Aske%23Sens%3Atob%23Sens%3Awtl%23vp%3A0%23MSFTA_2022%3ATrue%23TRGT_022020%3ATrue%23TYTA_22%3ATrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A2%2C%22msi%22%3A2%2C%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.27.0%22%2C%22userIds%22%3A%5B%5D%2C%22url%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22dms%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2222cb450f876fc94%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22185770%22%2C%22sid%22%3A%2212_1%22%7D%7D%2C%7B%22w%22%3A970%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22185770%22%2C%22sid%22%3A%2212_2%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22185770%22%2C%22sid%22%3A%2212_3%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A100%2C%22ext%22%3A%7B%22siteID%22%3A%22185770%22%2C%22sid%22%3A%2212_4%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22185770%22%2C%22sid%22%3A%2212_5%22%7D%7D%2C%7B%22w%22%3A468%2C%22h%22%3A60%2C%22ext%22%3A%7B%22siteID%22%3A%22185770%22%2C%22sid%22%3A%22468x60%22%7D%7D%2C%7B%22w%22%3A1%2C%22h%22%3A1%2C%22ext%22%3A%7B%22siteID%22%3A%22185770%22%2C%22sid%22%3A%221x1%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F18190176%2FAdThrive_Footer_1%2F61d877f7514b73001b093e34%22%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Footer_1%2F61d877f7514b73001b093e34%22%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%5D%7D%5D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f1c5d11e876fd4f0385466d0fe28159819555069eda2ddf2504e16ff69c9b2d0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bcRn%2FESBrUlJCTW4lJapg2wgkSgny0GBQddpk0IOyfAee2yINOL5VLvRSa6u5fnPZfoDn0ngWyI%2Bmo2qZU25D%2BoJtu%2BpZI27QYMPpeRnXMEqtPBJ0k%2Fi5f3JdBxBo7%2FcwzpevDN5"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7496422a3e37df9d-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
320 B 695ms
327ms XHR
application/json 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.27.0&cb=849798996

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:42 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
511 B 620ms
254ms XHR
application/json 52.220.232.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.27.0&referrer=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tmax=2800&us_privacy=1---

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.220.232.15 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
accept-ch: sec-ch-ua-mobile,sec-ch-save-data,sec-ch-device-memory,sec-ch-dpr,sec-ch-ua-full-version,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-viewport-width,sec-ch-ua-platform,sec-ch-viewport-height,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua,sec-ch-ua-bitness,sec-ch-prefers-color-scheme,sec-ch-width,sec-ch-ect,user-agent,sec-ch-downlink
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H/1.1 200
OK bid Show response
krk.kargo.com/api/v2/ 2 B
657 B 769ms
231ms XHR
application/json 52.77.87.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://krk.kargo.com/api/v2/bid?json=%7B%22sessionId%22%3A%2237119b77-34ef-49ba-9aef-270ab536c25b%22%2C%22requestCount%22%3A0%2C%22timeout%22%3A2800%2C%22currency%22%3A%22USD%22%2C%22cpmGranularity%22%3A1%2C%22timestamp%22%3A1662960702835%2C%22cpmRange%22%3A%7B%22floor%22%3A0%2C%22ceil%22%3A20%7D%2C%22bidIDs%22%3A%7B%2232f8e48bfab2aa4%22%3A%22_lP4vuVhICu%22%7D%2C%22bidSizes%22%3A%7B%2232f8e48bfab2aa4%22%3A%5B%5B728%2C90%5D%2C%5B320%2C50%5D%2C%5B970%2C90%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B1%2C1%5D%5D%7D%2C%22prebidRawBidRequests%22%3A%5B%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_lP4vuVhICu%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Footer_1%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Footer_1%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Footer_1%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B320%2C50%5D%2C%5B970%2C90%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B1%2C1%5D%5D%2C%22pos%22%3A1%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Footer_1_desktop%22%2C%22transactionId%22%3A%22266d9d39-88ee-4c87-95dc-8b53aab3eec1%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B320%2C50%5D%2C%5B970%2C90%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B1%2C1%5D%5D%2C%22bidId%22%3A%2232f8e48bfab2aa4%22%2C%22bidderRequestId%22%3A%2231a55c12c893312%22%2C%22auctionId%22%3A%22f09e1e03-e440-4c83-9ea2-a5bc60efea94%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A1%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%7D%5D%7D%7D%5D%2C%22userIDs%22%3A%7B%22crbIDs%22%3A%7B%7D%2C%22usp%22%3A%221---%22%7D%2C%22pageURL%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22rawCRB%22%3Anull%2C%22rawCRBLocalStorage%22%3Anull%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.87.101 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-87-101.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:43 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 26
X-Accel-Expires: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
467 B 609ms
235ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9694d00177771bcae21c6941d30023&pos=8a9694d00177771bcae21c6a7d880025&cmd=bid&sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&secure=1&us_privacy=1---
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 27a191c4122480016531535dce6a26387e0e07052351dba4e5a63dd44bec50e7

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
261 B 657ms
284ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9694d00177771bcae21c6941d30023&pos=8a969d580177771bc13c2046cd280081&cmd=bid&sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&secure=1&us_privacy=1---
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: ea322e7c722a1703da5f83fcd2cb59df6eb95d683622f991ee11cf68bb451314

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
260 B 628ms
255ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9694d00177771bcae21c6941d30023&pos=8a9694d00177771bcae2204408520056&cmd=bid&sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&secure=1&us_privacy=1---
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 615b86dfe63d1a25fa9ee51366f3ed757dba71dd5990dbe912fa0918fe36c3b5

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 62

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
121 B 595ms
202ms XHR
text/plain 103.231.98.193
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.193 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://leisurelylifestyle.com
date: Mon, 12 Sep 2022 05:31:43 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 617 B
1 KB 996ms
290ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881416&size_id=2&alt_size_ids=1%2C43%2C44%2C55%2C117%2C221&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!cafemedia.com,61d877f7514b73001b093e34,1,,,&eid_pubcid.org=d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%5E1&rf=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tg_i.mcmp=AO_DATE%2CBA_WSKW20%2CAO_CHLD&tg_i.site_code=MSFTA_2022%2CTRGT_022020%2CTYTA_22&tg_i.site_id=61d877f7514b73001b093e34&tg_i.sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&tg_i.verticals=Travel&tg_i.pmp_elig=true&tg_i.refresh=false&tg_i.vp=0&tg_i.pbadslot=%2F18190176%2FAdThrive_Footer_1%2F61d877f7514b73001b093e34&tk_flint=pbjs_lite_v6.27.0&x_source.tid=266d9d39-88ee-4c87-95dc-8b53aab3eec1&l_pb_bid_id=4031987cc70d0c&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F18190176%2FAdThrive_Footer_1%2F61d877f7514b73001b093e34&slots=1&rand=0.1553317308722595
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 4714e7a4f61252fa4b153c06d94f3723b9ae766fd9350991dbd905669a30ba5d

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
server: nginx/1.21.4
vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-type: application/json
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
265 B 265ms
262ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 07e663aadedfd939b751fcb27d904b59d7f10152e5a22cefc2cdcd048ab214b0

Request headers

Referer: https://leisurelylifestyle.com/
x-openrtb-version: 2.5
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
268 B 238ms
236ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 8f7faf9237ca89bfc97bdb567188f2aa0ccf3d6ffcc618fba575d7d4cb9fe25b

Request headers

Referer: https://leisurelylifestyle.com/
x-openrtb-version: 2.5
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
266 B 268ms
267ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: c2f4cdbf89c616277dc1a3f4d0a02ac6be8668abb34fdb7bd70d2c813773b124

Request headers

Referer: https://leisurelylifestyle.com/
x-openrtb-version: 2.5
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 66

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 144 B
1 KB 800ms
332ms XHR
application/json 104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-52-220-232-15.ap-southeast-1.compute.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

227313c27da16dff2065425ea37c627ed5c2f95428be1435657102ac2f5235d4

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:43 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 577022c8-cdec-489b-bb4f-c30c91e7ec06
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 144
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK cafemedia Show response
direct.adsrvr.org/bid/bidder/ 0
406 B 1581ms
1181ms XHR
application/json 13.248.136.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/cafemedia
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 13.248.136.210 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: af721359bfd441050.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
x-openrtb-version: 2.3
server: Kestrel
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 0

POST
H/1.1 200
OK / Show response
colossusssp.com/ 2 B
249 B 1361ms
346ms XHR
application/json 8.2.111.123
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://colossusssp.com/?c=o&m=multi
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 8.2.111.123 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://leisurelylifestyle.com
Date: Mon, 12 Sep 2022 05:31:44 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 2
Content-Type: application/json

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 3 KB
2 KB 871ms
381ms XHR
application/json 3.113.43.253
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?lt=1662960702869&to=0&aun=AdThrive_Footer_1_desktop&pubcid=d3020d20-0a91-4a3e-bc70-f9c4cb4bb728&gpid=%2F18190176%2FAdThrive_Footer_1%2F61d877f7514b73001b093e34&t=g95nznmj&pi=2&uspConsent=1---&schain=1.0%2C1!cafemedia.com%2C61d877f7514b73001b093e34%2C1%2C29f315b6-3a8b-4f6b-aa44-305cd9013abc%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%226.27.0%22%7D&ogu=null&ns=9523
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.113.43.253 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-113-43-253.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: c78df15d4838945ac29ef1d2afb40c01c336ac7ca5bb4b93e8343dfc58e9b6c5

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H2 200 cafemedia.js Show response
cdn.brandmetrics.com/tag/aa466d868b2742ffa2cc31bb6341dc12/ 5 KB
3 KB 336ms
132ms Script
text/javascript 104.26.7.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.brandmetrics.com/tag/aa466d868b2742ffa2cc31bb6341dc12/cafemedia.js
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/es2018/js/adthrive.min.js?deployment=2022-09-06-5:ade-249:pr2618:f56a6a1&experiments=amazonLoad,prebidLoad,gptLoad,rubiconFloors
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.7.155 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9c82d6bcab22dc402e1f0107c22fbd634c93515b112b29d51e58d03f559d2d22

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 12 Sep 2022 04:34:54 GMT
server: cloudflare
age: 3409
cf-polished: origSize=4927
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hs9Rokfe%2BTXHEdIqyiRWqrasfodGznK3Y85w6pbecAWoaFeX6AMhjwiE8ii8LY0pspBXFcYOqrFjKd90qjdxjS39QXELj4r%2FxBA7xKC1WPiyAnh2aZxRNFc9SnXzZxTi3vkF%2BYGd"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7496422a89ad5ac4-MEL
cf-bgj: minify

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 494ms
178ms Preflight 13.250.192.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.250.192.86 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-250-192-86.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://leisurelylifestyle.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://leisurelylifestyle.com
access-control-max-age: 600
age: 0
content-length: 0
date: Mon, 12 Sep 2022 05:31:43 GMT
server: ATS/9.1.10.25

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 6 KB
4 KB 2213ms
719ms XHR
application/json 52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 7730d0b4dce0eaceb42ceb301cb7939a725e32a664da0c6f818f1ea5cd4b4303

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:44 GMT
content-encoding: gzip
x-prebid: pbs-java/1.97.0
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 3404
expires: 0

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
368 B 905ms
429ms XHR
application/json 23.195.153.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.195.153.54 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-195-153-54.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Mon, 12 Sep 2022 05:31:43 GMT

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 37 B
568 B 593ms
453ms XHR
application/json 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=185787&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22793a9268893b049%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%3F%23PD%3Adesktop%23Source%3Adirect%23Browser%3AChrome%23Topic%3ATravel%23MCMP%3AAO_DATE%23MCMP%3ABA_WSKW20%23MCMP%3AAO_CHLD%23Sens%3Aalc%23Sens%3Aast%23Sens%3Acbd%23Sens%3Aconl%23Sens%3Acosm%23Sens%3Adat%23Sens%3Adlu%23Sens%3Adrg%23Sens%3Agamc%23Sens%3Agamv%23Sens%3Agrq%23Sens%3Apol%23Sens%3Arel%23Sens%3Asst%23Sens%3Assr%23Sens%3Asrh%23Sens%3Aske%23Sens%3Atob%23Sens%3Awtl%23vp%3A0%23MSFTA_2022%3ATrue%23TRGT_022020%3ATrue%23TYTA_22%3ATrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A5%2C%22msi%22%3A5%2C%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.27.0%22%2C%22userIds%22%3A%5B%5D%2C%22url%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22dms%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%228073c38889c3b45%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185787%22%2C%22sid%22%3A%2227_1%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22185787%22%2C%22sid%22%3A%2227_5%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22185787%22%2C%22sid%22%3A%22320x50%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A100%2C%22ext%22%3A%7B%22siteID%22%3A%22185787%22%2C%22sid%22%3A%22320x100%22%7D%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185787%22%2C%22sid%22%3A%22250x250%22%7D%7D%2C%7B%22w%22%3A120%2C%22h%22%3A240%2C%22ext%22%3A%7B%22siteID%22%3A%22185787%22%2C%22sid%22%3A%22120x240%22%7D%7D%2C%7B%22w%22%3A1%2C%22h%22%3A1%2C%22ext%22%3A%7B%22siteID%22%3A%22185787%22%2C%22sid%22%3A%221x1%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F18190176%2FAdThrive_Sidebar_1%2F61d877f7514b73001b093e34%22%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Sidebar_1%2F61d877f7514b73001b093e34%22%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%2229f315b6-3a8b-4f6b-aa44-305cd9013abc%22%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%5D%7D%5D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0819a7490443ccbf22f42db0ca6f07b399a6653cec297a712ec71d5d0c68c839

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=izRhfMgSgQcJwezEzdbZN84zw58KB8WtWgfUTNd2PUJ0cc1%2FAO7tLLAmDzMOO9PmCLmDM%2FEdxzlkjBFJms55qRfuVDc2G7hYOveQzB4a1Co9BZGjZUla1iYp6Tl1iRnBbHfPwgq0"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7496422a3e43df9d-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
319 B 815ms
503ms XHR
application/json 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.27.0&cb=46792013703

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:42 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 auction Show response
tlx.3lift.com/header/ 5 KB
3 KB 718ms
409ms XHR
application/json 52.220.232.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.27.0&referrer=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tmax=2800&us_privacy=1---

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.220.232.15 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

c94b3fc8bb12242d0117fdd721bfa78e4437d2daf3f622e8423f30c16a6ea256

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
content-encoding: gzip
accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-dpr,sec-ch-device-memory,sec-ch-save-data,sec-ch-ua-mobile,sec-ch-downlink,user-agent,sec-ch-ect,sec-ch-width,sec-ch-prefers-color-scheme,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-arch,sec-ch-rtt,sec-ch-viewport-height,sec-ch-ua-platform,sec-ch-viewport-width
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 2752
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H/1.1 200
OK bid Show response
krk.kargo.com/api/v2/ 2 B
657 B 973ms
406ms XHR
application/json 52.77.87.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://krk.kargo.com/api/v2/bid?json=%7B%22sessionId%22%3A%2237119b77-34ef-49ba-9aef-270ab536c25b%22%2C%22requestCount%22%3A1%2C%22timeout%22%3A2800%2C%22currency%22%3A%22USD%22%2C%22cpmGranularity%22%3A1%2C%22timestamp%22%3A1662960702891%2C%22cpmRange%22%3A%7B%22floor%22%3A0%2C%22ceil%22%3A20%7D%2C%22bidIDs%22%3A%7B%2287e12621d6a56a9%22%3A%22_mfu14jCkaN%22%7D%2C%22bidSizes%22%3A%7B%2287e12621d6a56a9%22%3A%5B%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%5D%7D%2C%22prebidRawBidRequests%22%3A%5B%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_mfu14jCkaN%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Sidebar_1%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Sidebar_1%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Sidebar_1%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%5D%2C%22pos%22%3A1%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Sidebar_1_desktop%22%2C%22transactionId%22%3A%22dc8c90ee-9c20-4928-8518-97bc37f3ebf8%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%5D%2C%22bidId%22%3A%2287e12621d6a56a9%22%2C%22bidderRequestId%22%3A%22866689636424da8%22%2C%22auctionId%22%3A%222dff3dc8-b1f1-4a32-823a-f37a9e86bdd9%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A1%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%2229f315b6-3a8b-4f6b-aa44-305cd9013abc%22%7D%5D%7D%7D%5D%2C%22userIDs%22%3A%7B%22crbIDs%22%3A%7B%7D%2C%22usp%22%3A%221---%22%7D%2C%22pageURL%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22rawCRB%22%3Anull%2C%22rawCRBLocalStorage%22%3Anull%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.87.101 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-87-101.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:43 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 26
X-Accel-Expires: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
261 B 586ms
265ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9694d00177771bcae21c6941d30023&pos=8a9694d00177771bcae2204449d80057&cmd=bid&sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&secure=1&us_privacy=1---
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: eb734fb61239ff7cffe41adeda72fa2ba4d7cfd5e0a9e7b0803fe189931c0715

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 62

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
65 B 731ms
388ms XHR
text/plain 103.231.98.193
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.193 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://leisurelylifestyle.com
date: Mon, 12 Sep 2022 05:31:43 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 617 B
1 KB 919ms
267ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881440&size_id=15&alt_size_ids=14%2C43%2C44%2C117%2C221&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!cafemedia.com,61d877f7514b73001b093e34,1,29f315b6-3a8b-4f6b-aa44-305cd9013abc,,&eid_pubcid.org=d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%5E1&rf=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tg_i.mcmp=AO_DATE%2CBA_WSKW20%2CAO_CHLD&tg_i.site_code=MSFTA_2022%2CTRGT_022020%2CTYTA_22&tg_i.site_id=61d877f7514b73001b093e34&tg_i.sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&tg_i.verticals=Travel&tg_i.pmp_elig=true&tg_i.refresh=false&tg_i.vp=0&tg_i.pbadslot=%2F18190176%2FAdThrive_Sidebar_1%2F61d877f7514b73001b093e34&tk_flint=pbjs_lite_v6.27.0&x_source.tid=dc8c90ee-9c20-4928-8518-97bc37f3ebf8&l_pb_bid_id=9375a29c8372402&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F18190176%2FAdThrive_Sidebar_1%2F61d877f7514b73001b093e34&slots=1&rand=0.36569742144289585
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: e19717a9635d126bb1d045bf745f13cad704c1dd7cf0e7464506a7fa4f9ac7fa

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:43 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 617
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
265 B 428ms
425ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 39d795c4b84136113431d52e3829e87b53015e54e70bf1ebc60926127db92090

Request headers

Referer: https://leisurelylifestyle.com/
x-openrtb-version: 2.5
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 66

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 144 B
1 KB 859ms
398ms XHR
application/json 104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-52-220-232-15.ap-southeast-1.compute.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

20333603dbdbc698311d7c5e65d79e89298781b59999a4dc2b1a1c9dc3a99ba9

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:43 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: d87aa859-d24f-490a-9611-0477257ffac0
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 144
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK cafemedia Show response
direct.adsrvr.org/bid/bidder/ 0
406 B 575ms
200ms XHR
application/json 13.248.136.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/cafemedia
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 13.248.136.210 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: af721359bfd441050.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:42 GMT
x-openrtb-version: 2.3
server: Kestrel
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 0

POST
H/1.1 200
OK / Show response
colossusssp.com/ 2 B
249 B 1342ms
340ms XHR
application/json 8.2.111.123
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://colossusssp.com/?c=o&m=multi
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 8.2.111.123 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://leisurelylifestyle.com
Date: Mon, 12 Sep 2022 05:31:44 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 2
Content-Type: application/json

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 436ms
171ms Preflight 13.250.192.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.250.192.86 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-250-192-86.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://leisurelylifestyle.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://leisurelylifestyle.com
access-control-max-age: 600
age: 0
content-length: 0
date: Mon, 12 Sep 2022 05:31:43 GMT
server: ATS/9.1.10.25

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 355 B
514 B 2179ms
743ms XHR
application/json 52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 57b51b79f4fb2c6dc47f65746cef173ab75810250eb648a6fa85f05942c713ca

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
x-prebid: pbs-java/1.97.0
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 275
expires: 0

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
368 B 714ms
297ms XHR
application/json 23.195.153.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.195.153.54 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-195-153-54.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Mon, 12 Sep 2022 05:31:43 GMT

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 37 B
310 B 637ms
556ms XHR
application/json 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=185762&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%222326497f463bba6%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%3F%23PD%3Adesktop%23Source%3Adirect%23Browser%3AChrome%23Topic%3ATravel%23MCMP%3AAO_DATE%23MCMP%3ABA_WSKW20%23MCMP%3AAO_CHLD%23Sens%3Aalc%23Sens%3Aast%23Sens%3Acbd%23Sens%3Aconl%23Sens%3Acosm%23Sens%3Adat%23Sens%3Adlu%23Sens%3Adrg%23Sens%3Agamc%23Sens%3Agamv%23Sens%3Agrq%23Sens%3Apol%23Sens%3Arel%23Sens%3Asst%23Sens%3Assr%23Sens%3Asrh%23Sens%3Aske%23Sens%3Atob%23Sens%3Awtl%23vp%3A0%23MSFTA_2022%3ATrue%23TRGT_022020%3ATrue%23TYTA_22%3ATrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A8%2C%22msi%22%3A8%2C%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.27.0%22%2C%22userIds%22%3A%5B%5D%2C%22url%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22dms%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22233528ce45723c67%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22185762%22%2C%22sid%22%3A%224_1%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185762%22%2C%22sid%22%3A%224_2%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22185762%22%2C%22sid%22%3A%224_4%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A100%2C%22ext%22%3A%7B%22siteID%22%3A%22185762%22%2C%22sid%22%3A%224_5%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22185762%22%2C%22sid%22%3A%224_6%22%7D%7D%2C%7B%22w%22%3A336%2C%22h%22%3A280%2C%22ext%22%3A%7B%22siteID%22%3A%22185762%22%2C%22sid%22%3A%22336x280%22%7D%7D%2C%7B%22w%22%3A468%2C%22h%22%3A60%2C%22ext%22%3A%7B%22siteID%22%3A%22185762%22%2C%22sid%22%3A%22468x60%22%7D%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185762%22%2C%22sid%22%3A%22250x250%22%7D%7D%2C%7B%22w%22%3A120%2C%22h%22%3A240%2C%22ext%22%3A%7B%22siteID%22%3A%22185762%22%2C%22sid%22%3A%22120x240%22%7D%7D%2C%7B%22w%22%3A1%2C%22h%22%3A1%2C%22ext%22%3A%7B%22siteID%22%3A%22185762%22%2C%22sid%22%3A%221x1%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A300%2C%22ext%22%3A%7B%22siteID%22%3A%22185762%22%2C%22sid%22%3A%22300x300%22%7D%7D%2C%7B%22w%22%3A552%2C%22h%22%3A334%2C%22ext%22%3A%7B%22siteID%22%3A%22185762%22%2C%22sid%22%3A%22552x334%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185762%22%2C%22sid%22%3A%22728x250%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F18190176%2FAdThrive_Content_2%2F61d877f7514b73001b093e34%22%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_2%2F61d877f7514b73001b093e34%22%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%22845da03a-60b3-4de9-a56e-6109610fb4fb%22%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%5D%7D%5D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 09e57e7f353f4655556ae7db3195c10a2f58dfc9f823647c9e03856941c37cb2

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a%2B807Q5tNeN8VW5pBa6UbEIlmzwjc0%2BLZg1fGzhp9DrVI6%2FfhDX%2B0gxKdm47HR4LZfSjmMAKHQyYh9iPBxO1avy21BzUx3sACL9fLAmdqrl6UxxzF2wJz6cnFzsD5C5Lzdj8SoI5"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7496422a3e40df9d-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
319 B 581ms
328ms XHR
application/json 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.27.0&cb=11310173207

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
512 B 498ms
245ms XHR
application/json 52.220.232.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.27.0&referrer=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tmax=2800&us_privacy=1---

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.220.232.15 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
accept-ch: sec-ch-ua-platform,sec-ch-viewport-width,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-dpr,sec-ch-device-memory,sec-ch-save-data,sec-ch-ua-mobile,sec-ch-downlink,user-agent,sec-ch-ect,sec-ch-width,sec-ch-prefers-color-scheme,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-arch,sec-ch-rtt,sec-ch-viewport-height
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H/1.1 200
OK bid Show response
krk.kargo.com/api/v2/ 2 B
657 B 850ms
311ms XHR
application/json 52.77.87.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://krk.kargo.com/api/v2/bid?json=%7B%22sessionId%22%3A%2237119b77-34ef-49ba-9aef-270ab536c25b%22%2C%22requestCount%22%3A2%2C%22timeout%22%3A2800%2C%22currency%22%3A%22USD%22%2C%22cpmGranularity%22%3A1%2C%22timestamp%22%3A1662960702949%2C%22cpmRange%22%3A%7B%22floor%22%3A0%2C%22ceil%22%3A20%7D%2C%22bidIDs%22%3A%7B%22243afd71bfd0f592%22%3A%22_mfu14jCkaN%22%2C%222447bb3b03241493%22%3A%22_vzS4k9rMKu%22%7D%2C%22bidSizes%22%3A%7B%22243afd71bfd0f592%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%222447bb3b03241493%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%2C%22prebidRawBidRequests%22%3A%5B%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_mfu14jCkaN%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content_2%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content_2%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_2%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_2_desktop%22%2C%22transactionId%22%3A%22b535e2ff-0872-4c30-93b7-f1ca4865ea91%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%22243afd71bfd0f592%22%2C%22bidderRequestId%22%3A%22242cd443e329c801%22%2C%22auctionId%22%3A%227d07361d-9d94-4804-8df6-cc9b6219105e%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%22845da03a-60b3-4de9-a56e-6109610fb4fb%22%7D%5D%7D%7D%2C%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_vzS4k9rMKu%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content_2%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content_2%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_2%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_2_desktop%22%2C%22transactionId%22%3A%22b535e2ff-0872-4c30-93b7-f1ca4865ea91%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%222447bb3b03241493%22%2C%22bidderRequestId%22%3A%22242cd443e329c801%22%2C%22auctionId%22%3A%227d07361d-9d94-4804-8df6-cc9b6219105e%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%22845da03a-60b3-4de9-a56e-6109610fb4fb%22%7D%5D%7D%7D%5D%2C%22userIDs%22%3A%7B%22crbIDs%22%3A%7B%7D%2C%22usp%22%3A%221---%22%7D%2C%22pageURL%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22rawCRB%22%3Anull%2C%22rawCRBLocalStorage%22%3Anull%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.87.101 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-87-101.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:43 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 26
X-Accel-Expires: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
260 B 527ms
261ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9694d00177771bcae21c6941d30023&pos=8a96918c0177771bc652204531fe0091&cmd=bid&sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&secure=1&us_privacy=1---
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: ffee7acf3df10e65739b92fad9d4c19c80e4d88760a4f6cee7b8fbd6ba960ada

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 62

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
65 B 680ms
392ms XHR
text/plain 103.231.98.193
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.193 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://leisurelylifestyle.com
date: Mon, 12 Sep 2022 05:31:43 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 623 B
951 B 940ms
337ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881400&size_id=15&alt_size_ids=2%2C1%2C14%2C16%2C43%2C44%2C48%2C117%2C221&us_privacy=1---&rp_schain=1.0,1!cafemedia.com,61d877f7514b73001b093e34,1,845da03a-60b3-4de9-a56e-6109610fb4fb,,&eid_pubcid.org=d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%5E1&rf=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tg_i.mcmp=AO_DATE%2CBA_WSKW20%2CAO_CHLD&tg_i.site_code=MSFTA_2022%2CTRGT_022020%2CTYTA_22&tg_i.site_id=61d877f7514b73001b093e34&tg_i.sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&tg_i.verticals=Travel&tg_i.pmp_elig=true&tg_i.refresh=false&tg_i.vp=0&tg_i.pbadslot=%2F18190176%2FAdThrive_Content_2%2F61d877f7514b73001b093e34&tk_flint=pbjs_lite_v6.27.0&x_source.tid=b535e2ff-0872-4c30-93b7-f1ca4865ea91&l_pb_bid_id=25073c4ab4e212f1&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F18190176%2FAdThrive_Content_2%2F61d877f7514b73001b093e34&slots=1&rand=0.17490487212716355
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: c45ab84b0dbc30dc5bf70f71780bbd3fd7d4c8031c540610180b9b99cffd0eb6

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
server: nginx/1.21.4
vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-type: application/json
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
265 B 244ms
243ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: b03ee71481d122b16aa745084cff56a646a85f246209c66b811fb9c26e354fc8

Request headers

Referer: https://leisurelylifestyle.com/
x-openrtb-version: 2.5
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 66

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 811ms
355ms XHR
application/json 104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-52-220-232-15.ap-southeast-1.compute.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

e0cc6863181bda0e3d29fdc76978a8a28742ca248a0d08f313f2af93af11591d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:43 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 2a8d7291-3122-4d62-9d00-4355bb424477
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK cafemedia Show response
direct.adsrvr.org/bid/bidder/ 0
406 B 565ms
189ms XHR
application/json 13.248.136.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/cafemedia
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 13.248.136.210 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: af721359bfd441050.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
x-openrtb-version: 2.3
server: Kestrel
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 0

POST
H/1.1 200
OK / Show response
colossusssp.com/ 2 B
249 B 1336ms
336ms XHR
application/json 8.2.111.123
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://colossusssp.com/?c=o&m=multi
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 8.2.111.123 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://leisurelylifestyle.com
Date: Mon, 12 Sep 2022 05:31:44 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 2
Content-Type: application/json

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 354 B
513 B 2125ms
718ms XHR
application/json 52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: afcea6778dab6484849d9766d8d0edbb9fb7e3b2cad7898de40eb9196127df1c

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:44 GMT
content-encoding: gzip
x-prebid: pbs-java/1.97.0
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 274
expires: 0

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
368 B 824ms
435ms XHR
application/json 23.195.153.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.195.153.54 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-195-153-54.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Mon, 12 Sep 2022 05:31:43 GMT

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 38 B
320 B 555ms
502ms XHR
application/json 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=185764&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22325351f867d003c1%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%3F%23PD%3Adesktop%23Source%3Adirect%23Browser%3AChrome%23Topic%3ATravel%23MCMP%3AAO_DATE%23MCMP%3ABA_WSKW20%23MCMP%3AAO_CHLD%23Sens%3Aalc%23Sens%3Aast%23Sens%3Acbd%23Sens%3Aconl%23Sens%3Acosm%23Sens%3Adat%23Sens%3Adlu%23Sens%3Adrg%23Sens%3Agamc%23Sens%3Agamv%23Sens%3Agrq%23Sens%3Apol%23Sens%3Arel%23Sens%3Asst%23Sens%3Assr%23Sens%3Asrh%23Sens%3Aske%23Sens%3Atob%23Sens%3Awtl%23vp%3A0%23MSFTA_2022%3ATrue%23TRGT_022020%3ATrue%23TYTA_22%3ATrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A9%2C%22msi%22%3A9%2C%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.27.0%22%2C%22userIds%22%3A%5B%5D%2C%22url%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22dms%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22326a6aa57c112119%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185764%22%2C%22sid%22%3A%226_1%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22185764%22%2C%22sid%22%3A%226_2%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A100%2C%22ext%22%3A%7B%22siteID%22%3A%22185764%22%2C%22sid%22%3A%226_3%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22185764%22%2C%22sid%22%3A%226_4%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22185764%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A336%2C%22h%22%3A280%2C%22ext%22%3A%7B%22siteID%22%3A%22185764%22%2C%22sid%22%3A%22336x280%22%7D%7D%2C%7B%22w%22%3A468%2C%22h%22%3A60%2C%22ext%22%3A%7B%22siteID%22%3A%22185764%22%2C%22sid%22%3A%22468x60%22%7D%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185764%22%2C%22sid%22%3A%22250x250%22%7D%7D%2C%7B%22w%22%3A120%2C%22h%22%3A240%2C%22ext%22%3A%7B%22siteID%22%3A%22185764%22%2C%22sid%22%3A%22120x240%22%7D%7D%2C%7B%22w%22%3A1%2C%22h%22%3A1%2C%22ext%22%3A%7B%22siteID%22%3A%22185764%22%2C%22sid%22%3A%221x1%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A300%2C%22ext%22%3A%7B%22siteID%22%3A%22185764%22%2C%22sid%22%3A%22300x300%22%7D%7D%2C%7B%22w%22%3A552%2C%22h%22%3A334%2C%22ext%22%3A%7B%22siteID%22%3A%22185764%22%2C%22sid%22%3A%22552x334%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185764%22%2C%22sid%22%3A%22728x250%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F18190176%2FAdThrive_Content_4%2F61d877f7514b73001b093e34%22%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_4%2F61d877f7514b73001b093e34%22%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%22339848ae-dcce-4fa0-94d5-891de72efd4b%22%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%5D%7D%5D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 98f72e00f31ef9873633b5a5ab7b889c2bcf114fdce5ad017ace9f71cded44b2

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=thJ6M0W%2FAmZ2cScA2G7L3Jybv8oP%2FeSPnsf52qJt3XJk7M8pzWDcBkXcejyUgzUuqHSBiVIBo%2BrI1yM7ZjwX3UovswY8%2FtjVT6%2B9vQE%2FO2ZkTDKmHCOXhnKb9hhrCD%2FlV8EJ7UeX"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7496422acf30df9d-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 38
expires: 0

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
319 B 754ms
529ms XHR
application/json 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.27.0&cb=98348544292

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:42 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
511 B 676ms
451ms XHR
application/json 52.220.232.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.27.0&referrer=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tmax=2800&us_privacy=1---

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.220.232.15 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
accept-ch: sec-ch-prefers-color-scheme,sec-ch-width,sec-ch-ect,user-agent,sec-ch-downlink,sec-ch-ua-mobile,sec-ch-save-data,sec-ch-device-memory,sec-ch-dpr,sec-ch-ua-full-version,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-viewport-width,sec-ch-ua-platform,sec-ch-viewport-height,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua,sec-ch-ua-bitness
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H/1.1 200
OK bid Show response
krk.kargo.com/api/v2/ 2 B
657 B 823ms
295ms XHR
application/json 52.77.87.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://krk.kargo.com/api/v2/bid?json=%7B%22sessionId%22%3A%2237119b77-34ef-49ba-9aef-270ab536c25b%22%2C%22requestCount%22%3A3%2C%22timeout%22%3A2800%2C%22currency%22%3A%22USD%22%2C%22cpmGranularity%22%3A1%2C%22timestamp%22%3A1662960702976%2C%22cpmRange%22%3A%7B%22floor%22%3A0%2C%22ceil%22%3A20%7D%2C%22bidIDs%22%3A%7B%223359e9fb2ad77e29%22%3A%22_mfu14jCkaN%22%2C%22336c2acb79df4b1a%22%3A%22_vzS4k9rMKu%22%7D%2C%22bidSizes%22%3A%7B%223359e9fb2ad77e29%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22336c2acb79df4b1a%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%2C%22prebidRawBidRequests%22%3A%5B%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_mfu14jCkaN%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content_4%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content_4%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_4%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_4_desktop%22%2C%22transactionId%22%3A%22650718d5-0f79-4807-980a-a42094f2fbfa%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%223359e9fb2ad77e29%22%2C%22bidderRequestId%22%3A%2233492c95bee48986%22%2C%22auctionId%22%3A%22c4ba9e47-822d-4906-adac-e3bcc0938482%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%22339848ae-dcce-4fa0-94d5-891de72efd4b%22%7D%5D%7D%7D%2C%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_vzS4k9rMKu%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content_4%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content_4%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_4%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_4_desktop%22%2C%22transactionId%22%3A%22650718d5-0f79-4807-980a-a42094f2fbfa%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%22336c2acb79df4b1a%22%2C%22bidderRequestId%22%3A%2233492c95bee48986%22%2C%22auctionId%22%3A%22c4ba9e47-822d-4906-adac-e3bcc0938482%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%22339848ae-dcce-4fa0-94d5-891de72efd4b%22%7D%5D%7D%7D%5D%2C%22userIDs%22%3A%7B%22crbIDs%22%3A%7B%7D%2C%22usp%22%3A%221---%22%7D%2C%22pageURL%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22rawCRB%22%3Anull%2C%22rawCRBLocalStorage%22%3Anull%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.87.101 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-87-101.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:43 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 26
X-Accel-Expires: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
65 B 657ms
394ms XHR
text/plain 103.231.98.193
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.193 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://leisurelylifestyle.com
date: Mon, 12 Sep 2022 05:31:43 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 623 B
952 B 944ms
366ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881404&size_id=15&alt_size_ids=2%2C1%2C14%2C16%2C43%2C44%2C48%2C117%2C221&us_privacy=1---&rp_schain=1.0,1!cafemedia.com,61d877f7514b73001b093e34,1,339848ae-dcce-4fa0-94d5-891de72efd4b,,&eid_pubcid.org=d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%5E1&rf=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tg_i.mcmp=AO_DATE%2CBA_WSKW20%2CAO_CHLD&tg_i.site_code=MSFTA_2022%2CTRGT_022020%2CTYTA_22&tg_i.site_id=61d877f7514b73001b093e34&tg_i.sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&tg_i.verticals=Travel&tg_i.pmp_elig=true&tg_i.refresh=false&tg_i.vp=0&tg_i.pbadslot=%2F18190176%2FAdThrive_Content_4%2F61d877f7514b73001b093e34&tk_flint=pbjs_lite_v6.27.0&x_source.tid=650718d5-0f79-4807-980a-a42094f2fbfa&l_pb_bid_id=340216846a403dcc&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F18190176%2FAdThrive_Content_4%2F61d877f7514b73001b093e34&slots=1&rand=0.37625768947988036
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 5ca8b9e61bd209e142c9900b031afb4c69d4becaea04c28ff84f2a188d373d8e

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
server: nginx/1.21.4
vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-type: application/json
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 17 KB
9 KB 783ms
327ms XHR
application/json 104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-52-220-232-15.ap-southeast-1.compute.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

8a9773d57d0c12efbb1553939c0c6d38ba6aa3930e56e37226071b1fcbb9df4d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 12 Sep 2022 05:31:43 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: e5713e1a-d401-478f-be4b-62fddbaae51a
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK cafemedia Show response
direct.adsrvr.org/bid/bidder/ 0
406 B 589ms
191ms XHR
application/json 13.248.136.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/cafemedia
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 13.248.136.210 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: af721359bfd441050.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
x-openrtb-version: 2.3
server: Kestrel
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 0

POST
H/1.1 200
OK / Show response
colossusssp.com/ 2 B
249 B 1345ms
341ms XHR
application/json 8.2.111.123
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://colossusssp.com/?c=o&m=multi
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 8.2.111.123 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://leisurelylifestyle.com
Date: Mon, 12 Sep 2022 05:31:44 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 2
Content-Type: application/json

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 354 B
515 B 2139ms
747ms XHR
application/json 52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 672b393658377fb7a438604d768e8000e97dcdf65e33abde1757e57aba214d2f

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
x-prebid: pbs-java/1.97.0
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 276
expires: 0

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
368 B 683ms
308ms XHR
application/json 23.195.153.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.195.153.54 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-195-153-54.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Mon, 12 Sep 2022 05:31:43 GMT

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 38 B
307 B 735ms
695ms XHR
application/json 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=185765&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22367f9d84c2bd852d%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%3F%23PD%3Adesktop%23Source%3Adirect%23Browser%3AChrome%23Topic%3ATravel%23MCMP%3AAO_DATE%23MCMP%3ABA_WSKW20%23MCMP%3AAO_CHLD%23Sens%3Aalc%23Sens%3Aast%23Sens%3Acbd%23Sens%3Aconl%23Sens%3Acosm%23Sens%3Adat%23Sens%3Adlu%23Sens%3Adrg%23Sens%3Agamc%23Sens%3Agamv%23Sens%3Agrq%23Sens%3Apol%23Sens%3Arel%23Sens%3Asst%23Sens%3Assr%23Sens%3Asrh%23Sens%3Aske%23Sens%3Atob%23Sens%3Awtl%23vp%3A0%23MSFTA_2022%3ATrue%23TRGT_022020%3ATrue%23TYTA_22%3ATrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A9%2C%22msi%22%3A9%2C%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.27.0%22%2C%22userIds%22%3A%5B%5D%2C%22url%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22dms%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22368b3b35febaf235%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185765%22%2C%22sid%22%3A%227_1%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22185765%22%2C%22sid%22%3A%227_2%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A100%2C%22ext%22%3A%7B%22siteID%22%3A%22185765%22%2C%22sid%22%3A%227_3%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22185765%22%2C%22sid%22%3A%227_4%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22185765%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A336%2C%22h%22%3A280%2C%22ext%22%3A%7B%22siteID%22%3A%22185765%22%2C%22sid%22%3A%22336x280%22%7D%7D%2C%7B%22w%22%3A468%2C%22h%22%3A60%2C%22ext%22%3A%7B%22siteID%22%3A%22185765%22%2C%22sid%22%3A%22468x60%22%7D%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185765%22%2C%22sid%22%3A%22250x250%22%7D%7D%2C%7B%22w%22%3A120%2C%22h%22%3A240%2C%22ext%22%3A%7B%22siteID%22%3A%22185765%22%2C%22sid%22%3A%22120x240%22%7D%7D%2C%7B%22w%22%3A1%2C%22h%22%3A1%2C%22ext%22%3A%7B%22siteID%22%3A%22185765%22%2C%22sid%22%3A%221x1%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A300%2C%22ext%22%3A%7B%22siteID%22%3A%22185765%22%2C%22sid%22%3A%22300x300%22%7D%7D%2C%7B%22w%22%3A552%2C%22h%22%3A334%2C%22ext%22%3A%7B%22siteID%22%3A%22185765%22%2C%22sid%22%3A%22552x334%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185765%22%2C%22sid%22%3A%22728x250%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F18190176%2FAdThrive_Content_5%2F61d877f7514b73001b093e34%22%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_5%2F61d877f7514b73001b093e34%22%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%22339848ae-dcce-4fa0-94d5-891de72efd4b%22%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%5D%7D%5D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b844a9c10c867a07c4f7bc929e928d4bacd51c05513c6e62a639887896702298

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2MOz2tQ288ajWAvkLQQVqEoIY8qxEpCLIEEuDcUR0XGUDZ4KwUxoOQV3BI6nNQ8i0q6uUyv118%2B3cNpVCMDI7Tk1RaiqjbiY5eR3HvF8ofLTr52bmm7TWOogUTJ79GfcnfNsF46i"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7496422a3e3ddf9d-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 38
expires: 0

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
319 B 564ms
354ms XHR
application/json 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.27.0&cb=43834535153

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:42 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
511 B 474ms
265ms XHR
application/json 52.220.232.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.27.0&referrer=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tmax=2800&us_privacy=1---

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.220.232.15 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
accept-ch: user-agent,sec-ch-ect,sec-ch-width,sec-ch-prefers-color-scheme,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-arch,sec-ch-rtt,sec-ch-viewport-height,sec-ch-ua-platform,sec-ch-viewport-width,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-dpr,sec-ch-device-memory,sec-ch-save-data,sec-ch-ua-mobile,sec-ch-downlink
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H/1.1 200
OK bid Show response
krk.kargo.com/api/v2/ 2 B
657 B 884ms
263ms XHR
application/json 52.77.87.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://krk.kargo.com/api/v2/bid?json=%7B%22sessionId%22%3A%2237119b77-34ef-49ba-9aef-270ab536c25b%22%2C%22requestCount%22%3A4%2C%22timeout%22%3A2800%2C%22currency%22%3A%22USD%22%2C%22cpmGranularity%22%3A1%2C%22timestamp%22%3A1662960702992%2C%22cpmRange%22%3A%7B%22floor%22%3A0%2C%22ceil%22%3A20%7D%2C%22bidIDs%22%3A%7B%22377755916a531929%22%3A%22_mfu14jCkaN%22%2C%22378ba2e199ca44ea%22%3A%22_vzS4k9rMKu%22%7D%2C%22bidSizes%22%3A%7B%22377755916a531929%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22378ba2e199ca44ea%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%2C%22prebidRawBidRequests%22%3A%5B%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_mfu14jCkaN%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content_5%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content_5%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_5%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_5_desktop%22%2C%22transactionId%22%3A%2209aa0bac-15f5-44ec-8393-e40497531671%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%22377755916a531929%22%2C%22bidderRequestId%22%3A%223760125124a94ffe%22%2C%22auctionId%22%3A%2244955f36-07c3-4d3e-8cb7-9e2ef0abb927%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%22339848ae-dcce-4fa0-94d5-891de72efd4b%22%7D%5D%7D%7D%2C%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_vzS4k9rMKu%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content_5%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content_5%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_5%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_5_desktop%22%2C%22transactionId%22%3A%2209aa0bac-15f5-44ec-8393-e40497531671%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%22378ba2e199ca44ea%22%2C%22bidderRequestId%22%3A%223760125124a94ffe%22%2C%22auctionId%22%3A%2244955f36-07c3-4d3e-8cb7-9e2ef0abb927%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%22339848ae-dcce-4fa0-94d5-891de72efd4b%22%7D%5D%7D%7D%5D%2C%22userIDs%22%3A%7B%22crbIDs%22%3A%7B%7D%2C%22usp%22%3A%221---%22%7D%2C%22pageURL%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22rawCRB%22%3Anull%2C%22rawCRBLocalStorage%22%3Anull%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.87.101 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-87-101.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:43 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 26
X-Accel-Expires: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
65 B 634ms
387ms XHR
text/plain 103.231.98.193
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.193 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://leisurelylifestyle.com
date: Mon, 12 Sep 2022 05:31:43 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 623 B
951 B 854ms
292ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881406&size_id=15&alt_size_ids=2%2C1%2C14%2C16%2C43%2C44%2C48%2C117%2C221&us_privacy=1---&rp_schain=1.0,1!cafemedia.com,61d877f7514b73001b093e34,1,339848ae-dcce-4fa0-94d5-891de72efd4b,,&eid_pubcid.org=d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%5E1&rf=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tg_i.mcmp=AO_DATE%2CBA_WSKW20%2CAO_CHLD&tg_i.site_code=MSFTA_2022%2CTRGT_022020%2CTYTA_22&tg_i.site_id=61d877f7514b73001b093e34&tg_i.sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&tg_i.verticals=Travel&tg_i.pmp_elig=true&tg_i.refresh=false&tg_i.vp=0&tg_i.pbadslot=%2F18190176%2FAdThrive_Content_5%2F61d877f7514b73001b093e34&tk_flint=pbjs_lite_v6.27.0&x_source.tid=09aa0bac-15f5-44ec-8393-e40497531671&l_pb_bid_id=382f834d7922ea18&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F18190176%2FAdThrive_Content_5%2F61d877f7514b73001b093e34&slots=1&rand=0.3330195183557365
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 37d37ec4d75c051355d91134a02d50fda3da1376c18c598034ae8edee040a45a

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:43 GMT
server: nginx/1.21.4
vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-type: application/json
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 889ms
428ms XHR
application/json 104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

nginx/1.21.3 /

Resource Hash

8cb9524a26f23f8c709643663ca3c738cdebf86b1c3107bcf095bfbba8878c96

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:43 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: a7e290a7-67ed-44ff-8415-935304f10ceb
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK cafemedia Show response
direct.adsrvr.org/bid/bidder/ 0
406 B 681ms
189ms XHR
application/json 13.248.136.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/cafemedia
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 13.248.136.210 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: af721359bfd441050.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:43 GMT
x-openrtb-version: 2.3
server: Kestrel
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 0

POST
H/1.1 200
OK / Show response
colossusssp.com/ 2 B
249 B 1340ms
340ms XHR
application/json 8.2.111.123
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://colossusssp.com/?c=o&m=multi
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 8.2.111.123 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://leisurelylifestyle.com
Date: Mon, 12 Sep 2022 05:31:44 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 2
Content-Type: application/json

GET
H2 200 65568.js Show response
cdn.brandmetrics.com/scripts/bundle/ 42 KB
14 KB 1288ms
1287ms Script
text/javascript 104.26.7.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.brandmetrics.com/scripts/bundle/65568.js?sid=f9816ecc-b51b-4747-bc3e-1ea86a0677a2&toploc=leisurelylifestyle.com
Requested by: Host: cdn.brandmetrics.com
URL: https://cdn.brandmetrics.com/tag/aa466d868b2742ffa2cc31bb6341dc12/cafemedia.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.7.155 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e438b5c5fd37d4b4a7a1c5f2b1469d90091e2aed6940ea0fa7e7baf9d5b9839

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:44 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Mon, 12 Sep 2022 00:36:44 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JiJKDoY6hz2Za5rVRq85ncXhX3RBCSn0%2Bfj08arp7ijy0y1S2zOwNBdA%2FqIklBT%2BR%2FiE%2BaMc4p0ZzvzdvTmem4bSHQ4VEZrj%2FBX04kNpryO96dFmbbt8oecEAAXRYRErWGpFx%2F93"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7496422b5b4e5ac4-MEL

POST
H/1.1 200 367.json Show response
id5-sync.com/g/v2/ 457 B
1 KB 1110ms
370ms XHR
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/367.json

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

26aefa5026ab7424a5c1774072383b5caa7ae0d22c06d1df9290e00b5351b676

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:44 GMT
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
p3p: CP="CAO PSA OUR"
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/json;charset=UTF-8
transfer-encoding: chunked

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
375 B 181ms
181ms XHR
text/javascript 13.225.2.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&pid=KpQQqzf01toc9&cb=9&ws=1600x1200&v=22.8.252032&t=2600&slots=%5B%7B%22sd%22%3A%22AdThrive_Content_8_desktop%22%2C%22s%22%3A%5B%22728x90%22%2C%22300x250%22%2C%22320x50%22%2C%22336x280%22%2C%22300x50%22%2C%22320x100%22%2C%22468x60%22%2C%22250x250%22%2C%22120x240%22%2C%221x1%22%2C%22300x300%22%2C%22552x334%22%2C%22728x250%22%5D%2C%22sn%22%3A%22%2F18190176%2FAdThrive_Content_8%2F61d877f7514b73001b093e34%22%7D%5D&cfgv=1&schain=1.0%2C1!cafemedia.com%2C61d877f7514b73001b093e34%2C1%2C%2C%2C&pubid=4fbba76f-7987-4fa2-9733-c27eb3a2170b&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.2.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-2-118.sin52.r.cloudfront.net
Software: Server /
Resource Hash: 4b8f230af668f20a7b50021f1edb1fac1c96cab1aa576933a2064e5d7807179b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:44 GMT
via: 1.1 a6f10891bf05ce2d27b04a152b14cf00.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SIN52-C2
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: 9Mz5qDyjdCSv0BKhqrTc970_pZQQ4rE51w9sdGIm9nLKef4wjDBa_w==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 24 B
375 B 182ms
182ms XHR
text/javascript 13.225.2.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&pid=KpQQqzf01toc9&cb=10&ws=1600x1200&v=22.8.252032&t=2600&slots=%5B%7B%22sd%22%3A%22AdThrive_Content_10_desktop%22%2C%22s%22%3A%5B%22728x90%22%2C%22300x250%22%2C%22320x50%22%2C%22336x280%22%2C%22300x50%22%2C%22320x100%22%2C%22468x60%22%2C%22250x250%22%2C%22120x240%22%2C%221x1%22%2C%22300x300%22%2C%22552x334%22%2C%22728x250%22%5D%2C%22sn%22%3A%22%2F18190176%2FAdThrive_Content_10%2F61d877f7514b73001b093e34%22%7D%5D&cfgv=1&schain=1.0%2C1!cafemedia.com%2C61d877f7514b73001b093e34%2C1%2C%2C%2C&pubid=4fbba76f-7987-4fa2-9733-c27eb3a2170b&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.2.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-2-118.sin52.r.cloudfront.net
Software: Server /
Resource Hash: b84677c9d507861ede2db86349957b3fff926d3857fb11595ab96d8866314798

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:44 GMT
via: 1.1 a6f10891bf05ce2d27b04a152b14cf00.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SIN52-C2
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 24
x-amz-cf-id: aYz9_3oltoYhpmEO22q7CVrvxkcS9lFoT06hWhNDLWsPAy6T6B_VBA==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 24 B
376 B 181ms
180ms XHR
text/javascript 13.225.2.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&pid=KpQQqzf01toc9&cb=11&ws=1600x1200&v=22.8.252032&t=2600&slots=%5B%7B%22sd%22%3A%22AdThrive_Content_9_desktop%22%2C%22s%22%3A%5B%22728x90%22%2C%22300x250%22%2C%22320x50%22%2C%22336x280%22%2C%22300x50%22%2C%22320x100%22%2C%22468x60%22%2C%22250x250%22%2C%22120x240%22%2C%221x1%22%2C%22300x300%22%2C%22552x334%22%2C%22728x250%22%5D%2C%22sn%22%3A%22%2F18190176%2FAdThrive_Content_9%2F61d877f7514b73001b093e34%22%7D%5D&cfgv=1&schain=1.0%2C1!cafemedia.com%2C61d877f7514b73001b093e34%2C1%2C%2C%2C&pubid=4fbba76f-7987-4fa2-9733-c27eb3a2170b&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.2.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-2-118.sin52.r.cloudfront.net
Software: Server /
Resource Hash: 843ca27aa5a55f23f36493f7a6c93bd16bae165e07e4be441ea45723b586eae2

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:44 GMT
via: 1.1 a6f10891bf05ce2d27b04a152b14cf00.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SIN52-C2
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 24
x-amz-cf-id: WiBBNBvpcqaUlOyJ82wnGAtQrwHDtA1wz6PYtyBuAoIvRVkeuVZt0g==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 24 B
377 B 180ms
180ms XHR
text/javascript 13.225.2.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&pid=KpQQqzf01toc9&cb=12&ws=1600x1200&v=22.8.252032&t=2600&slots=%5B%7B%22sd%22%3A%22AdThrive_Content_7_desktop%22%2C%22s%22%3A%5B%22728x90%22%2C%22300x250%22%2C%22320x50%22%2C%22336x280%22%2C%22300x50%22%2C%22320x100%22%2C%22468x60%22%2C%22250x250%22%2C%22120x240%22%2C%221x1%22%2C%22300x300%22%2C%22552x334%22%2C%22728x250%22%5D%2C%22sn%22%3A%22%2F18190176%2FAdThrive_Content_7%2F61d877f7514b73001b093e34%22%7D%5D&cfgv=1&schain=1.0%2C1!cafemedia.com%2C61d877f7514b73001b093e34%2C1%2C%2C%2C&pubid=4fbba76f-7987-4fa2-9733-c27eb3a2170b&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.2.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-2-118.sin52.r.cloudfront.net
Software: Server /
Resource Hash: 63c3f35eed8f9fae951373f4f0642d09521b1b86c8d3a6d679047bc5440790fb

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:44 GMT
via: 1.1 a6f10891bf05ce2d27b04a152b14cf00.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SIN52-C2
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 24
x-amz-cf-id: kjbVqmm5H8gwQGhLGEjWvW-NT7hiS0gXB2yQiCGOx4bCjRxhyKiTGA==

GET
H2 200 c.js Show response
collector.brandmetrics.com/ 0
76 B 1012ms
325ms Script
text/javascript 20.50.2.28
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://collector.brandmetrics.com/c.js?siteid=f9816ecc-b51b-4747-bc3e-1ea86a0677a2&toploc=leisurelylifestyle.com&rnd=7390760
Requested by: Host: cdn.brandmetrics.com
URL: https://cdn.brandmetrics.com/scripts/bundle/65568.js?sid=f9816ecc-b51b-4747-bc3e-1ea86a0677a2&toploc=leisurelylifestyle.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.50.2.28 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:44 GMT
content-length: 0
content-type: text/javascript;charset=utf-8

GET
H2

200

setuid
prebid-server.rubiconproject.com/
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=rp-pbs&gdpr=&gdpr_consent=&account=9262&us_privacy=1---
https://prebid-server.rubiconproject.com/setuid?bidder=rubicon&account=9262&uid=L7YBV74B-1L-JU5B&us_privacy=1---

86 B
609 B

242ms
241ms

Image
image/png

52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-server.rubiconproject.com/setuid?bidder=rubicon&account=9262&uid=L7YBV74B-1L-JU5B&us_privacy=1---
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/png
content-encoding: gzip
expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://prebid-server.rubiconproject.com/setuid?bidder=rubicon&account=9262&uid=L7YBV74B-1L-JU5B&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: d335433bbbe0efeac67146df47932f6f
Expires: 0

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 170ms
169ms Preflight 13.250.192.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.250.192.86 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-250-192-86.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://leisurelylifestyle.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://leisurelylifestyle.com
access-control-max-age: 600
age: 0
content-length: 0
date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 172ms
170ms Preflight 13.250.192.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.250.192.86 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-250-192-86.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://leisurelylifestyle.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://leisurelylifestyle.com
access-control-max-age: 600
age: 0
content-length: 0
date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 172ms
170ms Preflight 13.250.192.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.250.192.86 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-250-192-86.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://leisurelylifestyle.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://leisurelylifestyle.com
access-control-max-age: 600
age: 0
content-length: 0
date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 171ms
169ms Preflight 13.250.192.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.250.192.86 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-250-192-86.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://leisurelylifestyle.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://leisurelylifestyle.com
access-control-max-age: 600
age: 0
content-length: 0
date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 355 B
514 B 508ms
507ms XHR
application/json 52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 040d054e99f7069d466070843189fa98de283d5ef2eee73e479c97a05272cb14

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
x-prebid: pbs-java/1.97.0
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 275
expires: 0

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
253 B 254ms
254ms XHR
application/json 23.195.153.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.195.153.54 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-195-153-54.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Mon, 12 Sep 2022 05:31:45 GMT

GET
H3 200 cygnus Show response
htlb.casalemedia.com/ 38 B
544 B 610ms
509ms XHR
application/json 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=185795&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%221248a87b1e102f48%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%3F%23PD%3Adesktop%23Source%3Adirect%23Browser%3AChrome%23Topic%3ATravel%23MCMP%3AAO_DATE%23MCMP%3ABA_WSKW20%23MCMP%3AAO_CHLD%23Sens%3Aalc%23Sens%3Aast%23Sens%3Acbd%23Sens%3Aconl%23Sens%3Acosm%23Sens%3Adat%23Sens%3Adlu%23Sens%3Adrg%23Sens%3Agamc%23Sens%3Agamv%23Sens%3Agrq%23Sens%3Apol%23Sens%3Arel%23Sens%3Asst%23Sens%3Assr%23Sens%3Asrh%23Sens%3Aske%23Sens%3Atob%23Sens%3Awtl%23vp%3A0%23MSFTA_2022%3ATrue%23TRGT_022020%3ATrue%23TYTA_22%3ATrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A6%2C%22msi%22%3A6%2C%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.27.0%22%2C%22userIds%22%3A%5B%5D%2C%22url%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22dms%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%221256544372aef793%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185795%22%2C%22sid%22%3A%2235_1%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A600%2C%22ext%22%3A%7B%22siteID%22%3A%22185795%22%2C%22sid%22%3A%2235_2%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A1050%2C%22ext%22%3A%7B%22siteID%22%3A%22185795%22%2C%22sid%22%3A%2235_3%22%7D%7D%2C%7B%22w%22%3A160%2C%22h%22%3A600%2C%22ext%22%3A%7B%22siteID%22%3A%22185795%22%2C%22sid%22%3A%2235_4%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22185795%22%2C%22sid%22%3A%2235_5%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22185795%22%2C%22sid%22%3A%22320x50%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A100%2C%22ext%22%3A%7B%22siteID%22%3A%22185795%22%2C%22sid%22%3A%22320x100%22%7D%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185795%22%2C%22sid%22%3A%22250x250%22%7D%7D%2C%7B%22w%22%3A120%2C%22h%22%3A240%2C%22ext%22%3A%7B%22siteID%22%3A%22185795%22%2C%22sid%22%3A%22120x240%22%7D%7D%2C%7B%22w%22%3A1%2C%22h%22%3A1%2C%22ext%22%3A%7B%22siteID%22%3A%22185795%22%2C%22sid%22%3A%221x1%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A420%2C%22ext%22%3A%7B%22siteID%22%3A%22185795%22%2C%22sid%22%3A%22300x420%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F18190176%2FAdThrive_Sidebar_9%2F61d877f7514b73001b093e34%22%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Sidebar_9%2F61d877f7514b73001b093e34%22%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%22339848ae-dcce-4fa0-94d5-891de72efd4b%22%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%5D%7D%5D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b21a7733636f01d9d0b1998ee93f5956c5c597e93a1c4dd09bc4ae14007f2d17

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IRYvZTSnMFHAg7AovBg0pCXvZbrg9Xc1ko77kuqptbe210vA8TTGAdxgFbBJ0B5nX%2F%2F1uv9znXFlbVO%2BRj5Pf00hknyD0xwzp5JdAyceHyhmTf0Bumdys23sbJkbs6a2rCO6R5Ij"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 74964237ca245ac4-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 38
expires: 0

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
319 B 337ms
336ms XHR
application/json 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.27.0&cb=16202725761

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
511 B 245ms
245ms XHR
application/json 52.220.232.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.27.0&referrer=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tmax=2800&us_privacy=1---

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.220.232.15 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-220-232-15.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
accept-ch: sec-ch-ua,sec-ch-ua-arch,sec-ch-rtt,sec-ch-viewport-height,sec-ch-ua-platform,sec-ch-viewport-width,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-dpr,sec-ch-device-memory,sec-ch-save-data,sec-ch-ua-mobile,sec-ch-downlink,user-agent,sec-ch-ect,sec-ch-width,sec-ch-prefers-color-scheme,sec-ch-ua-bitness
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H/1.1 200
OK bid Show response
krk.kargo.com/api/v2/ 2 B
657 B 261ms
260ms XHR
application/json 52.77.87.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://krk.kargo.com/api/v2/bid?json=%7B%22sessionId%22%3A%2237119b77-34ef-49ba-9aef-270ab536c25b%22%2C%22requestCount%22%3A5%2C%22timeout%22%3A2800%2C%22currency%22%3A%22USD%22%2C%22cpmGranularity%22%3A1%2C%22timestamp%22%3A1662960705105%2C%22cpmRange%22%3A%7B%22floor%22%3A0%2C%22ceil%22%3A20%7D%2C%22bidIDs%22%3A%7B%221357c8eab160d7fa%22%3A%22_zxmQwsW17E%22%2C%221363918697b77dbf%22%3A%22_mfu14jCkaN%22%7D%2C%22bidSizes%22%3A%7B%221357c8eab160d7fa%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%2C%5B320%2C50%5D%2C%5B160%2C600%5D%2C%5B300%2C1050%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C420%5D%5D%2C%221363918697b77dbf%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%2C%5B320%2C50%5D%2C%5B160%2C600%5D%2C%5B300%2C1050%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C420%5D%5D%7D%2C%22prebidRawBidRequests%22%3A%5B%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_zxmQwsW17E%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Sidebar_9%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Sidebar_9%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Sidebar_9%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%2C%5B320%2C50%5D%2C%5B160%2C600%5D%2C%5B300%2C1050%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C420%5D%5D%2C%22pos%22%3A1%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Sidebar_9_desktop%22%2C%22transactionId%22%3A%22b9c697c6-8897-4460-9cb9-134021c29952%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%2C%5B320%2C50%5D%2C%5B160%2C600%5D%2C%5B300%2C1050%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C420%5D%5D%2C%22bidId%22%3A%221357c8eab160d7fa%22%2C%22bidderRequestId%22%3A%22134f82d6dd8024ee%22%2C%22auctionId%22%3A%22c09a9013-5856-4230-81cd-a4145d34c655%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%22339848ae-dcce-4fa0-94d5-891de72efd4b%22%7D%5D%7D%7D%2C%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_mfu14jCkaN%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Sidebar_9%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Sidebar_9%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Sidebar_9%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%2C%5B320%2C50%5D%2C%5B160%2C600%5D%2C%5B300%2C1050%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C420%5D%5D%2C%22pos%22%3A1%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Sidebar_9_desktop%22%2C%22transactionId%22%3A%22b9c697c6-8897-4460-9cb9-134021c29952%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%2C%5B320%2C50%5D%2C%5B160%2C600%5D%2C%5B300%2C1050%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C420%5D%5D%2C%22bidId%22%3A%221363918697b77dbf%22%2C%22bidderRequestId%22%3A%22134f82d6dd8024ee%22%2C%22auctionId%22%3A%22c09a9013-5856-4230-81cd-a4145d34c655%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%22339848ae-dcce-4fa0-94d5-891de72efd4b%22%7D%5D%7D%7D%5D%2C%22userIDs%22%3A%7B%22crbIDs%22%3A%7B%7D%2C%22usp%22%3A%221---%22%7D%2C%22pageURL%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22rawCRB%22%3Anull%2C%22rawCRBLocalStorage%22%3Anull%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.87.101 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-87-101.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:45 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 26
X-Accel-Expires: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
284 B 239ms
237ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9694d00177771bcae21c6941d30023&pos=8a969d580177771bc13c2045ff6b0080&cmd=bid&sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&secure=1&us_privacy=1---
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 37be73bdbb4d8129a6afc351dcaf50b95fd0eff3f9f446948969f857a10320e0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
93 B 276ms
274ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9694d00177771bcae21c6941d30023&pos=8a96918c0177771bc6522043c8540090&cmd=bid&sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&secure=1&us_privacy=1---
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 3b1624f2d5a602e5dc75c627cd8e09d6b244fec086e2f1e0739a07934b667353

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
93 B 244ms
243ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9694d00177771bcae21c6941d30023&pos=8a969d580177771bc13c2044ea91007d&cmd=bid&sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&secure=1&us_privacy=1---
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 126daecc0778e2d5ed5c4f331b31fd82f6b9c661a8876420ec6aae7fc369417b

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
93 B 243ms
242ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9694d00177771bcae21c6941d30023&pos=8a96918c0177771bc6521c6b5f4e003f&cmd=bid&sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&secure=1&us_privacy=1---
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 2061674e3247f426cb6c4fd4ae965835a3ca16231019670b1b50d86f83e8e61e

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 62

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
65 B 231ms
230ms XHR
text/plain 103.231.98.193
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.193 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://leisurelylifestyle.com
date: Mon, 12 Sep 2022 05:31:45 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 625 B
683 B 286ms
285ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881478&size_id=15&alt_size_ids=9%2C10%2C14%2C43%2C44%2C54%2C117%2C221&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!cafemedia.com,61d877f7514b73001b093e34,1,339848ae-dcce-4fa0-94d5-891de72efd4b,,&eid_pubcid.org=d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%5E1&rf=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tg_i.mcmp=AO_DATE%2CBA_WSKW20%2CAO_CHLD&tg_i.site_code=MSFTA_2022%2CTRGT_022020%2CTYTA_22&tg_i.site_id=61d877f7514b73001b093e34&tg_i.sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&tg_i.verticals=Travel&tg_i.pmp_elig=true&tg_i.refresh=false&tg_i.vp=0&tg_i.pbadslot=%2F18190176%2FAdThrive_Sidebar_9%2F61d877f7514b73001b093e34&tk_flint=pbjs_lite_v6.27.0&x_source.tid=b9c697c6-8897-4460-9cb9-134021c29952&l_pb_bid_id=145a436c465b11d7&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F18190176%2FAdThrive_Sidebar_9%2F61d877f7514b73001b093e34&slots=1&rand=0.861280116745786
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 33c6043643908b2763c282e90dedb94798f380fffd146013d3300540694d12bb

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
server: nginx/1.21.4
vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-type: application/json
content-length: 625
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
97 B 256ms
254ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 972638a80dd303a6aa3c9241eb15010f65fea7184cde93f49b3801054fe7efb3

Request headers

Referer: https://leisurelylifestyle.com/
x-openrtb-version: 2.5
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
97 B 444ms
443ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: a8e0b92f1620188deb62891b7faa602623c9aac9460d0397bef0b2946f1387e4

Request headers

Referer: https://leisurelylifestyle.com/
x-openrtb-version: 2.5
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
97 B 284ms
282ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 5454e3c264acc99fdb345e451783a85f402fd8400a17294ead0394e693ca8987

Request headers

Referer: https://leisurelylifestyle.com/
x-openrtb-version: 2.5
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
97 B 268ms
266ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: eebca5b249dfb03e14cc06fc729cb72124b3b7cda2458ae6a218ec25596dfb33

Request headers

Referer: https://leisurelylifestyle.com/
x-openrtb-version: 2.5
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 66

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 144 B
1 KB 347ms
347ms XHR
application/json 104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

19f3f32fcb946e9820981161c45dfebd67dff514d78c0348b31b369f24edb146

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:45 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 5046786a-7e5a-42c8-a0b5-e26f1a1fd830
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 144
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK cafemedia Show response
direct.adsrvr.org/bid/bidder/ 0
406 B 191ms
190ms XHR
application/json 13.248.136.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/cafemedia
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 13.248.136.210 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: af721359bfd441050.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:44 GMT
x-openrtb-version: 2.3
server: Kestrel
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 0

POST
H/1.1 200
OK / Show response
colossusssp.com/ 2 B
249 B 352ms
351ms XHR
application/json 8.2.111.123
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://colossusssp.com/?c=o&m=multi
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 8.2.111.123 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://leisurelylifestyle.com
Date: Mon, 12 Sep 2022 05:31:45 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 2
Content-Type: application/json

POST
H2 204 hb Show response
hb.undertone.com/ 0
802 B 784ms
390ms XHR
text/plain 52.84.251.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.undertone.com/hb?pid=2002&domain=leisurelylifestyle.com&ccpa=1---
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.251.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-251-90.sin5.r.cloudfront.net
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
via: 1.1 6744df903aaebd8a225f5410dbe17efc.cloudfront.net (CloudFront)
server: istio-envoy
x-amz-cf-pop: SIN5-C1
x-cache: Miss from cloudfront
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSDo OUR BUS UNI COM NAV"
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
x-envoy-upstream-service-time: 7
accept-ch: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
x-amz-cf-id: D2ZaofgfrcTyxF80zE3EUjV2xk-Fvcrn2jGmwyqwfONyLwBTzGEWUw==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.com.au/adsid/ 107 B
792 B 515ms
173ms Script
application/javascript 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com.au/adsid/integrator.js?domain=leisurelylifestyle.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 530ms
184ms Script
application/javascript 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=leisurelylifestyle.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
8 KB 665ms
662ms XHR
text/plain 74.125.68.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3277682631422013&correlator=304029939384631&eid=31068457%2C31068929%2C31069183%2C31069332&output=ldjh&gdfp_req=1&vrg=2022090601&ptt=17&impl=fifs&us_privacy=1---&tfcd=0&iu_parts=18190176%3A21726097356%2CAdThrive_Footer_1%2C61d877f7514b73001b093e34&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C728x90%7C320x50%7C970x90%7C300x50%7C320x100%7C468x60%7C1x1&fluid=height&ifi=1&adks=47228975&sfv=1-0-38&fsbs=1&fsapi=false&prev_scp=location%3DFooter%26sequence%3D1%26id%3DAdThrive_Footer_1_desktop%26ATF%3Dtrue%26sticky%3Dtrue%26lazy%3Dfalse%26refresh%3D00%26nref%3D0%26hvp%3D80%26amznbid%3D2%26amznp%3D2%26flag_slot%3Dfv%253Af%26hb_bidder%3DnoBid&eri=5&cust_params=flag%3Dtarget%253Aes2018%252Cadsmnche%253A1510%252Cpmp_elig%253A1%252Cclson%253Atrue%252CclsBranch%253A484004f%252CclsBucket%253Aprod%252Cintegration%253Aplugin%252Clmdv%253A1.7.0%26siteId%3D61d877f7514b73001b093e34%26siteName%3DLeisurely%2520Lifestyle%26verticals%3DTravel%26abgroup%3Dwvtls%253Aoff%252Camzn_hold_load%253Aon%252Crfii%253Aoff%252Cflr%253Acm%252Clzflr%253Aoff%252Cebho%253Asharethrough_ebda%252Cloglevel%253Aoff%252Cidho%253Aoff%252Clzhb%253Aon%252Clzcvp%253A1.25%252Clzbpvp%253A0.75%252Ctripleliftdr%253Aboth%252Cmagnitedr%253Aboth%252Cpbs2s_appnexus%253Aoff%252Cpbs2s_grid%253Aon%252Cpbs2s_gumgum%253Aoff%252Cpbs2s_openx%253Aoff%252Cadt%253A0%252Cito_ds%253A2800%252C3pho%253Anone%252Cvebho%253Aoff%252Ccbt%253A2s%252Cvast_to%253A10s%252Cproto%253Anv1%252Cpbm%253Aon%252CreqTo%253A15%252Cvadv%253Aon%252Csmhd100%253Aoff%252Csmad300%253Aon%252Cs2sbuff%253A300%252Crmos1%253Aoff%252Csocon%253A1%252Csab%253Aon%252Cdco%253Arelaxed%252Cmxrpog%253A5%252Cdajto%253Aoff%252Cjwb%253Aon%252Cvpred%253Aon%252Ccrtvmon%253Aoff%252Cpba%253Anone%252Camzn_hold_disp%253Aoff%252Cbmetrics%253Aon%252Cconfiant%253Aprod%252Ccnfep%253Aon%252Crefflr2%253A1.2%252Csocbe%253Asovpct2%252Clogcls%253Aoff%252Ctpcapi%253Aon%252Csidp%253Aoff%252Crebuildslot%253Aon%252Cupl%253Aoff%252Csekho%253Aoff%252Csospp%253Aon%252Crmosnv1%253Aoff%26bucket%3Dflex-30%26sens%3Dalc%252Cast%252Ccbd%252Cconl%252Ccosm%252Cdat%252Cdlu%252Cdrg%252Cgamc%252Cgamv%252Cgrq%252Cpol%252Crel%252Csst%252Cssr%252Csrh%252Cske%252Ctob%252Cwtl%26domain%3Dleisurelylifestyle.com%26plugin%3Dadthrive-ads-2.3.1%26hi_au%3Dod%252Com%26vpwxvph%3D1600x1200%26ri%3D48%26pvk%3D01GCR2X4B7FJF6KKGKM2Y5KPHN%26sess%3D01GCR2X4B72666RTK6J7CQK4KF%26branch%3Df56a6a1%26deployment%3D2022-09-06-5%253Aade-249%253Apr2618%253Af56a6a1%26hbho%3Dnativo%252Csharethrough%26vbho%3Dnone%26gptv%3D2022090601%26connection%3Dniet%253A4g%252Cdl%253A9.3%26fpv%3D1%26mcmp%3DAO_DATE%252CBA_WSKW20%252CAO_CHLD%26site_code%3DMSFTA_2022%252CTRGT_022020%252CTYTA_22%26marmalade%3Dtrue&sc=1&cookie_enabled=1&abxe=1&dt=1662960705142&dlt=1662960699576&idt=3135&adxs=436&adys=1131&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&frm=20&vis=1&psz=1600x11190&msz=1600x-1&fws=516&ohw=1600&ga_vid=1266557791.1662960702&ga_sid=1662960705&ga_hid=335300354&ga_fc=true&cbidsp=CtYECAESEQoIdHJpcGxfc3MQ_BEgAjgCEg0KBGdyaWQQ_REgAjgCEhMKCmJyaWdodHJvbGwQ_BEgAjgCEhAKB3B1Ym1fc3MQ_BEgAjgCEhAKB3J1Ymlfc3MQ_BEgAjgCEhAKB3lpZWxkbW8Q_BEgAjgCEhEKCDMzYWNyb3NzEPwRIAI4AhIPCgZ1bnJ1bHkQ_BEgAjgCEg8KBmNvbF9zcxD8ESACOAISDAoFdGVhZHMQxwYgAhIJCgJpeBCuBiACEgkKAml4EK4GIAISCQoCaXgQrgYgAhIJCgJpeBCuBiACEgkKAml4EK4GIAISDQoGY3JpdGVvEL0FIAISEQoKdHJpcGxlbGlmdBDxBCACEgwKBWthcmdvEI0GIAISDgoHdmVyaXpvbhCXBSACEg4KB3Zlcml6b24QlwUgAhIOCgd2ZXJpem9uEJcFIAISDwoIcHVibWF0aWMQ2gQgAhIOCgdydWJpY29uEOsHIAISDwoIeWFob29zc3AQrAYgAhIPCgh5YWhvb3NzcBCsBiACEg8KCHlhaG9vc3NwEKwGIAISDwoIYXBwbmV4dXMQpQYgAhIKCgN0dGQQsAwgAhIPCghjb2xvc3N1cxDVCiACEg0KBmd1bWd1bRDtBiACEg0KB3JvdW5kZWwQAiACEg0KB3JvdW5kZWwQAiACEg0KB3JvdW5kZWwQAiACEg0KB3JvdW5kZWwQAiACEg0KB3JvdW5kZWwQAiACGAIiJDI2NmQ5ZDM5LTg4ZWUtNGM4Ny05NWRjLThiNTNhYWIzZWVjMSoCCANKAEDEEw..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bd46ad60e5df7ce749c0687f0036bfe72787656cea220a330239304ff8ab8d55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8282
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9466 6 KB
4 KB 521ms
174ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 05:31:45 GMT
expires: Tue, 12 Sep 2023 05:31:45 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
8 KB 584ms
583ms XHR
text/plain 74.125.68.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3277682631422013&correlator=104972797962880&eid=31068457%2C31068929%2C31069183%2C31069332&output=ldjh&gdfp_req=1&vrg=2022090601&ptt=17&impl=fifs&us_privacy=1---&tfcd=0&iu_parts=18190176%3A21726097356%2CAdThrive_Content_4%2C61d877f7514b73001b093e34&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C728x90%7C300x250%7C320x50%7C336x280%7C300x50%7C320x100%7C468x60%7C250x250%7C120x240%7C1x1%7C300x300%7C552x334%7C728x250&fluid=height&ifi=2&adks=1451936700&sfv=1-0-38&fsbs=1&fsapi=false&prev_scp=location%3DContent%26sequence%3D4%26id%3DAdThrive_Content_4_desktop%26lazy%3Dfalse%26refresh%3D00%26nref%3D0%26hvp%3D50%26amznbid%3D2%26amznp%3D2%26flag_slot%3Dfv%253Af%26hb_format_appnexus%3Dbanner%26hb_size_appnexus%3D552x334%26hb_pb_appnexus%3D0.06%26hb_adid_appnexus%3D432b10d36ca8984f%26hb_format%3Dbanner%26hb_size%3D552x334%26hb_pb%3D0.06%26hb_adid%3D432b10d36ca8984f%26hb_bidder%3Dappnexus%26hb_bsid%3D11882&eri=5&cust_params=flag%3Dtarget%253Aes2018%252Cadsmnche%253A1510%252Cpmp_elig%253A1%252Cclson%253Atrue%252CclsBranch%253A484004f%252CclsBucket%253Aprod%252Cintegration%253Aplugin%252Clmdv%253A1.7.0%26siteId%3D61d877f7514b73001b093e34%26siteName%3DLeisurely%2520Lifestyle%26verticals%3DTravel%26abgroup%3Dwvtls%253Aoff%252Camzn_hold_load%253Aon%252Crfii%253Aoff%252Cflr%253Acm%252Clzflr%253Aoff%252Cebho%253Asharethrough_ebda%252Cloglevel%253Aoff%252Cidho%253Aoff%252Clzhb%253Aon%252Clzcvp%253A1.25%252Clzbpvp%253A0.75%252Ctripleliftdr%253Aboth%252Cmagnitedr%253Aboth%252Cpbs2s_appnexus%253Aoff%252Cpbs2s_grid%253Aon%252Cpbs2s_gumgum%253Aoff%252Cpbs2s_openx%253Aoff%252Cadt%253A0%252Cito_ds%253A2800%252C3pho%253Anone%252Cvebho%253Aoff%252Ccbt%253A2s%252Cvast_to%253A10s%252Cproto%253Anv1%252Cpbm%253Aon%252CreqTo%253A15%252Cvadv%253Aon%252Csmhd100%253Aoff%252Csmad300%253Aon%252Cs2sbuff%253A300%252Crmos1%253Aoff%252Csocon%253A1%252Csab%253Aon%252Cdco%253Arelaxed%252Cmxrpog%253A5%252Cdajto%253Aoff%252Cjwb%253Aon%252Cvpred%253Aon%252Ccrtvmon%253Aoff%252Cpba%253Anone%252Camzn_hold_disp%253Aoff%252Cbmetrics%253Aon%252Cconfiant%253Aprod%252Ccnfep%253Aon%252Crefflr2%253A1.2%252Csocbe%253Asovpct2%252Clogcls%253Aoff%252Ctpcapi%253Aon%252Csidp%253Aoff%252Crebuildslot%253Aon%252Cupl%253Aoff%252Csekho%253Aoff%252Csospp%253Aon%252Crmosnv1%253Aoff%26bucket%3Dflex-30%26sens%3Dalc%252Cast%252Ccbd%252Cconl%252Ccosm%252Cdat%252Cdlu%252Cdrg%252Cgamc%252Cgamv%252Cgrq%252Cpol%252Crel%252Csst%252Cssr%252Csrh%252Cske%252Ctob%252Cwtl%26domain%3Dleisurelylifestyle.com%26plugin%3Dadthrive-ads-2.3.1%26hi_au%3Dod%252Com%26vpwxvph%3D1600x1200%26ri%3D48%26pvk%3D01GCR2X4B7FJF6KKGKM2Y5KPHN%26sess%3D01GCR2X4B72666RTK6J7CQK4KF%26branch%3Df56a6a1%26deployment%3D2022-09-06-5%253Aade-249%253Apr2618%253Af56a6a1%26hbho%3Dnativo%252Csharethrough%26vbho%3Dnone%26gptv%3D2022090601%26connection%3Dniet%253A4g%252Cdl%253A9.3%26fpv%3D1%26mcmp%3DAO_DATE%252CBA_WSKW20%252CAO_CHLD%26site_code%3DMSFTA_2022%252CTRGT_022020%252CTYTA_22%26marmalade%3Dtrue&sc=1&cookie_enabled=1&abxe=1&dt=1662960705165&dlt=1662960699576&idt=3135&adxs=601&adys=5442&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&frm=20&vis=1&psz=762x9386&msz=762x250&fws=4&ohw=1600&ga_vid=1266557791.1662960702&ga_sid=1662960705&ga_hid=335300354&ga_fc=true&cbidsp=CsAECAESEQoIdHJpcGxfc3MQhxEgAjgCEg0KBGdyaWQQhxEgAjgCEhMKCmJyaWdodHJvbGwQhxEgAjgCEhAKB3B1Ym1fc3MQhxEgAjgCEhAKB3J1Ymlfc3MQhxEgAjgCEhAKB3lpZWxkbW8QhxEgAjgCEhEKCDMzYWNyb3NzEIcRIAI4AhIPCgZ1bnJ1bHkQhxEgAjgCEg8KBmNvbF9zcxCHESACOAISDAoFdGVhZHMQuwYgAhIJCgJpeBCwBCACEgkKAml4ELAEIAISCQoCaXgQsAQgAhIJCgJpeBCwBCACEg0KBmNyaXRlbxD0BSACEhEKCnRyaXBsZWxpZnQQpgUgAhIMCgVrYXJnbxC_BiACEgwKBWthcmdvEL8GIAISDwoIcHVibWF0aWMQkwUgAhIOCgdydWJpY29uELcHIAISsgEKCGFwcG5leHVzEJIGGqABChA0MzJiMTBkMzZjYTg5ODRmELHhA0Dh5QMaA1VTRCIJaGJfYmlkZGVyIgdoYl9hZGlkIgVoYl9wYiIHaGJfc2l6ZSIJaGJfZm9ybWF0IhBoYl9hZGlkX2FwcG5leHVzIg5oYl9wYl9hcHBuZXh1cyIQaGJfc2l6ZV9hcHBuZXh1cyISaGJfZm9ybWF0X2FwcG5leHVzKAE6BgioBBDOAiABEgoKA3R0ZBDPBCACEg8KCGNvbG9zc3VzEMMKIAIYAiIkNjUwNzE4ZDUtMGY3OS00ODA3LTk4MGEtYTQyMDk0ZjJmYmZhKgIIA0oAQMQT

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4065e2d9a41edbdafce6a8c95050a73edc7cbda963125f197a8b845c82fac00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8187
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 26 KB
11 KB 774ms
773ms XHR
text/plain 74.125.68.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3277682631422013&correlator=343496641908129&eid=31068457%2C31068929%2C31069183%2C31069332&output=ldjh&gdfp_req=1&vrg=2022090601&ptt=17&impl=fifs&us_privacy=1---&tfcd=0&iu_parts=18190176%3A21726097356%2CAdThrive_Sidebar_1%2C61d877f7514b73001b093e34&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C300x250%7C320x50%7C300x50%7C320x100%7C250x250%7C120x240%7C1x1&fluid=height&ifi=3&adks=3524300456&sfv=1-0-38&fsbs=1&fsapi=false&prev_scp=location%3DSidebar%26sequence%3D1%26id%3DAdThrive_Sidebar_1_desktop%26lazy%3Dfalse%26refresh%3D00%26nref%3D0%26hvp%3D70%26amznbid%3D2%26amznp%3D2%26flag_slot%3Dfv%253Af%26hb_format_triplelift%3Dnative%26hb_size_triplelift%3D300x250%26hb_pb_triplelift%3D0.01%26hb_adid_triplelift%3D431c1fb915b16c63%26hb_format_tripl_ss%3Dnative%26hb_size_tripl_ss%3D300x250%26hb_pb_tripl_ss%3D0.01%26hb_adid_tripl_ss%3D6217b8aa61668353%26hb_adomain%3Dspeedfindr.com%26hb_format%3Dnative%26hb_size%3D300x250%26hb_pb%3D0.01%26hb_adid%3D6217b8aa61668353%26hb_bidder%3Dtripl_ss&eri=5&cust_params=flag%3Dtarget%253Aes2018%252Cadsmnche%253A1510%252Cpmp_elig%253A1%252Cclson%253Atrue%252CclsBranch%253A484004f%252CclsBucket%253Aprod%252Cintegration%253Aplugin%252Clmdv%253A1.7.0%26siteId%3D61d877f7514b73001b093e34%26siteName%3DLeisurely%2520Lifestyle%26verticals%3DTravel%26abgroup%3Dwvtls%253Aoff%252Camzn_hold_load%253Aon%252Crfii%253Aoff%252Cflr%253Acm%252Clzflr%253Aoff%252Cebho%253Asharethrough_ebda%252Cloglevel%253Aoff%252Cidho%253Aoff%252Clzhb%253Aon%252Clzcvp%253A1.25%252Clzbpvp%253A0.75%252Ctripleliftdr%253Aboth%252Cmagnitedr%253Aboth%252Cpbs2s_appnexus%253Aoff%252Cpbs2s_grid%253Aon%252Cpbs2s_gumgum%253Aoff%252Cpbs2s_openx%253Aoff%252Cadt%253A0%252Cito_ds%253A2800%252C3pho%253Anone%252Cvebho%253Aoff%252Ccbt%253A2s%252Cvast_to%253A10s%252Cproto%253Anv1%252Cpbm%253Aon%252CreqTo%253A15%252Cvadv%253Aon%252Csmhd100%253Aoff%252Csmad300%253Aon%252Cs2sbuff%253A300%252Crmos1%253Aoff%252Csocon%253A1%252Csab%253Aon%252Cdco%253Arelaxed%252Cmxrpog%253A5%252Cdajto%253Aoff%252Cjwb%253Aon%252Cvpred%253Aon%252Ccrtvmon%253Aoff%252Cpba%253Anone%252Camzn_hold_disp%253Aoff%252Cbmetrics%253Aon%252Cconfiant%253Aprod%252Ccnfep%253Aon%252Crefflr2%253A1.2%252Csocbe%253Asovpct2%252Clogcls%253Aoff%252Ctpcapi%253Aon%252Csidp%253Aoff%252Crebuildslot%253Aon%252Cupl%253Aoff%252Csekho%253Aoff%252Csospp%253Aon%252Crmosnv1%253Aoff%26bucket%3Dflex-30%26sens%3Dalc%252Cast%252Ccbd%252Cconl%252Ccosm%252Cdat%252Cdlu%252Cdrg%252Cgamc%252Cgamv%252Cgrq%252Cpol%252Crel%252Csst%252Cssr%252Csrh%252Cske%252Ctob%252Cwtl%26domain%3Dleisurelylifestyle.com%26plugin%3Dadthrive-ads-2.3.1%26hi_au%3Dod%252Com%26vpwxvph%3D1600x1200%26ri%3D48%26pvk%3D01GCR2X4B7FJF6KKGKM2Y5KPHN%26sess%3D01GCR2X4B72666RTK6J7CQK4KF%26branch%3Df56a6a1%26deployment%3D2022-09-06-5%253Aade-249%253Apr2618%253Af56a6a1%26hbho%3Dnativo%252Csharethrough%26vbho%3Dnone%26gptv%3D2022090601%26connection%3Dniet%253A4g%252Cdl%253A9.3%26fpv%3D1%26mcmp%3DAO_DATE%252CBA_WSKW20%252CAO_CHLD%26site_code%3DMSFTA_2022%252CTRGT_022020%252CTYTA_22%26marmalade%3Dtrue&sc=1&cookie_enabled=1&abxe=1&dt=1662960705179&dlt=1662960699576&idt=3135&adxs=237&adys=564&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&frm=20&vis=1&psz=300x9664&msz=300x250&fws=4&ohw=1600&ga_vid=1266557791.1662960702&ga_sid=1662960705&ga_hid=335300354&ga_fc=true&cbidsp=Cs4FCAESuwEKCHRyaXBsX3NzEO8RGqcBChA2MjE3YjhhYTYxNjY4MzUzEIB9GgNVU0QiBWhiX3BiIgdoYl9zaXplIgloYl9iaWRkZXIiB2hiX2FkaWQiCWhiX2Zvcm1hdCIKaGJfYWRvbWFpbiIOaGJfcGJfdHJpcGxfc3MiEGhiX3NpemVfdHJpcGxfc3MiEGhiX2FkaWRfdHJpcGxfc3MiEmhiX2Zvcm1hdF90cmlwbF9zcygBOgYIrAIQ-gEgATgCEg0KBGdyaWQQ7xEgAjgCEhMKCmJyaWdodHJvbGwQ7xEgAjgCEhAKB3B1Ym1fc3MQ7xEgAjgCEhAKB3J1Ymlfc3MQ7xEgAjgCEhAKB3lpZWxkbW8Q7xEgAjgCEhEKCDMzYWNyb3NzEO8RIAI4AhIPCgZ1bnJ1bHkQ7hEgAjgCEg8KBmNvbF9zcxDuESACOAISDAoFdGVhZHMQjgcgAhIJCgJpeBDYBCACEgkKAml4ENgEIAISDQoGY3JpdGVvELIGIAISiwEKCnRyaXBsZWxpZnQQ1AUaeAoQNDMxYzFmYjkxNWIxNmM2MxCQThoDVVNEIhJoYl9hZGlkX3RyaXBsZWxpZnQiEGhiX3BiX3RyaXBsZWxpZnQiEmhiX3NpemVfdHJpcGxlbGlmdCIUaGJfZm9ybWF0X3RyaXBsZWxpZnQoATICCgA6BgisAhD6ASABEgwKBWthcmdvENQHIAISDgoHdmVyaXpvbhDPBCACEg8KCHB1Ym1hdGljEN0FIAISDgoHcnViaWNvbhCqByACEg8KCHlhaG9vc3NwEKgHIAISDwoIYXBwbmV4dXMQ3wYgAhIKCgN0dGQQxAQgAhIPCghjb2xvc3N1cxDACiACEg0KB3JvdW5kZWwQACACGAIiJGRjOGM5MGVlLTljMjAtNDkyOC04NTE4LTk3YmMzN2YzZWJmOCoCCANKAEDEEw..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2f0d497e5d791892fa650ea9c11e98ae272848539adc32b44c80954dfda10637

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10943
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
8 KB 596ms
595ms XHR
text/plain 74.125.68.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3277682631422013&correlator=1248224978227966&eid=31068457%2C31068929%2C31069183%2C31069332&output=ldjh&gdfp_req=1&vrg=2022090601&ptt=17&impl=fifs&us_privacy=1---&tfcd=0&iu_parts=18190176%3A21726097356%2CAdThrive_Content_2%2C61d877f7514b73001b093e34&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C728x90%7C300x250%7C320x50%7C336x280%7C300x50%7C320x100%7C468x60%7C250x250%7C120x240%7C1x1%7C300x300%7C552x334%7C728x250&fluid=height&ifi=4&adks=3970611045&sfv=1-0-38&fsbs=1&fsapi=false&prev_scp=location%3DContent%26sequence%3D2%26id%3DAdThrive_Content_2_desktop%26lazy%3Dfalse%26refresh%3D00%26nref%3D0%26amznbid%3D2%26amznp%3D2%26flag_slot%3Dfv%253Af&eri=5&cust_params=flag%3Dtarget%253Aes2018%252Cadsmnche%253A1510%252Cpmp_elig%253A1%252Cclson%253Atrue%252CclsBranch%253A484004f%252CclsBucket%253Aprod%252Cintegration%253Aplugin%252Clmdv%253A1.7.0%26siteId%3D61d877f7514b73001b093e34%26siteName%3DLeisurely%2520Lifestyle%26verticals%3DTravel%26abgroup%3Dwvtls%253Aoff%252Camzn_hold_load%253Aon%252Crfii%253Aoff%252Cflr%253Acm%252Clzflr%253Aoff%252Cebho%253Asharethrough_ebda%252Cloglevel%253Aoff%252Cidho%253Aoff%252Clzhb%253Aon%252Clzcvp%253A1.25%252Clzbpvp%253A0.75%252Ctripleliftdr%253Aboth%252Cmagnitedr%253Aboth%252Cpbs2s_appnexus%253Aoff%252Cpbs2s_grid%253Aon%252Cpbs2s_gumgum%253Aoff%252Cpbs2s_openx%253Aoff%252Cadt%253A0%252Cito_ds%253A2800%252C3pho%253Anone%252Cvebho%253Aoff%252Ccbt%253A2s%252Cvast_to%253A10s%252Cproto%253Anv1%252Cpbm%253Aon%252CreqTo%253A15%252Cvadv%253Aon%252Csmhd100%253Aoff%252Csmad300%253Aon%252Cs2sbuff%253A300%252Crmos1%253Aoff%252Csocon%253A1%252Csab%253Aon%252Cdco%253Arelaxed%252Cmxrpog%253A5%252Cdajto%253Aoff%252Cjwb%253Aon%252Cvpred%253Aon%252Ccrtvmon%253Aoff%252Cpba%253Anone%252Camzn_hold_disp%253Aoff%252Cbmetrics%253Aon%252Cconfiant%253Aprod%252Ccnfep%253Aon%252Crefflr2%253A1.2%252Csocbe%253Asovpct2%252Clogcls%253Aoff%252Ctpcapi%253Aon%252Csidp%253Aoff%252Crebuildslot%253Aon%252Cupl%253Aoff%252Csekho%253Aoff%252Csospp%253Aon%252Crmosnv1%253Aoff%26bucket%3Dflex-30%26sens%3Dalc%252Cast%252Ccbd%252Cconl%252Ccosm%252Cdat%252Cdlu%252Cdrg%252Cgamc%252Cgamv%252Cgrq%252Cpol%252Crel%252Csst%252Cssr%252Csrh%252Cske%252Ctob%252Cwtl%26domain%3Dleisurelylifestyle.com%26plugin%3Dadthrive-ads-2.3.1%26hi_au%3Dod%252Com%26vpwxvph%3D1600x1200%26ri%3D48%26pvk%3D01GCR2X4B7FJF6KKGKM2Y5KPHN%26sess%3D01GCR2X4B72666RTK6J7CQK4KF%26branch%3Df56a6a1%26deployment%3D2022-09-06-5%253Aade-249%253Apr2618%253Af56a6a1%26hbho%3Dnativo%252Csharethrough%26vbho%3Dnone%26gptv%3D2022090601%26connection%3Dniet%253A4g%252Cdl%253A9.3%26fpv%3D1%26mcmp%3DAO_DATE%252CBA_WSKW20%252CAO_CHLD%26site_code%3DMSFTA_2022%252CTRGT_022020%252CTYTA_22%26marmalade%3Dtrue&sc=1&cookie_enabled=1&abxe=1&dt=1662960705192&dlt=1662960699576&idt=3135&adxs=601&adys=4189&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=2&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&frm=20&vis=1&psz=762x9386&msz=762x250&fws=4&ohw=1600&ga_vid=1266557791.1662960702&ga_sid=1662960705&ga_hid=335300354&ga_fc=true&cbidsp=CsgDCAESEQoIdHJpcGxfc3MQxBEgAjgCEg0KBGdyaWQQxBEgAjgCEhMKCmJyaWdodHJvbGwQxBEgAjgCEhAKB3B1Ym1fc3MQxBEgAjgCEhAKB3J1Ymlfc3MQxBEgAjgCEhAKB3lpZWxkbW8QxBEgAjgCEhEKCDMzYWNyb3NzEMQRIAI4AhIPCgZ1bnJ1bHkQxBEgAjgCEg8KBmNvbF9zcxDEESACOAISDAoFdGVhZHMQ0AUgAhIJCgJpeBCBBSACEgkKAml4EIEFIAISCQoCaXgQgQUgAhIJCgJpeBCBBSACEgkKAml4EIEFIAISDQoGY3JpdGVvEMoEIAISEQoKdHJpcGxlbGlmdBD1AyACEgwKBWthcmdvENwGIAISDAoFa2FyZ28Q3AYgAhIOCgd2ZXJpem9uEJIEIAISDwoIcHVibWF0aWMQrAUgAhIOCgdydWJpY29uELoHIAISDwoIeWFob29zc3AQrQUgAhIPCghhcHBuZXh1cxCuBiACEgoKA3R0ZBC4BCACEg8KCGNvbG9zc3VzELsKIAIYAiIkYjUzNWUyZmYtMDg3Mi00YzMwLTkzYjctZjFjYTQ4NjVlYTkxKgIIA0oAQMQT

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

912de6555bfd50cd34e0a1d92c5a40ee458648c51648953d85832f887f7beed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7937
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 51 KB
12 KB 1261ms
1259ms XHR
text/plain 74.125.68.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3277682631422013&correlator=3080157579568344&eid=31068457%2C31068929%2C31069183%2C31069332&output=ldjh&gdfp_req=1&vrg=2022090601&ptt=17&impl=fifs&us_privacy=1---&tfcd=0&iu_parts=18190176%3A21726097356%2CAdThrive_Content_5%2C61d877f7514b73001b093e34&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C728x90%7C300x250%7C320x50%7C336x280%7C300x50%7C320x100%7C468x60%7C250x250%7C120x240%7C1x1%7C300x300%7C552x334%7C728x250&fluid=height&ifi=5&adks=3360438506&sfv=1-0-38&fsbs=1&fsapi=false&prev_scp=location%3DContent%26sequence%3D5%26id%3DAdThrive_Content_5_desktop%26lazy%3Dfalse%26refresh%3D00%26nref%3D0%26amznbid%3D2%26amznp%3D2%26flag_slot%3Dfv%253Af&eri=5&cust_params=flag%3Dtarget%253Aes2018%252Cadsmnche%253A1510%252Cpmp_elig%253A1%252Cclson%253Atrue%252CclsBranch%253A484004f%252CclsBucket%253Aprod%252Cintegration%253Aplugin%252Clmdv%253A1.7.0%26siteId%3D61d877f7514b73001b093e34%26siteName%3DLeisurely%2520Lifestyle%26verticals%3DTravel%26abgroup%3Dwvtls%253Aoff%252Camzn_hold_load%253Aon%252Crfii%253Aoff%252Cflr%253Acm%252Clzflr%253Aoff%252Cebho%253Asharethrough_ebda%252Cloglevel%253Aoff%252Cidho%253Aoff%252Clzhb%253Aon%252Clzcvp%253A1.25%252Clzbpvp%253A0.75%252Ctripleliftdr%253Aboth%252Cmagnitedr%253Aboth%252Cpbs2s_appnexus%253Aoff%252Cpbs2s_grid%253Aon%252Cpbs2s_gumgum%253Aoff%252Cpbs2s_openx%253Aoff%252Cadt%253A0%252Cito_ds%253A2800%252C3pho%253Anone%252Cvebho%253Aoff%252Ccbt%253A2s%252Cvast_to%253A10s%252Cproto%253Anv1%252Cpbm%253Aon%252CreqTo%253A15%252Cvadv%253Aon%252Csmhd100%253Aoff%252Csmad300%253Aon%252Cs2sbuff%253A300%252Crmos1%253Aoff%252Csocon%253A1%252Csab%253Aon%252Cdco%253Arelaxed%252Cmxrpog%253A5%252Cdajto%253Aoff%252Cjwb%253Aon%252Cvpred%253Aon%252Ccrtvmon%253Aoff%252Cpba%253Anone%252Camzn_hold_disp%253Aoff%252Cbmetrics%253Aon%252Cconfiant%253Aprod%252Ccnfep%253Aon%252Crefflr2%253A1.2%252Csocbe%253Asovpct2%252Clogcls%253Aoff%252Ctpcapi%253Aon%252Csidp%253Aoff%252Crebuildslot%253Aon%252Cupl%253Aoff%252Csekho%253Aoff%252Csospp%253Aon%252Crmosnv1%253Aoff%26bucket%3Dflex-30%26sens%3Dalc%252Cast%252Ccbd%252Cconl%252Ccosm%252Cdat%252Cdlu%252Cdrg%252Cgamc%252Cgamv%252Cgrq%252Cpol%252Crel%252Csst%252Cssr%252Csrh%252Cske%252Ctob%252Cwtl%26domain%3Dleisurelylifestyle.com%26plugin%3Dadthrive-ads-2.3.1%26hi_au%3Dod%252Com%26vpwxvph%3D1600x1200%26ri%3D48%26pvk%3D01GCR2X4B7FJF6KKGKM2Y5KPHN%26sess%3D01GCR2X4B72666RTK6J7CQK4KF%26branch%3Df56a6a1%26deployment%3D2022-09-06-5%253Aade-249%253Apr2618%253Af56a6a1%26hbho%3Dnativo%252Csharethrough%26vbho%3Dnone%26gptv%3D2022090601%26connection%3Dniet%253A4g%252Cdl%253A9.3%26fpv%3D1%26mcmp%3DAO_DATE%252CBA_WSKW20%252CAO_CHLD%26site_code%3DMSFTA_2022%252CTRGT_022020%252CTYTA_22%26marmalade%3Dtrue&sc=1&cookie_enabled=1&abxe=1&dt=1662960705352&dlt=1662960699576&idt=3135&adxs=601&adys=5972&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=3&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&frm=20&vis=1&psz=762x9386&msz=762x250&fws=4&ohw=1600&ga_vid=1266557791.1662960702&ga_sid=1662960705&ga_hid=335300354&ga_fc=true&cbidsp=CpwDCAESEQoIdHJpcGxfc3MQrhIgAjgCEg0KBGdyaWQQrhIgAjgCEhMKCmJyaWdodHJvbGwQrhIgAjgCEhAKB3B1Ym1fc3MQrhIgAjgCEhAKB3J1Ymlfc3MQrhIgAjgCEhAKB3lpZWxkbW8QrhIgAjgCEhEKCDMzYWNyb3NzEK4SIAI4AhIPCgZ1bnJ1bHkQrhIgAjgCEg8KBmNvbF9zcxCuEiACOAISDAoFdGVhZHMQrQUgAhIJCgJpeBDiBSACEgkKAml4EOIFIAISCQoCaXgQ4gUgAhIJCgJpeBDiBSACEg0KBmNyaXRlbxC4BCACEhEKCnRyaXBsZWxpZnQQ3AMgAhIMCgVrYXJnbxD3BiACEgwKBWthcmdvEPcGIAISDwoIcHVibWF0aWMQ_AQgAhIOCgdydWJpY29uENgGIAISDwoIYXBwbmV4dXMQ-wYgAhIKCgN0dGQQqwUgAhIPCghjb2xvc3N1cxC-CiACGAIiJDA5YWEwYmFjLTE1ZjUtNDRlYy04MzkzLWU0MDQ5NzUzMTY3MSoCCANKAEDEEw..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-220-232-15.ap-southeast-1.compute.amazonaws.com

Software

cafe /

Resource Hash

05a70b4d051922fcd6475b74c01e033a47e6674e47e2eb4f9622a283aafb056b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12218
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 172ms
171ms Preflight 13.250.192.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.250.192.86 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-250-192-86.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://leisurelylifestyle.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://leisurelylifestyle.com
access-control-max-age: 600
age: 0
content-length: 0
date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 171ms
170ms Preflight 13.250.192.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.250.192.86 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-250-192-86.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://leisurelylifestyle.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://leisurelylifestyle.com
access-control-max-age: 600
age: 0
content-length: 0
date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 354 B
512 B 496ms
495ms XHR
application/json 52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: a0367b34a46fc90f816f506264a188a1783fd16fddab7b33a0a28b0b228af4e9

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
x-prebid: pbs-java/1.97.0
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 273
expires: 0

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
253 B 256ms
255ms XHR
application/json 23.195.153.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.195.153.54 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-195-153-54.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Mon, 12 Sep 2022 05:31:45 GMT

GET
H3 200 cygnus Show response
htlb.casalemedia.com/ 38 B
513 B 450ms
450ms XHR
application/json 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=185761&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%2218343072d569ba09%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%3F%23PD%3Adesktop%23Source%3Adirect%23Browser%3AChrome%23Topic%3ATravel%23MCMP%3AAO_DATE%23MCMP%3ABA_WSKW20%23MCMP%3AAO_CHLD%23Sens%3Aalc%23Sens%3Aast%23Sens%3Acbd%23Sens%3Aconl%23Sens%3Acosm%23Sens%3Adat%23Sens%3Adlu%23Sens%3Adrg%23Sens%3Agamc%23Sens%3Agamv%23Sens%3Agrq%23Sens%3Apol%23Sens%3Arel%23Sens%3Asst%23Sens%3Assr%23Sens%3Asrh%23Sens%3Aske%23Sens%3Atob%23Sens%3Awtl%23vp%3A0%23MSFTA_2022%3ATrue%23TRGT_022020%3ATrue%23TYTA_22%3ATrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A8%2C%22msi%22%3A8%2C%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.27.0%22%2C%22userIds%22%3A%5B%5D%2C%22url%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22dms%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2218421b3802af5481%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22185761%22%2C%22sid%22%3A%223_1%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185761%22%2C%22sid%22%3A%223_2%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22185761%22%2C%22sid%22%3A%223_4%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A100%2C%22ext%22%3A%7B%22siteID%22%3A%22185761%22%2C%22sid%22%3A%223_5%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22185761%22%2C%22sid%22%3A%223_6%22%7D%7D%2C%7B%22w%22%3A336%2C%22h%22%3A280%2C%22ext%22%3A%7B%22siteID%22%3A%22185761%22%2C%22sid%22%3A%22336x280%22%7D%7D%2C%7B%22w%22%3A468%2C%22h%22%3A60%2C%22ext%22%3A%7B%22siteID%22%3A%22185761%22%2C%22sid%22%3A%22468x60%22%7D%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185761%22%2C%22sid%22%3A%22250x250%22%7D%7D%2C%7B%22w%22%3A120%2C%22h%22%3A240%2C%22ext%22%3A%7B%22siteID%22%3A%22185761%22%2C%22sid%22%3A%22120x240%22%7D%7D%2C%7B%22w%22%3A1%2C%22h%22%3A1%2C%22ext%22%3A%7B%22siteID%22%3A%22185761%22%2C%22sid%22%3A%221x1%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A300%2C%22ext%22%3A%7B%22siteID%22%3A%22185761%22%2C%22sid%22%3A%22300x300%22%7D%7D%2C%7B%22w%22%3A552%2C%22h%22%3A334%2C%22ext%22%3A%7B%22siteID%22%3A%22185761%22%2C%22sid%22%3A%22552x334%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185761%22%2C%22sid%22%3A%22728x250%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F18190176%2FAdThrive_Content_1%2F61d877f7514b73001b093e34%22%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_1%2F61d877f7514b73001b093e34%22%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%22518e75e1-62f0-409b-9610-30d943b381f7%22%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%5D%7D%5D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b7ad3fa2679511d72f426bcad7b80bf47e3e8b68a28a128975c3bab07ff6cd8b

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RaeF4Iw%2FuZbeIDUIW3WgqMO42HzyNH9uMFWJQoL%2FerHgc3SqxXTPrR0NyFvSgC%2Fb%2BcANbIGGONJtGrme%2BaDnnDrr1se9FrSg8PQT8WPAC1d%2BeKq6YDw2a8lQMQjlftUiLfNIsjkb"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 74964239fe3e5ac4-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 38
expires: 0

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
319 B 479ms
479ms XHR
application/json 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.27.0&cb=83851156858

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
511 B 254ms
254ms XHR
application/json 52.220.232.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.27.0&referrer=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tmax=2800&us_privacy=1---

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.220.232.15 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
accept-ch: sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-dpr,sec-ch-device-memory,sec-ch-save-data,sec-ch-ua-mobile,sec-ch-downlink,user-agent,sec-ch-ect,sec-ch-width,sec-ch-prefers-color-scheme,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-arch,sec-ch-rtt,sec-ch-viewport-height,sec-ch-ua-platform,sec-ch-viewport-width,sec-ch-ua-platform-version
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H/1.1 200
OK bid Show response
krk.kargo.com/api/v2/ 2 B
657 B 336ms
336ms XHR
application/json 52.77.87.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://krk.kargo.com/api/v2/bid?json=%7B%22sessionId%22%3A%2237119b77-34ef-49ba-9aef-270ab536c25b%22%2C%22requestCount%22%3A6%2C%22timeout%22%3A2800%2C%22currency%22%3A%22USD%22%2C%22cpmGranularity%22%3A1%2C%22timestamp%22%3A1662960705547%2C%22cpmRange%22%3A%7B%22floor%22%3A0%2C%22ceil%22%3A20%7D%2C%22bidIDs%22%3A%7B%221948829a7b7a5414%22%3A%22_mfu14jCkaN%22%2C%221955a88bbfbc4b32%22%3A%22_vzS4k9rMKu%22%7D%2C%22bidSizes%22%3A%7B%221948829a7b7a5414%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%221955a88bbfbc4b32%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%2C%22prebidRawBidRequests%22%3A%5B%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_mfu14jCkaN%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content_1%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content_1%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_1%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_1_desktop%22%2C%22transactionId%22%3A%22e0a49d7b-e447-472e-bea8-603e1e766781%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%221948829a7b7a5414%22%2C%22bidderRequestId%22%3A%221932f43164923af7%22%2C%22auctionId%22%3A%22bdb86885-d8c8-470b-9ed6-6c7688be504f%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%22518e75e1-62f0-409b-9610-30d943b381f7%22%7D%5D%7D%7D%2C%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_vzS4k9rMKu%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content_1%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content_1%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_1%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_1_desktop%22%2C%22transactionId%22%3A%22e0a49d7b-e447-472e-bea8-603e1e766781%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%221955a88bbfbc4b32%22%2C%22bidderRequestId%22%3A%221932f43164923af7%22%2C%22auctionId%22%3A%22bdb86885-d8c8-470b-9ed6-6c7688be504f%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%22518e75e1-62f0-409b-9610-30d943b381f7%22%7D%5D%7D%7D%5D%2C%22userIDs%22%3A%7B%22crbIDs%22%3A%7B%7D%2C%22usp%22%3A%221---%22%7D%2C%22pageURL%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22rawCRB%22%3Anull%2C%22rawCRBLocalStorage%22%3Anull%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.87.101 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-87-101.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:45 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 26
X-Accel-Expires: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
93 B 247ms
247ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9694d00177771bcae21c6941d30023&pos=8a969d580177771bc13c20458198007e&cmd=bid&sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&secure=1&us_privacy=1---
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 6a76942997a7c4e6fdc940832bb36d18e5ec90fcb6af96c36ec2ece3bccf9c7c

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
93 B 235ms
235ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9694d00177771bcae21c6941d30023&pos=8a96918c0177771bc65220467ff60092&cmd=bid&sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&secure=1&us_privacy=1---
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: dfa782462ce5b35e1209c2f18715a182ba782e4b66db43167e30fb13b00faafd

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 62

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
65 B 199ms
199ms XHR
text/plain 103.231.98.193
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.193 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://leisurelylifestyle.com
date: Mon, 12 Sep 2022 05:31:45 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 623 B
658 B 306ms
305ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881398&size_id=15&alt_size_ids=2%2C1%2C14%2C16%2C43%2C44%2C48%2C117%2C221&us_privacy=1---&rp_schain=1.0,1!cafemedia.com,61d877f7514b73001b093e34,1,518e75e1-62f0-409b-9610-30d943b381f7,,&eid_pubcid.org=d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%5E1&rf=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tg_i.mcmp=AO_DATE%2CBA_WSKW20%2CAO_CHLD&tg_i.site_code=MSFTA_2022%2CTRGT_022020%2CTYTA_22&tg_i.site_id=61d877f7514b73001b093e34&tg_i.sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&tg_i.verticals=Travel&tg_i.pmp_elig=true&tg_i.refresh=false&tg_i.vp=0&tg_i.pbadslot=%2F18190176%2FAdThrive_Content_1%2F61d877f7514b73001b093e34&tk_flint=pbjs_lite_v6.27.0&x_source.tid=e0a49d7b-e447-472e-bea8-603e1e766781&l_pb_bid_id=202f91568463f936&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F18190176%2FAdThrive_Content_1%2F61d877f7514b73001b093e34&slots=1&rand=0.40077784782543646
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 0b267ca5a3866eaf48c787f10e3fb502ff3645f53d93f33c3c4d5f76b1084647

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
server: nginx/1.21.4
vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-type: application/json
content-length: 623
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
97 B 259ms
256ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 95c08779489e03afed2d1e88bc1684caadb2975d35e4a833e1238d1ca7effbc5

Request headers

Referer: https://leisurelylifestyle.com/
x-openrtb-version: 2.5
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
97 B 246ms
242ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 375e5ee96d25472aae8faa2721bd6ffc8b220ca7d4f70eb1bee4a682cdf987a0

Request headers

Referer: https://leisurelylifestyle.com/
x-openrtb-version: 2.5
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 66

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 17 KB
9 KB 431ms
431ms XHR
application/json 104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-52-220-232-15.ap-southeast-1.compute.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

ba7f66eb140eab6b30f84d91ff903c0756669256dd8625b07a1426ddc16d3f39

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 12 Sep 2022 05:31:45 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 954b2989-9216-4ec0-b16f-503fc2765c9d
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK cafemedia Show response
direct.adsrvr.org/bid/bidder/ 0
406 B 290ms
289ms XHR
application/json 13.248.136.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/cafemedia
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 13.248.136.210 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: af721359bfd441050.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
x-openrtb-version: 2.3
server: Kestrel
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 0

POST
H/1.1 200
OK / Show response
colossusssp.com/ 2 B
249 B 337ms
336ms XHR
application/json 8.2.111.123
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://colossusssp.com/?c=o&m=multi
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 8.2.111.123 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://leisurelylifestyle.com
Date: Mon, 12 Sep 2022 05:31:45 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 2
Content-Type: application/json

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 170ms
170ms Preflight 13.250.192.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.250.192.86 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-250-192-86.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://leisurelylifestyle.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://leisurelylifestyle.com
access-control-max-age: 600
age: 0
content-length: 0
date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 16 KB
9 KB 456ms
455ms XHR
application/json 52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 5d6e82b6cfce7d94a3f8318d4d5997c41b64e7ab2dda42714588084a67353578

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
x-prebid: pbs-java/1.97.0
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 9276
expires: 0

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
253 B 270ms
270ms XHR
application/json 23.195.153.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.195.153.54 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-195-153-54.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Mon, 12 Sep 2022 05:31:45 GMT

GET
H3 200 cygnus Show response
htlb.casalemedia.com/ 38 B
511 B 405ms
404ms XHR
application/json 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=185763&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22279aa79bdaa7792c%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%3F%23PD%3Adesktop%23Source%3Adirect%23Browser%3AChrome%23Topic%3ATravel%23MCMP%3AAO_DATE%23MCMP%3ABA_WSKW20%23MCMP%3AAO_CHLD%23Sens%3Aalc%23Sens%3Aast%23Sens%3Acbd%23Sens%3Aconl%23Sens%3Acosm%23Sens%3Adat%23Sens%3Adlu%23Sens%3Adrg%23Sens%3Agamc%23Sens%3Agamv%23Sens%3Agrq%23Sens%3Apol%23Sens%3Arel%23Sens%3Asst%23Sens%3Assr%23Sens%3Asrh%23Sens%3Aske%23Sens%3Atob%23Sens%3Awtl%23vp%3A0%23MSFTA_2022%3ATrue%23TRGT_022020%3ATrue%23TYTA_22%3ATrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A9%2C%22msi%22%3A9%2C%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.27.0%22%2C%22userIds%22%3A%5B%5D%2C%22url%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22dms%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22280026c5207486f5%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185763%22%2C%22sid%22%3A%225_1%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22185763%22%2C%22sid%22%3A%225_2%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A100%2C%22ext%22%3A%7B%22siteID%22%3A%22185763%22%2C%22sid%22%3A%225_3%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22185763%22%2C%22sid%22%3A%225_4%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22185763%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A336%2C%22h%22%3A280%2C%22ext%22%3A%7B%22siteID%22%3A%22185763%22%2C%22sid%22%3A%22336x280%22%7D%7D%2C%7B%22w%22%3A468%2C%22h%22%3A60%2C%22ext%22%3A%7B%22siteID%22%3A%22185763%22%2C%22sid%22%3A%22468x60%22%7D%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185763%22%2C%22sid%22%3A%22250x250%22%7D%7D%2C%7B%22w%22%3A120%2C%22h%22%3A240%2C%22ext%22%3A%7B%22siteID%22%3A%22185763%22%2C%22sid%22%3A%22120x240%22%7D%7D%2C%7B%22w%22%3A1%2C%22h%22%3A1%2C%22ext%22%3A%7B%22siteID%22%3A%22185763%22%2C%22sid%22%3A%221x1%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A300%2C%22ext%22%3A%7B%22siteID%22%3A%22185763%22%2C%22sid%22%3A%22300x300%22%7D%7D%2C%7B%22w%22%3A552%2C%22h%22%3A334%2C%22ext%22%3A%7B%22siteID%22%3A%22185763%22%2C%22sid%22%3A%22552x334%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185763%22%2C%22sid%22%3A%22728x250%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F18190176%2FAdThrive_Content_3%2F61d877f7514b73001b093e34%22%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_3%2F61d877f7514b73001b093e34%22%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%2213b29320-bd1e-4d99-8dcf-497f56df269b%22%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%5D%7D%5D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 188fdafae7cac380bb2bf494fa866cef84d20b29d53892e6183e0e536d53140c

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I%2FdjG7TCAV1zTPc8b74mGtEHKCG6hiG1cQ1kn8ua8AsAxmGvDeoRynwGIRtDD7q7sBpQB%2FWrh9AuovZBfb%2FrYmZ8lDWilr0qMfWuXZFaXRXRw%2BxwXM7rCtrWfi8wmdF0CReXdgNQ"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7496423a0e645ac4-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 38
expires: 0

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
319 B 329ms
329ms XHR
application/json 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.27.0&cb=51786389417

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:44 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
511 B 253ms
253ms XHR
application/json 52.220.232.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.27.0&referrer=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tmax=2800&us_privacy=1---

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.220.232.15 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
accept-ch: sec-ch-ua-mobile,sec-ch-save-data,sec-ch-device-memory,sec-ch-dpr,sec-ch-ua-full-version,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-viewport-width,sec-ch-ua-platform,sec-ch-viewport-height,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua,sec-ch-ua-bitness,sec-ch-prefers-color-scheme,sec-ch-width,sec-ch-ect,user-agent,sec-ch-downlink
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H/1.1 200
OK bid Show response
krk.kargo.com/api/v2/ 2 B
657 B 343ms
342ms XHR
application/json 52.77.87.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://krk.kargo.com/api/v2/bid?json=%7B%22sessionId%22%3A%2237119b77-34ef-49ba-9aef-270ab536c25b%22%2C%22requestCount%22%3A7%2C%22timeout%22%3A2800%2C%22currency%22%3A%22USD%22%2C%22cpmGranularity%22%3A1%2C%22timestamp%22%3A1662960705562%2C%22cpmRange%22%3A%7B%22floor%22%3A0%2C%22ceil%22%3A20%7D%2C%22bidIDs%22%3A%7B%222893f7e354b28218%22%3A%22_mfu14jCkaN%22%2C%222902f69e09686629%22%3A%22_vzS4k9rMKu%22%7D%2C%22bidSizes%22%3A%7B%222893f7e354b28218%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%222902f69e09686629%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%2C%22prebidRawBidRequests%22%3A%5B%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_mfu14jCkaN%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content_3%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content_3%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_3%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_3_desktop%22%2C%22transactionId%22%3A%228f10418c-58d9-4765-8f1e-1f82560e1950%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%222893f7e354b28218%22%2C%22bidderRequestId%22%3A%222885b54d688a7a2d%22%2C%22auctionId%22%3A%22395f682f-f332-4329-af1d-092a1565c87e%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%2213b29320-bd1e-4d99-8dcf-497f56df269b%22%7D%5D%7D%7D%2C%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_vzS4k9rMKu%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content_3%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content_3%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_3%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_3_desktop%22%2C%22transactionId%22%3A%228f10418c-58d9-4765-8f1e-1f82560e1950%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%222902f69e09686629%22%2C%22bidderRequestId%22%3A%222885b54d688a7a2d%22%2C%22auctionId%22%3A%22395f682f-f332-4329-af1d-092a1565c87e%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%2213b29320-bd1e-4d99-8dcf-497f56df269b%22%7D%5D%7D%7D%5D%2C%22userIDs%22%3A%7B%22crbIDs%22%3A%7B%7D%2C%22usp%22%3A%221---%22%7D%2C%22pageURL%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22rawCRB%22%3Anull%2C%22rawCRBLocalStorage%22%3Anull%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.87.101 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-87-101.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:45 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 26
X-Accel-Expires: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
93 B 237ms
236ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9694d00177771bcae21c6941d30023&pos=8a9694d00177771bcae220463a710058&cmd=bid&sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&secure=1&us_privacy=1---
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: aa35b059c5a01607c898ef45f625b2a0c49eadabc92ba31a65a47860a3823ffb

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 62

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
65 B 199ms
199ms XHR
text/plain 103.231.98.193
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.193 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://leisurelylifestyle.com
date: Mon, 12 Sep 2022 05:31:45 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 623 B
658 B 434ms
434ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881402&size_id=15&alt_size_ids=2%2C1%2C14%2C16%2C43%2C44%2C48%2C117%2C221&us_privacy=1---&rp_schain=1.0,1!cafemedia.com,61d877f7514b73001b093e34,1,13b29320-bd1e-4d99-8dcf-497f56df269b,,&eid_pubcid.org=d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%5E1&rf=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tg_i.mcmp=AO_DATE%2CBA_WSKW20%2CAO_CHLD&tg_i.site_code=MSFTA_2022%2CTRGT_022020%2CTYTA_22&tg_i.site_id=61d877f7514b73001b093e34&tg_i.sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&tg_i.verticals=Travel&tg_i.pmp_elig=true&tg_i.refresh=false&tg_i.vp=0&tg_i.pbadslot=%2F18190176%2FAdThrive_Content_3%2F61d877f7514b73001b093e34&tk_flint=pbjs_lite_v6.27.0&x_source.tid=8f10418c-58d9-4765-8f1e-1f82560e1950&l_pb_bid_id=296c64ac0c8ebb36&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F18190176%2FAdThrive_Content_3%2F61d877f7514b73001b093e34&slots=1&rand=0.9606123081777858
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: d65f7b89d7d090af34d384eb5eea91f3a38bb38f668934fe00bec08d38a01dad

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
server: nginx/1.21.4
vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-type: application/json
content-length: 623
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
97 B 344ms
344ms XHR
application/json 52.77.152.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.77.152.198 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-152-198.ap-southeast-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 08eddf721fd7bf5c1a6de78ebfd8d3a8ae243903b0824d37bb377e951bbbd93f

Request headers

Referer: https://leisurelylifestyle.com/
x-openrtb-version: 2.5
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
content-length: 66

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 380ms
380ms XHR
application/json 104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-52-220-232-15.ap-southeast-1.compute.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

bca29c467aa53bffabbc69e43fa372b822c1194ffd22a7158cdc7106550ca285

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:45 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 278e9dbe-6a25-440f-bbbc-544b5a1afc14
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK cafemedia Show response
direct.adsrvr.org/bid/bidder/ 0
406 B 287ms
287ms XHR
application/json 13.248.136.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/cafemedia
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 13.248.136.210 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: af721359bfd441050.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
x-openrtb-version: 2.3
server: Kestrel
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 0

POST
H/1.1 200
OK / Show response
colossusssp.com/ 2 B
249 B 338ms
338ms XHR
application/json 8.2.111.123
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://colossusssp.com/?c=o&m=multi
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 8.2.111.123 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://leisurelylifestyle.com
Date: Mon, 12 Sep 2022 05:31:45 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 2
Content-Type: application/json

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 354 B
514 B 424ms
424ms XHR
application/json 52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 0770fcaee558930c0c2a89e6bf290108e344f71481ce0236a5b467b7fad1fb5b

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
x-prebid: pbs-java/1.97.0
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 275
expires: 0

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
253 B 263ms
263ms XHR
application/json 23.195.153.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.195.153.54 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-195-153-54.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Mon, 12 Sep 2022 05:31:45 GMT

GET
H3 200 cygnus Show response
htlb.casalemedia.com/ 38 B
514 B 1014ms
1013ms XHR
application/json 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=185766&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%224096c28ff7356d52%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%3F%23PD%3Adesktop%23Source%3Adirect%23Browser%3AChrome%23Topic%3ATravel%23MCMP%3AAO_DATE%23MCMP%3ABA_WSKW20%23MCMP%3AAO_CHLD%23Sens%3Aalc%23Sens%3Aast%23Sens%3Acbd%23Sens%3Aconl%23Sens%3Acosm%23Sens%3Adat%23Sens%3Adlu%23Sens%3Adrg%23Sens%3Agamc%23Sens%3Agamv%23Sens%3Agrq%23Sens%3Apol%23Sens%3Arel%23Sens%3Asst%23Sens%3Assr%23Sens%3Asrh%23Sens%3Aske%23Sens%3Atob%23Sens%3Awtl%23vp%3A0%23MSFTA_2022%3ATrue%23TRGT_022020%3ATrue%23TYTA_22%3ATrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A9%2C%22msi%22%3A9%2C%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.27.0%22%2C%22userIds%22%3A%5B%5D%2C%22url%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22dms%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%224101a4a4f14c39a%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185766%22%2C%22sid%22%3A%228_1%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22185766%22%2C%22sid%22%3A%228_2%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A100%2C%22ext%22%3A%7B%22siteID%22%3A%22185766%22%2C%22sid%22%3A%228_3%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22185766%22%2C%22sid%22%3A%228_4%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22185766%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A336%2C%22h%22%3A280%2C%22ext%22%3A%7B%22siteID%22%3A%22185766%22%2C%22sid%22%3A%22336x280%22%7D%7D%2C%7B%22w%22%3A468%2C%22h%22%3A60%2C%22ext%22%3A%7B%22siteID%22%3A%22185766%22%2C%22sid%22%3A%22468x60%22%7D%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185766%22%2C%22sid%22%3A%22250x250%22%7D%7D%2C%7B%22w%22%3A120%2C%22h%22%3A240%2C%22ext%22%3A%7B%22siteID%22%3A%22185766%22%2C%22sid%22%3A%22120x240%22%7D%7D%2C%7B%22w%22%3A1%2C%22h%22%3A1%2C%22ext%22%3A%7B%22siteID%22%3A%22185766%22%2C%22sid%22%3A%221x1%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A300%2C%22ext%22%3A%7B%22siteID%22%3A%22185766%22%2C%22sid%22%3A%22300x300%22%7D%7D%2C%7B%22w%22%3A552%2C%22h%22%3A334%2C%22ext%22%3A%7B%22siteID%22%3A%22185766%22%2C%22sid%22%3A%22552x334%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22185766%22%2C%22sid%22%3A%22728x250%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F18190176%2FAdThrive_Content_6%2F61d877f7514b73001b093e34%22%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_6%2F61d877f7514b73001b093e34%22%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%229780d82f-ccec-4f6d-80cb-0a7acbfeb4fb%22%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%5D%7D%5D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 126d0157735ec9993916f4a6d38ff3305dcd3a2bcb4629210445ff24168a64c1

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9wQ6CAZT9aOZksJWB1sWIpXXsv9tzvE1zlSN5vchoFY0Fs2Dk9fIQd27tqz%2BBY%2FxumBDEoov99TTkrl6vl3W%2BkzeGQ1j1B0sjq%2Brb7UqAiI%2BLZE6XWP0i%2Fk%2F7bbOrhvLb896N8Ka"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7496423a2e8b5ac4-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 38
expires: 0

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
319 B 476ms
475ms XHR
application/json 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.27.0&cb=70159134402

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
511 B 276ms
276ms XHR
application/json 52.220.232.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.27.0&referrer=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tmax=2800&us_privacy=1---

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.220.232.15 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
accept-ch: sec-ch-ua,sec-ch-ua-bitness,sec-ch-prefers-color-scheme,sec-ch-width,sec-ch-ect,user-agent,sec-ch-downlink,sec-ch-ua-mobile,sec-ch-save-data,sec-ch-device-memory,sec-ch-dpr,sec-ch-ua-full-version,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-viewport-width,sec-ch-ua-platform,sec-ch-viewport-height,sec-ch-rtt,sec-ch-ua-arch
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H/1.1 200
OK bid Show response
krk.kargo.com/api/v2/ 2 B
657 B 263ms
263ms XHR
application/json 52.77.87.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://krk.kargo.com/api/v2/bid?json=%7B%22sessionId%22%3A%2237119b77-34ef-49ba-9aef-270ab536c25b%22%2C%22requestCount%22%3A8%2C%22timeout%22%3A2800%2C%22currency%22%3A%22USD%22%2C%22cpmGranularity%22%3A1%2C%22timestamp%22%3A1662960705577%2C%22cpmRange%22%3A%7B%22floor%22%3A0%2C%22ceil%22%3A20%7D%2C%22bidIDs%22%3A%7B%224193673aa88100d8%22%3A%22_mfu14jCkaN%22%2C%22420b93fc712ab148%22%3A%22_vzS4k9rMKu%22%7D%2C%22bidSizes%22%3A%7B%224193673aa88100d8%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22420b93fc712ab148%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%2C%22prebidRawBidRequests%22%3A%5B%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_mfu14jCkaN%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content_6%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content_6%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_6%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_6_desktop%22%2C%22transactionId%22%3A%22ab7b7e8c-1196-429a-a3a0-a19f649d59fb%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%224193673aa88100d8%22%2C%22bidderRequestId%22%3A%22418944ce2e34f68e%22%2C%22auctionId%22%3A%22585448f1-e282-4975-860f-99e47c7212f5%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%229780d82f-ccec-4f6d-80cb-0a7acbfeb4fb%22%7D%5D%7D%7D%2C%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_vzS4k9rMKu%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content_6%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content_6%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_6%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_6_desktop%22%2C%22transactionId%22%3A%22ab7b7e8c-1196-429a-a3a0-a19f649d59fb%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%22420b93fc712ab148%22%2C%22bidderRequestId%22%3A%22418944ce2e34f68e%22%2C%22auctionId%22%3A%22585448f1-e282-4975-860f-99e47c7212f5%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%229780d82f-ccec-4f6d-80cb-0a7acbfeb4fb%22%7D%5D%7D%7D%5D%2C%22userIDs%22%3A%7B%22crbIDs%22%3A%7B%7D%2C%22usp%22%3A%221---%22%7D%2C%22pageURL%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22rawCRB%22%3Anull%2C%22rawCRBLocalStorage%22%3Anull%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.87.101 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-87-101.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:45 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 26
X-Accel-Expires: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
65 B 201ms
201ms XHR
text/plain 103.231.98.193
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.193 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://leisurelylifestyle.com
date: Mon, 12 Sep 2022 05:31:45 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 623 B
658 B 299ms
299ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881408&size_id=15&alt_size_ids=2%2C1%2C14%2C16%2C43%2C44%2C48%2C117%2C221&us_privacy=1---&rp_schain=1.0,1!cafemedia.com,61d877f7514b73001b093e34,1,9780d82f-ccec-4f6d-80cb-0a7acbfeb4fb,,&eid_pubcid.org=d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%5E1&rf=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tg_i.mcmp=AO_DATE%2CBA_WSKW20%2CAO_CHLD&tg_i.site_code=MSFTA_2022%2CTRGT_022020%2CTYTA_22&tg_i.site_id=61d877f7514b73001b093e34&tg_i.sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&tg_i.verticals=Travel&tg_i.pmp_elig=true&tg_i.refresh=false&tg_i.vp=0&tg_i.pbadslot=%2F18190176%2FAdThrive_Content_6%2F61d877f7514b73001b093e34&tk_flint=pbjs_lite_v6.27.0&x_source.tid=ab7b7e8c-1196-429a-a3a0-a19f649d59fb&l_pb_bid_id=42479b8052516b79&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F18190176%2FAdThrive_Content_6%2F61d877f7514b73001b093e34&slots=1&rand=0.31652415891281693
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 7b94ab1e8e453d32abeba17e1523bef5d8591366587cfef048c01a10c02618b4

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
server: nginx/1.21.4
vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-type: application/json
content-length: 623
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 380ms
380ms XHR
application/json 104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-52-220-232-15.ap-southeast-1.compute.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

a51d8b3cf119eb1d6458202edca601bbb6369d883aa6e20eae9504c405366af6

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:45 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: dfd79120-263e-4de0-8bde-68507dc2668f
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK cafemedia Show response
direct.adsrvr.org/bid/bidder/ 0
406 B 191ms
191ms XHR
application/json 13.248.136.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/cafemedia
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 13.248.136.210 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: af721359bfd441050.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
x-openrtb-version: 2.3
server: Kestrel
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 0

POST
H/1.1 200
OK / Show response
colossusssp.com/ 2 B
249 B 338ms
338ms XHR
application/json 8.2.111.123
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://colossusssp.com/?c=o&m=multi
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 8.2.111.123 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://leisurelylifestyle.com
Date: Mon, 12 Sep 2022 05:31:45 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 2
Content-Type: application/json

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 358 B
513 B 540ms
539ms XHR
application/json 52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 8ba54621b33975e712a9041e89e6373af3fff7f75bbf24f58e90b6de18369150

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: gzip
x-prebid: pbs-java/1.97.0
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 274
expires: 0

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
253 B 268ms
268ms XHR
application/json 23.195.153.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.195.153.54 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-195-153-54.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Mon, 12 Sep 2022 05:31:45 GMT

GET
H3 200 cygnus Show response
htlb.casalemedia.com/ 38 B
510 B 652ms
652ms XHR
application/json 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=404604&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%224532f7df89ea37d3%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%3F%23PD%3Adesktop%23Source%3Adirect%23Browser%3AChrome%23Topic%3ATravel%23MCMP%3AAO_DATE%23MCMP%3ABA_WSKW20%23MCMP%3AAO_CHLD%23Sens%3Aalc%23Sens%3Aast%23Sens%3Acbd%23Sens%3Aconl%23Sens%3Acosm%23Sens%3Adat%23Sens%3Adlu%23Sens%3Adrg%23Sens%3Agamc%23Sens%3Agamv%23Sens%3Agrq%23Sens%3Apol%23Sens%3Arel%23Sens%3Asst%23Sens%3Assr%23Sens%3Asrh%23Sens%3Aske%23Sens%3Atob%23Sens%3Awtl%23vp%3A0%23MSFTA_2022%3ATrue%23TRGT_022020%3ATrue%23TYTA_22%3ATrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A10%2C%22msi%22%3A10%2C%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.27.0%22%2C%22userIds%22%3A%5B%5D%2C%22url%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22dms%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22454d021e1378c068%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22404604%22%2C%22sid%22%3A%2210_1%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22404604%22%2C%22sid%22%3A%2210_1%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22404604%22%2C%22sid%22%3A%2210_2%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22404604%22%2C%22sid%22%3A%2210_2%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22404604%22%2C%22sid%22%3A%2210_3%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22404604%22%2C%22sid%22%3A%2210_3%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22404604%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A336%2C%22h%22%3A280%2C%22ext%22%3A%7B%22siteID%22%3A%22404604%22%2C%22sid%22%3A%22336x280%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A100%2C%22ext%22%3A%7B%22siteID%22%3A%22404604%22%2C%22sid%22%3A%22320x100%22%7D%7D%2C%7B%22w%22%3A468%2C%22h%22%3A60%2C%22ext%22%3A%7B%22siteID%22%3A%22404604%22%2C%22sid%22%3A%22468x60%22%7D%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22404604%22%2C%22sid%22%3A%22250x250%22%7D%7D%2C%7B%22w%22%3A120%2C%22h%22%3A240%2C%22ext%22%3A%7B%22siteID%22%3A%22404604%22%2C%22sid%22%3A%22120x240%22%7D%7D%2C%7B%22w%22%3A1%2C%22h%22%3A1%2C%22ext%22%3A%7B%22siteID%22%3A%22404604%22%2C%22sid%22%3A%221x1%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A300%2C%22ext%22%3A%7B%22siteID%22%3A%22404604%22%2C%22sid%22%3A%22300x300%22%7D%7D%2C%7B%22w%22%3A552%2C%22h%22%3A334%2C%22ext%22%3A%7B%22siteID%22%3A%22404604%22%2C%22sid%22%3A%22552x334%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22404604%22%2C%22sid%22%3A%22728x250%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F18190176%2FAdThrive_Content_8%2F61d877f7514b73001b093e34%22%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_8%2F61d877f7514b73001b093e34%22%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%229780d82f-ccec-4f6d-80cb-0a7acbfeb4fb%22%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%5D%7D%5D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f970487b9335e3536a50ff742914f02abcf28af19807b8d247a412b3af65ab7b

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iuibaHS2EFzmQ6LG%2BIBmMycSbAcarx2q7JIkrrfl4oJX%2BuEwAxJifarC0ngMpM60q%2FDtQ715m2dpnxsL4lL7wv96VkvcP%2B9dwvbdwMWlVJiYVMJoLHehBWW0KzprJc%2FGTGw4Wc56"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7496423a5f175ac4-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 38
expires: 0

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
319 B 353ms
353ms XHR
application/json 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.27.0&cb=96707762267

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
511 B 260ms
260ms XHR
application/json 52.220.232.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.27.0&referrer=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tmax=2800&us_privacy=1---

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.220.232.15 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
accept-ch: sec-ch-ect,sec-ch-width,sec-ch-prefers-color-scheme,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-arch,sec-ch-rtt,sec-ch-viewport-height,sec-ch-ua-platform,sec-ch-viewport-width,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-dpr,sec-ch-device-memory,sec-ch-save-data,sec-ch-ua-mobile,sec-ch-downlink,user-agent
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H/1.1 200
OK bid Show response
krk.kargo.com/api/v2/ 2 B
657 B 252ms
252ms XHR
application/json 52.77.87.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://krk.kargo.com/api/v2/bid?json=%7B%22sessionId%22%3A%2237119b77-34ef-49ba-9aef-270ab536c25b%22%2C%22requestCount%22%3A9%2C%22timeout%22%3A2800%2C%22currency%22%3A%22USD%22%2C%22cpmGranularity%22%3A1%2C%22timestamp%22%3A1662960705616%2C%22cpmRange%22%3A%7B%22floor%22%3A0%2C%22ceil%22%3A20%7D%2C%22bidIDs%22%3A%7B%2246506123e208b4e8%22%3A%22_mfu14jCkaN%22%2C%2246656802c2910b43%22%3A%22_vzS4k9rMKu%22%7D%2C%22bidSizes%22%3A%7B%2246506123e208b4e8%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%2246656802c2910b43%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%2C%22prebidRawBidRequests%22%3A%5B%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_mfu14jCkaN%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content_8%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content_8%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_8%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22pos%22%3A1%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_8_desktop%22%2C%22transactionId%22%3A%22b22d35d3-b5e5-4864-8d30-777fc5b519f4%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%2246506123e208b4e8%22%2C%22bidderRequestId%22%3A%22464441a6910726f9%22%2C%22auctionId%22%3A%221f44e91d-ca82-4370-9684-a7f346109ed7%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%229780d82f-ccec-4f6d-80cb-0a7acbfeb4fb%22%7D%5D%7D%7D%2C%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_vzS4k9rMKu%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content_8%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content_8%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_8%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22pos%22%3A1%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_8_desktop%22%2C%22transactionId%22%3A%22b22d35d3-b5e5-4864-8d30-777fc5b519f4%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%2246656802c2910b43%22%2C%22bidderRequestId%22%3A%22464441a6910726f9%22%2C%22auctionId%22%3A%221f44e91d-ca82-4370-9684-a7f346109ed7%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%229780d82f-ccec-4f6d-80cb-0a7acbfeb4fb%22%7D%5D%7D%7D%5D%2C%22userIDs%22%3A%7B%22crbIDs%22%3A%7B%7D%2C%22usp%22%3A%221---%22%7D%2C%22pageURL%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22rawCRB%22%3Anull%2C%22rawCRBLocalStorage%22%3Anull%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.87.101 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-87-101.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:45 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 26
X-Accel-Expires: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
65 B 322ms
321ms XHR
text/plain 103.231.98.193
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.193 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://leisurelylifestyle.com
date: Mon, 12 Sep 2022 05:31:45 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 623 B
658 B 274ms
273ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881412&size_id=15&alt_size_ids=2%2C1%2C14%2C16%2C43%2C44%2C48%2C117%2C221&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!cafemedia.com,61d877f7514b73001b093e34,1,9780d82f-ccec-4f6d-80cb-0a7acbfeb4fb,,&eid_pubcid.org=d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%5E1&rf=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tg_i.mcmp=AO_DATE%2CBA_WSKW20%2CAO_CHLD&tg_i.site_code=MSFTA_2022%2CTRGT_022020%2CTYTA_22&tg_i.site_id=61d877f7514b73001b093e34&tg_i.sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&tg_i.verticals=Travel&tg_i.pmp_elig=true&tg_i.refresh=false&tg_i.vp=0&tg_i.pbadslot=%2F18190176%2FAdThrive_Content_8%2F61d877f7514b73001b093e34&tk_flint=pbjs_lite_v6.27.0&x_source.tid=b22d35d3-b5e5-4864-8d30-777fc5b519f4&l_pb_bid_id=4702750ae18331dc&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F18190176%2FAdThrive_Content_8%2F61d877f7514b73001b093e34&slots=1&rand=0.13455361356242057
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 9ee2ef9c3fb6c50f574af802bd281ec8d0caa16d5dd35d73af02237e51f35770

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
server: nginx/1.21.4
vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-type: application/json
content-length: 623
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 340ms
339ms XHR
application/json 104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-52-220-232-15.ap-southeast-1.compute.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

d7b231a46aaeadc6584007cf0591a010f838a18f96da9af9b5afe17b21252242

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:45 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 9b17a744-c867-4c5e-be17-da3f012434dd
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK cafemedia Show response
direct.adsrvr.org/bid/bidder/ 0
406 B 189ms
189ms XHR
application/json 13.248.136.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/cafemedia
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 13.248.136.210 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: af721359bfd441050.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
x-openrtb-version: 2.3
server: Kestrel
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 0

POST
H/1.1 200
OK / Show response
colossusssp.com/ 2 B
249 B 406ms
406ms XHR
application/json 8.2.111.123
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://colossusssp.com/?c=o&m=multi
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 8.2.111.123 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://leisurelylifestyle.com
Date: Mon, 12 Sep 2022 05:31:45 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 2
Content-Type: application/json

GET
H2

200

setuid
prebid-server.rubiconproject.com/
Redirect Chain

https://prebid-match.dotomi.com/match/bounce/current?version=1&networkId=72582&rurl=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dconversant%26gdpr%3D%26gdpr_consent%3D%26us_pr...
https://prebid-match.dotomi.com/match/bounce/current?DotomiTest=24030b2390f1b28&is_secure=true&version=1&networkId=72582&rurl=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dconv...
https://prebid-server.rubiconproject.com/setuid?bidder=conversant&gdpr=&gdpr_consent=&us_privacy=1---&networkId=72582&version=1&f=i&uid=AAAJqFty_zdepQNszu2iAAAAAAA&expiration=1663047106&is_secure=true

86 B
711 B

280ms
280ms

Image
image/png

52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-server.rubiconproject.com/setuid?bidder=conversant&gdpr=&gdpr_consent=&us_privacy=1---&networkId=72582&version=1&f=i&uid=AAAJqFty_zdepQNszu2iAAAAAAA&expiration=1663047106&is_secure=true
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/png
content-encoding: gzip
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://prebid-server.rubiconproject.com/setuid?bidder=conversant&gdpr=&gdpr_consent=&us_privacy=1---&networkId=72582&version=1&f=i&uid=AAAJqFty_zdepQNszu2iAAAAAAA&expiration=1663047106&is_secure=true
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 354 B
514 B 678ms
678ms XHR
application/json 52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 4d850157eadd8eba691b1bfeee43b3cd1fbb42dfd72999e4799129c6377975a2

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: gzip
x-prebid: pbs-java/1.97.0
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 275
expires: 0

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
253 B 266ms
265ms XHR
application/json 23.195.153.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.195.153.54 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-195-153-54.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Mon, 12 Sep 2022 05:31:45 GMT

GET
H3 200 cygnus Show response
htlb.casalemedia.com/ 38 B
509 B 714ms
713ms XHR
application/json 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=404605&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%224977d90d4c00b95f%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%3F%23PD%3Adesktop%23Source%3Adirect%23Browser%3AChrome%23Topic%3ATravel%23MCMP%3AAO_DATE%23MCMP%3ABA_WSKW20%23MCMP%3AAO_CHLD%23Sens%3Aalc%23Sens%3Aast%23Sens%3Acbd%23Sens%3Aconl%23Sens%3Acosm%23Sens%3Adat%23Sens%3Adlu%23Sens%3Adrg%23Sens%3Agamc%23Sens%3Agamv%23Sens%3Agrq%23Sens%3Apol%23Sens%3Arel%23Sens%3Asst%23Sens%3Assr%23Sens%3Asrh%23Sens%3Aske%23Sens%3Atob%23Sens%3Awtl%23vp%3A0%23MSFTA_2022%3ATrue%23TRGT_022020%3ATrue%23TYTA_22%3ATrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A10%2C%22msi%22%3A10%2C%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.27.0%22%2C%22userIds%22%3A%5B%5D%2C%22url%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22dms%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22498b9c93c7c248ad%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%2211_1%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%2211_1%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%2211_2%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%2211_2%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%2211_3%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%2211_3%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A336%2C%22h%22%3A280%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%22336x280%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A100%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%22320x100%22%7D%7D%2C%7B%22w%22%3A468%2C%22h%22%3A60%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%22468x60%22%7D%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%22250x250%22%7D%7D%2C%7B%22w%22%3A120%2C%22h%22%3A240%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%22120x240%22%7D%7D%2C%7B%22w%22%3A1%2C%22h%22%3A1%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%221x1%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A300%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%22300x300%22%7D%7D%2C%7B%22w%22%3A552%2C%22h%22%3A334%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%22552x334%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%22728x250%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F18190176%2FAdThrive_Content%2F61d877f7514b73001b093e34%22%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content%2F61d877f7514b73001b093e34%22%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%229780d82f-ccec-4f6d-80cb-0a7acbfeb4fb%22%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%5D%7D%5D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 53d4d40c28e65899d2e6def3f1cfbac1f0595f50b6ca135c12ff0609c12f590e

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SUiVuqegq04BcEIwjXd01gUsEHzmQTOslhzdCKLEoHRu49T6KnXMjOVj7dH0jhkhFlX5MOWkzxVIBdjQjTVjggLVHFiZQDoiPPAPdX7LzhV8spexwtOt4S1ul%2BL5h%2FigJoFW3qwp"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7496423b086f5ac4-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 38
expires: 0

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
319 B 356ms
352ms XHR
application/json 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.27.0&cb=69132082401

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
511 B 247ms
244ms XHR
application/json 52.220.232.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.27.0&referrer=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tmax=2800&us_privacy=1---

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.220.232.15 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
accept-ch: sec-ch-ua,sec-ch-ua-arch,sec-ch-rtt,sec-ch-viewport-height,sec-ch-ua-platform,sec-ch-viewport-width,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-dpr,sec-ch-device-memory,sec-ch-save-data,sec-ch-ua-mobile,sec-ch-downlink,user-agent,sec-ch-ect,sec-ch-width,sec-ch-prefers-color-scheme,sec-ch-ua-bitness
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H/1.1 200
OK bid Show response
krk.kargo.com/api/v2/ 2 B
657 B 231ms
227ms XHR
application/json 52.77.87.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://krk.kargo.com/api/v2/bid?json=%7B%22sessionId%22%3A%2237119b77-34ef-49ba-9aef-270ab536c25b%22%2C%22requestCount%22%3A10%2C%22timeout%22%3A2800%2C%22currency%22%3A%22USD%22%2C%22cpmGranularity%22%3A1%2C%22timestamp%22%3A1662960705722%2C%22cpmRange%22%3A%7B%22floor%22%3A0%2C%22ceil%22%3A20%7D%2C%22bidIDs%22%3A%7B%22509dc041d7bd135b%22%3A%22_mfu14jCkaN%22%2C%2251070c22edea38b4%22%3A%22_vzS4k9rMKu%22%7D%2C%22bidSizes%22%3A%7B%22509dc041d7bd135b%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%2251070c22edea38b4%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%2C%22prebidRawBidRequests%22%3A%5B%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_mfu14jCkaN%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22pos%22%3A1%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_10_desktop%22%2C%22transactionId%22%3A%227f2dff70-1eda-4d97-bc9a-5222911a813c%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%22509dc041d7bd135b%22%2C%22bidderRequestId%22%3A%22508c397f9fe31042%22%2C%22auctionId%22%3A%22d9e3de7d-97d8-44e7-8a3f-7950cb8c59bb%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%229780d82f-ccec-4f6d-80cb-0a7acbfeb4fb%22%7D%5D%7D%7D%2C%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_vzS4k9rMKu%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22pos%22%3A1%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_10_desktop%22%2C%22transactionId%22%3A%227f2dff70-1eda-4d97-bc9a-5222911a813c%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%2251070c22edea38b4%22%2C%22bidderRequestId%22%3A%22508c397f9fe31042%22%2C%22auctionId%22%3A%22d9e3de7d-97d8-44e7-8a3f-7950cb8c59bb%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%229780d82f-ccec-4f6d-80cb-0a7acbfeb4fb%22%7D%5D%7D%7D%5D%2C%22userIDs%22%3A%7B%22crbIDs%22%3A%7B%7D%2C%22usp%22%3A%221---%22%7D%2C%22pageURL%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22rawCRB%22%3Anull%2C%22rawCRBLocalStorage%22%3Anull%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.87.101 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-87-101.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:45 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 26
X-Accel-Expires: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
65 B 218ms
214ms XHR
text/plain 103.231.98.193
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.193 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://leisurelylifestyle.com
date: Mon, 12 Sep 2022 05:31:45 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 621 B
655 B 301ms
297ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881414&size_id=15&alt_size_ids=2%2C1%2C14%2C16%2C43%2C44%2C48%2C117%2C221&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!cafemedia.com,61d877f7514b73001b093e34,1,9780d82f-ccec-4f6d-80cb-0a7acbfeb4fb,,&eid_pubcid.org=d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%5E1&rf=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tg_i.mcmp=AO_DATE%2CBA_WSKW20%2CAO_CHLD&tg_i.site_code=MSFTA_2022%2CTRGT_022020%2CTYTA_22&tg_i.site_id=61d877f7514b73001b093e34&tg_i.sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&tg_i.verticals=Travel&tg_i.pmp_elig=true&tg_i.refresh=false&tg_i.vp=0&tg_i.pbadslot=%2F18190176%2FAdThrive_Content%2F61d877f7514b73001b093e34&tk_flint=pbjs_lite_v6.27.0&x_source.tid=7f2dff70-1eda-4d97-bc9a-5222911a813c&l_pb_bid_id=514c6464fcdff862&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F18190176%2FAdThrive_Content%2F61d877f7514b73001b093e34&slots=1&rand=0.39676236691959765
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 6ee46b56a545c367d878f6b18cd72ae71668bfcf51b6417cc26cfa9a7ec694f1

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:45 GMT
server: nginx/1.21.4
vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-type: application/json
content-length: 621
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 446ms
445ms XHR
application/json 104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

c598a8b6b3bf051e56181003227fd4c6851b8e38a0785a2e3800ff2bd87a0799

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:46 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 124c1d5c-a69c-487b-82e8-b3fea2615b24
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK cafemedia Show response
direct.adsrvr.org/bid/bidder/ 0
406 B 191ms
190ms XHR
application/json 13.248.136.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/cafemedia
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 13.248.136.210 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: af721359bfd441050.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
x-openrtb-version: 2.3
server: Kestrel
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 0

POST
H/1.1 200
OK / Show response
colossusssp.com/ 2 B
249 B 339ms
339ms XHR
application/json 8.2.111.123
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://colossusssp.com/?c=o&m=multi
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 8.2.111.123 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://leisurelylifestyle.com
Date: Mon, 12 Sep 2022 05:31:45 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 2
Content-Type: application/json

GET
H2 200 integrator.js Show response
adservice.google.com.au/adsid/ 107 B
165 B 476ms
175ms Script
application/javascript 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com.au/adsid/integrator.js?domain=leisurelylifestyle.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 486ms
185ms Script
application/javascript 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=leisurelylifestyle.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
8 KB 714ms
714ms XHR
text/plain 74.125.68.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3277682631422013&correlator=1870212771406558&eid=31068457%2C31068929%2C31069183%2C31069332&output=ldjh&gdfp_req=1&vrg=2022090601&ptt=17&impl=fifs&us_privacy=1---&tfcd=0&iu_parts=18190176%3A21726097356%2CAdThrive_Sidebar_9%2C61d877f7514b73001b093e34&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C300x250%7C300x600%7C320x50%7C160x600%7C300x1050%7C300x50%7C320x100%7C250x250%7C120x240%7C1x1%7C300x420&fluid=height&ifi=6&adks=2049900766&sfv=1-0-38&fsbs=1&fsapi=false&prev_scp=location%3DSidebar%26sequence%3D9%26id%3DAdThrive_Sidebar_9_desktop%26sticky%3Dtrue%26lazy%3Dfalse%26refresh%3D00%26nref%3D0%26hvp%3D60%26amznbid%3D2%26amznp%3D2%26flag_slot%3Dfv%253Af&eri=5&cust_params=flag%3Dtarget%253Aes2018%252Cadsmnche%253A1510%252Cpmp_elig%253A1%252Cclson%253Atrue%252CclsBranch%253A484004f%252CclsBucket%253Aprod%252Cintegration%253Aplugin%252Clmdv%253A1.7.0%26siteId%3D61d877f7514b73001b093e34%26siteName%3DLeisurely%2520Lifestyle%26verticals%3DTravel%26abgroup%3Dwvtls%253Aoff%252Camzn_hold_load%253Aon%252Crfii%253Aoff%252Cflr%253Acm%252Clzflr%253Aoff%252Cebho%253Asharethrough_ebda%252Cloglevel%253Aoff%252Cidho%253Aoff%252Clzhb%253Aon%252Clzcvp%253A1.25%252Clzbpvp%253A0.75%252Ctripleliftdr%253Aboth%252Cmagnitedr%253Aboth%252Cpbs2s_appnexus%253Aoff%252Cpbs2s_grid%253Aon%252Cpbs2s_gumgum%253Aoff%252Cpbs2s_openx%253Aoff%252Cadt%253A0%252Cito_ds%253A2800%252C3pho%253Anone%252Cvebho%253Aoff%252Ccbt%253A2s%252Cvast_to%253A10s%252Cproto%253Anv1%252Cpbm%253Aon%252CreqTo%253A15%252Cvadv%253Aon%252Csmhd100%253Aoff%252Csmad300%253Aon%252Cs2sbuff%253A300%252Crmos1%253Aoff%252Csocon%253A1%252Csab%253Aon%252Cdco%253Arelaxed%252Cmxrpog%253A5%252Cdajto%253Aoff%252Cjwb%253Aon%252Cvpred%253Aon%252Ccrtvmon%253Aoff%252Cpba%253Anone%252Camzn_hold_disp%253Aoff%252Cbmetrics%253Aon%252Cconfiant%253Aprod%252Ccnfep%253Aon%252Crefflr2%253A1.2%252Csocbe%253Asovpct2%252Clogcls%253Aoff%252Ctpcapi%253Aon%252Csidp%253Aoff%252Crebuildslot%253Aon%252Cupl%253Aoff%252Csekho%253Aoff%252Csospp%253Aon%252Crmosnv1%253Aoff%26bucket%3Dflex-30%26sens%3Dalc%252Cast%252Ccbd%252Cconl%252Ccosm%252Cdat%252Cdlu%252Cdrg%252Cgamc%252Cgamv%252Cgrq%252Cpol%252Crel%252Csst%252Cssr%252Csrh%252Cske%252Ctob%252Cwtl%26domain%3Dleisurelylifestyle.com%26plugin%3Dadthrive-ads-2.3.1%26hi_au%3Dod%252Com%26vpwxvph%3D1600x1200%26ri%3D48%26pvk%3D01GCR2X4B7FJF6KKGKM2Y5KPHN%26sess%3D01GCR2X4B72666RTK6J7CQK4KF%26branch%3Df56a6a1%26deployment%3D2022-09-06-5%253Aade-249%253Apr2618%253Af56a6a1%26hbho%3Dnativo%252Csharethrough%26vbho%3Dnone%26gptv%3D2022090601%26connection%3Dniet%253A4g%252Cdl%253A9.3%26fpv%3D1%26mcmp%3DAO_DATE%252CBA_WSKW20%252CAO_CHLD%26site_code%3DMSFTA_2022%252CTRGT_022020%252CTYTA_22%26marmalade%3Dtrue&sc=1&cookie_enabled=1&abxe=1&dt=1662960705746&dlt=1662960699576&idt=3135&adxs=237&adys=1107&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&frm=20&vis=1&psz=300x9664&msz=300x250&fws=4&ohw=1600&ga_vid=1266557791.1662960702&ga_sid=1662960705&ga_hid=335300354&ga_fc=true&cbidsp=CuoECAESEQoIdHJpcGxfc3MQiwQgAjgCEg0KBGdyaWQQiwQgAjgCEhMKCmJyaWdodHJvbGwQiwQgAjgCEhAKB3B1Ym1fc3MQiwQgAjgCEhAKB3J1Ymlfc3MQiwQgAjgCEhAKB3lpZWxkbW8QiwQgAjgCEhEKCDMzYWNyb3NzEIsEIAI4AhIPCgZ1bnJ1bHkQiwQgAjgCEg8KBmNvbF9zcxCLBCACOAISDAoFdGVhZHMQhQIgAhIJCgJpeBDzBCACEgkKAml4EPMEIAISCQoCaXgQ8wQgAhIJCgJpeBDzBCACEgkKAml4EPMEIAISDQoGY3JpdGVvENMCIAISEQoKdHJpcGxlbGlmdBD_ASACEgwKBWthcmdvEIkCIAISDAoFa2FyZ28QiQIgAhIOCgd2ZXJpem9uEJcCIAISDgoHdmVyaXpvbhCXAiACEg4KB3Zlcml6b24QlwIgAhIOCgd2ZXJpem9uEJcCIAISDwoIcHVibWF0aWMQ-gEgAhIOCgdydWJpY29uEKECIAISDwoIeWFob29zc3AQ8AQgAhIPCgh5YWhvb3NzcBDwBCACEg8KCHlhaG9vc3NwEPAEIAISDwoIeWFob29zc3AQ8AQgAhIPCghhcHBuZXh1cxDeAiACEgoKA3R0ZBDBASACEg8KCGNvbG9zc3VzEOICIAISEAoJdW5kZXJ0b25lEPAVIAMSDQoHcm91bmRlbBABIAISDQoHcm91bmRlbBABIAISDQoHcm91bmRlbBABIAIYAiIkYjljNjk3YzYtODg5Ny00NDYwLTljYjktMTM0MDIxYzI5OTUyKgIIA0oAQMQT

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

39fc0ca2ff5a7f808536bf48fbb3a5367152cd766969f0c1b733aa5c01cca389

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8318
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 0DD0 6 KB
3 KB 473ms
171ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202205091138/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 05:31:45 GMT
expires: Tue, 12 Sep 2023 05:31:45 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame EE34 6 KB
3 KB 473ms
171ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202205091138/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 05:31:45 GMT
expires: Tue, 12 Sep 2023 05:31:45 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F876 6 KB
3 KB 451ms
179ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202205091138/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 05:31:45 GMT
expires: Tue, 12 Sep 2023 05:31:45 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 04A2 6 KB
3 KB 297ms
168ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202205091138/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-220-232-15.ap-southeast-1.compute.amazonaws.com

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 05:31:45 GMT
expires: Tue, 12 Sep 2023 05:31:45 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 354 B
512 B 526ms
526ms XHR
application/json 52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: d187ca201ead3980b726afc9b9d045764e33281bd1193451a0d9f5585851ccb9

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: gzip
x-prebid: pbs-java/1.97.0
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 273
expires: 0

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
253 B 260ms
260ms XHR
application/json 23.195.153.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.195.153.54 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-195-153-54.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Mon, 12 Sep 2022 05:31:46 GMT

GET
H3 200 cygnus Show response
htlb.casalemedia.com/ 38 B
513 B 575ms
572ms XHR
application/json 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=404605&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22545d1619e73638f1%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%3F%23PD%3Adesktop%23Source%3Adirect%23Browser%3AChrome%23Topic%3ATravel%23MCMP%3AAO_DATE%23MCMP%3ABA_WSKW20%23MCMP%3AAO_CHLD%23Sens%3Aalc%23Sens%3Aast%23Sens%3Acbd%23Sens%3Aconl%23Sens%3Acosm%23Sens%3Adat%23Sens%3Adlu%23Sens%3Adrg%23Sens%3Agamc%23Sens%3Agamv%23Sens%3Agrq%23Sens%3Apol%23Sens%3Arel%23Sens%3Asst%23Sens%3Assr%23Sens%3Asrh%23Sens%3Aske%23Sens%3Atob%23Sens%3Awtl%23vp%3A0%23MSFTA_2022%3ATrue%23TRGT_022020%3ATrue%23TYTA_22%3ATrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A10%2C%22msi%22%3A10%2C%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.27.0%22%2C%22userIds%22%3A%5B%5D%2C%22url%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22dms%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2254633471c8438f86%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%2211_1%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%2211_1%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%2211_2%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%2211_2%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%2211_3%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%2211_3%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A336%2C%22h%22%3A280%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%22336x280%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A100%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%22320x100%22%7D%7D%2C%7B%22w%22%3A468%2C%22h%22%3A60%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%22468x60%22%7D%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%22250x250%22%7D%7D%2C%7B%22w%22%3A120%2C%22h%22%3A240%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%22120x240%22%7D%7D%2C%7B%22w%22%3A1%2C%22h%22%3A1%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%221x1%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A300%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%22300x300%22%7D%7D%2C%7B%22w%22%3A552%2C%22h%22%3A334%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%22552x334%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22404605%22%2C%22sid%22%3A%22728x250%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F18190176%2FAdThrive_Content_9%2F61d877f7514b73001b093e34%22%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_9%2F61d877f7514b73001b093e34%22%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%229780d82f-ccec-4f6d-80cb-0a7acbfeb4fb%22%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%5D%7D%5D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fc7e91fab5f5abbddc4ed0c1239ea6fd07cb14525ff3204664a425aa4263a3f2

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dzHFU6XmUNE%2FGw58HEUsXRqX5b72jg%2FTVqkemBn%2FOpyfCfYZmCwayr1Xdd8%2F5QVQvtp2VZlkp6juK8pCkEG%2FPWAKsAkv5ARqfs2GPn3jgMyKmYM4b5cY7msiGZStc7hJGgdu0uye"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7496423cebba5ac4-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 38
expires: 0

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
319 B 549ms
548ms XHR
application/json 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.27.0&cb=2046968007

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
511 B 265ms
264ms XHR
application/json 52.220.232.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.27.0&referrer=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tmax=2800&us_privacy=1---

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.220.232.15 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
accept-ch: sec-ch-viewport-width,sec-ch-ua-platform,sec-ch-viewport-height,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua,sec-ch-ua-bitness,sec-ch-prefers-color-scheme,sec-ch-width,sec-ch-ect,user-agent,sec-ch-downlink,sec-ch-ua-mobile,sec-ch-save-data,sec-ch-device-memory,sec-ch-dpr,sec-ch-ua-full-version,sec-ch-ua-model,sec-ch-ua-platform-version
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H/1.1 200
OK bid Show response
krk.kargo.com/api/v2/ 2 B
657 B 378ms
378ms XHR
application/json 52.77.87.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://krk.kargo.com/api/v2/bid?json=%7B%22sessionId%22%3A%2237119b77-34ef-49ba-9aef-270ab536c25b%22%2C%22requestCount%22%3A11%2C%22timeout%22%3A2800%2C%22currency%22%3A%22USD%22%2C%22cpmGranularity%22%3A1%2C%22timestamp%22%3A1662960706015%2C%22cpmRange%22%3A%7B%22floor%22%3A0%2C%22ceil%22%3A20%7D%2C%22bidIDs%22%3A%7B%22557d288f19f06ef8%22%3A%22_mfu14jCkaN%22%2C%22558ac39c14eb247f%22%3A%22_vzS4k9rMKu%22%7D%2C%22bidSizes%22%3A%7B%22557d288f19f06ef8%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22558ac39c14eb247f%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%2C%22prebidRawBidRequests%22%3A%5B%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_mfu14jCkaN%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content_9%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content_9%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_9%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22pos%22%3A1%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_9_desktop%22%2C%22transactionId%22%3A%220a2135a1-7963-44dc-b56a-48c1e7b8fb7e%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%22557d288f19f06ef8%22%2C%22bidderRequestId%22%3A%22556d9e816ad4b4f5%22%2C%22auctionId%22%3A%220db97aa5-a870-4931-aac9-383e7e90d391%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%229780d82f-ccec-4f6d-80cb-0a7acbfeb4fb%22%7D%5D%7D%7D%2C%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_vzS4k9rMKu%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content_9%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content_9%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_9%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22pos%22%3A1%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_9_desktop%22%2C%22transactionId%22%3A%220a2135a1-7963-44dc-b56a-48c1e7b8fb7e%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%22558ac39c14eb247f%22%2C%22bidderRequestId%22%3A%22556d9e816ad4b4f5%22%2C%22auctionId%22%3A%220db97aa5-a870-4931-aac9-383e7e90d391%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%229780d82f-ccec-4f6d-80cb-0a7acbfeb4fb%22%7D%5D%7D%7D%5D%2C%22userIDs%22%3A%7B%22crbIDs%22%3A%7B%7D%2C%22usp%22%3A%221---%22%7D%2C%22pageURL%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22rawCRB%22%3Anull%2C%22rawCRBLocalStorage%22%3Anull%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.87.101 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-87-101.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:46 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 26
X-Accel-Expires: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
65 B 203ms
202ms XHR
text/plain 103.231.98.193
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.193 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://leisurelylifestyle.com
date: Mon, 12 Sep 2022 05:31:46 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 623 B
681 B 282ms
282ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881414&size_id=15&alt_size_ids=2%2C1%2C14%2C16%2C43%2C44%2C48%2C117%2C221&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!cafemedia.com,61d877f7514b73001b093e34,1,9780d82f-ccec-4f6d-80cb-0a7acbfeb4fb,,&eid_pubcid.org=d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%5E1&rf=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tg_i.mcmp=AO_DATE%2CBA_WSKW20%2CAO_CHLD&tg_i.site_code=MSFTA_2022%2CTRGT_022020%2CTYTA_22&tg_i.site_id=61d877f7514b73001b093e34&tg_i.sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&tg_i.verticals=Travel&tg_i.pmp_elig=true&tg_i.refresh=false&tg_i.vp=0&tg_i.pbadslot=%2F18190176%2FAdThrive_Content_9%2F61d877f7514b73001b093e34&tk_flint=pbjs_lite_v6.27.0&x_source.tid=0a2135a1-7963-44dc-b56a-48c1e7b8fb7e&l_pb_bid_id=562b3dd05e990db&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F18190176%2FAdThrive_Content_9%2F61d877f7514b73001b093e34&slots=1&rand=0.8245403967886122
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 5f124ab85dedf78c469b995811a81055a35f27b22fae54f0600bb5124ecddab1

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
server: nginx/1.21.4
vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-type: application/json
content-length: 623
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 17 KB
9 KB 323ms
323ms XHR
application/json 104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-52-220-232-15.ap-southeast-1.compute.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

7db1ea2ab83c270a336e6317455e23b76f80a86ee662300e2b29586b720efe05

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 12 Sep 2022 05:31:46 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 3914e450-aead-4d61-87f6-1aaffd057a3e
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK cafemedia Show response
direct.adsrvr.org/bid/bidder/ 0
406 B 235ms
235ms XHR
application/json 13.248.136.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/cafemedia
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 13.248.136.210 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: af721359bfd441050.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
x-openrtb-version: 2.3
server: Kestrel
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 0

POST
H/1.1 200
OK / Show response
colossusssp.com/ 2 B
249 B 336ms
336ms XHR
application/json 8.2.111.123
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://colossusssp.com/?c=o&m=multi
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 8.2.111.123 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://leisurelylifestyle.com
Date: Mon, 12 Sep 2022 05:31:46 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 2
Content-Type: application/json

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 354 B
515 B 456ms
456ms XHR
application/json 52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: a9e7358b2cec5bc8f5dd1b0ceb8dd1171bfeec62c3bb8cf1187776c654d54b2f

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: gzip
x-prebid: pbs-java/1.97.0
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 276
expires: 0

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
253 B 253ms
253ms XHR
application/json 23.195.153.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.195.153.54 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-195-153-54.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Mon, 12 Sep 2022 05:31:46 GMT

GET
H3 200 cygnus Show response
htlb.casalemedia.com/ 38 B
517 B 572ms
571ms XHR
application/json 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=404603&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22593d49820c2900f9%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%3F%23PD%3Adesktop%23Source%3Adirect%23Browser%3AChrome%23Topic%3ATravel%23MCMP%3AAO_DATE%23MCMP%3ABA_WSKW20%23MCMP%3AAO_CHLD%23Sens%3Aalc%23Sens%3Aast%23Sens%3Acbd%23Sens%3Aconl%23Sens%3Acosm%23Sens%3Adat%23Sens%3Adlu%23Sens%3Adrg%23Sens%3Agamc%23Sens%3Agamv%23Sens%3Agrq%23Sens%3Apol%23Sens%3Arel%23Sens%3Asst%23Sens%3Assr%23Sens%3Asrh%23Sens%3Aske%23Sens%3Atob%23Sens%3Awtl%23vp%3A0%23MSFTA_2022%3ATrue%23TRGT_022020%3ATrue%23TYTA_22%3ATrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A10%2C%22msi%22%3A10%2C%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.27.0%22%2C%22userIds%22%3A%5B%5D%2C%22url%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22dms%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22594550e2a9de80a8%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22404603%22%2C%22sid%22%3A%229_1%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22404603%22%2C%22sid%22%3A%229_1%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22404603%22%2C%22sid%22%3A%229_2%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22404603%22%2C%22sid%22%3A%229_2%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22404603%22%2C%22sid%22%3A%229_3%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22404603%22%2C%22sid%22%3A%229_3%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22404603%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A336%2C%22h%22%3A280%2C%22ext%22%3A%7B%22siteID%22%3A%22404603%22%2C%22sid%22%3A%22336x280%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A100%2C%22ext%22%3A%7B%22siteID%22%3A%22404603%22%2C%22sid%22%3A%22320x100%22%7D%7D%2C%7B%22w%22%3A468%2C%22h%22%3A60%2C%22ext%22%3A%7B%22siteID%22%3A%22404603%22%2C%22sid%22%3A%22468x60%22%7D%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22404603%22%2C%22sid%22%3A%22250x250%22%7D%7D%2C%7B%22w%22%3A120%2C%22h%22%3A240%2C%22ext%22%3A%7B%22siteID%22%3A%22404603%22%2C%22sid%22%3A%22120x240%22%7D%7D%2C%7B%22w%22%3A1%2C%22h%22%3A1%2C%22ext%22%3A%7B%22siteID%22%3A%22404603%22%2C%22sid%22%3A%221x1%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A300%2C%22ext%22%3A%7B%22siteID%22%3A%22404603%22%2C%22sid%22%3A%22300x300%22%7D%7D%2C%7B%22w%22%3A552%2C%22h%22%3A334%2C%22ext%22%3A%7B%22siteID%22%3A%22404603%22%2C%22sid%22%3A%22552x334%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22404603%22%2C%22sid%22%3A%22728x250%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F18190176%2FAdThrive_Content_7%2F61d877f7514b73001b093e34%22%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_7%2F61d877f7514b73001b093e34%22%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%229780d82f-ccec-4f6d-80cb-0a7acbfeb4fb%22%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%5D%7D%5D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 781a6eb295f266b8cb20303ebfba5685577a1720cd72b2597169aed0dfa35606

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FQhdSzf8D%2BzZnTGxVeplx9KPJ1txIwbfvKe0%2FuZbBO1%2FByeV7l7ZISAH%2Fq1s202JYzNVmA8zd4LFKKVSZuM%2BA9zpwqFYyKshRwtkJTAZzJDEyVfBd7YFmL4C%2FFVQoRtSR4z%2BImvD"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7496423cfbf55ac4-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 38
expires: 0

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
319 B 333ms
332ms XHR
application/json 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.27.0&cb=33273345372

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
511 B 259ms
259ms XHR
application/json 52.220.232.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.27.0&referrer=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tmax=2800&us_privacy=1---

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.220.232.15 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
accept-ch: sec-ch-ua-platform,sec-ch-viewport-height,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua,sec-ch-ua-bitness,sec-ch-prefers-color-scheme,sec-ch-width,sec-ch-ect,user-agent,sec-ch-downlink,sec-ch-ua-mobile,sec-ch-save-data,sec-ch-device-memory,sec-ch-dpr,sec-ch-ua-full-version,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-viewport-width
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H/1.1 200
OK bid Show response
krk.kargo.com/api/v2/ 2 B
657 B 245ms
245ms XHR
application/json 52.77.87.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://krk.kargo.com/api/v2/bid?json=%7B%22sessionId%22%3A%2237119b77-34ef-49ba-9aef-270ab536c25b%22%2C%22requestCount%22%3A12%2C%22timeout%22%3A2800%2C%22currency%22%3A%22USD%22%2C%22cpmGranularity%22%3A1%2C%22timestamp%22%3A1662960706033%2C%22cpmRange%22%3A%7B%22floor%22%3A0%2C%22ceil%22%3A20%7D%2C%22bidIDs%22%3A%7B%226058104d69209cdc%22%3A%22_mfu14jCkaN%22%2C%226067b01881dde4f1%22%3A%22_vzS4k9rMKu%22%7D%2C%22bidSizes%22%3A%7B%226058104d69209cdc%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%226067b01881dde4f1%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%7D%2C%22prebidRawBidRequests%22%3A%5B%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_mfu14jCkaN%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content_7%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content_7%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_7%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22pos%22%3A1%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_7_desktop%22%2C%22transactionId%22%3A%225562576b-797e-46e7-afaa-97eaa8e559fc%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%226058104d69209cdc%22%2C%22bidderRequestId%22%3A%22604f4ea43d7fafe%22%2C%22auctionId%22%3A%22608c71d2-d9f9-4d91-9f0e-e10e738baed0%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%229780d82f-ccec-4f6d-80cb-0a7acbfeb4fb%22%7D%5D%7D%7D%2C%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_vzS4k9rMKu%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F18190176%2FAdThrive_Content_7%2F61d877f7514b73001b093e34%22%7D%2C%22pbadslot%22%3A%22%2F18190176%2FAdThrive_Content_7%2F61d877f7514b73001b093e34%22%7D%2C%22gpid%22%3A%22%2F18190176%2FAdThrive_Content_7%2F61d877f7514b73001b093e34%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22pos%22%3A1%7D%7D%2C%22adUnitCode%22%3A%22AdThrive_Content_7_desktop%22%2C%22transactionId%22%3A%225562576b-797e-46e7-afaa-97eaa8e559fc%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B300%2C250%5D%2C%5B320%2C50%5D%2C%5B336%2C280%5D%2C%5B300%2C50%5D%2C%5B320%2C100%5D%2C%5B468%2C60%5D%2C%5B250%2C250%5D%2C%5B120%2C240%5D%2C%5B1%2C1%5D%2C%5B300%2C300%5D%2C%5B552%2C334%5D%2C%5B728%2C250%5D%5D%2C%22bidId%22%3A%226067b01881dde4f1%22%2C%22bidderRequestId%22%3A%22604f4ea43d7fafe%22%2C%22auctionId%22%3A%22608c71d2-d9f9-4d91-9f0e-e10e738baed0%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22cafemedia.com%22%2C%22sid%22%3A%2261d877f7514b73001b093e34%22%2C%22hp%22%3A1%2C%22rid%22%3A%229780d82f-ccec-4f6d-80cb-0a7acbfeb4fb%22%7D%5D%7D%7D%5D%2C%22userIDs%22%3A%7B%22crbIDs%22%3A%7B%7D%2C%22usp%22%3A%221---%22%7D%2C%22pageURL%22%3A%22https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F%22%2C%22rawCRB%22%3Anull%2C%22rawCRBLocalStorage%22%3Anull%7D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.87.101 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-87-101.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:46 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 26
X-Accel-Expires: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
65 B 269ms
269ms XHR
text/plain 103.231.98.193
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.193 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://leisurelylifestyle.com
date: Mon, 12 Sep 2022 05:31:46 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 623 B
658 B 281ms
280ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881410&size_id=15&alt_size_ids=2%2C1%2C14%2C16%2C43%2C44%2C48%2C117%2C221&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!cafemedia.com,61d877f7514b73001b093e34,1,9780d82f-ccec-4f6d-80cb-0a7acbfeb4fb,,&eid_pubcid.org=d3020d20-0a91-4a3e-bc70-f9c4cb4bb728%5E1&rf=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&tg_i.mcmp=AO_DATE%2CBA_WSKW20%2CAO_CHLD&tg_i.site_code=MSFTA_2022%2CTRGT_022020%2CTYTA_22&tg_i.site_id=61d877f7514b73001b093e34&tg_i.sens=alc%2Cast%2Ccbd%2Cconl%2Ccosm%2Cdat%2Cdlu%2Cdrg%2Cgamc%2Cgamv%2Cgrq%2Cpol%2Crel%2Csst%2Cssr%2Csrh%2Cske%2Ctob%2Cwtl&tg_i.verticals=Travel&tg_i.pmp_elig=true&tg_i.refresh=false&tg_i.vp=0&tg_i.pbadslot=%2F18190176%2FAdThrive_Content_7%2F61d877f7514b73001b093e34&tk_flint=pbjs_lite_v6.27.0&x_source.tid=5562576b-797e-46e7-afaa-97eaa8e559fc&l_pb_bid_id=6103e2290dd13323&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F18190176%2FAdThrive_Content_7%2F61d877f7514b73001b093e34&slots=1&rand=0.6332655121348272
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 753d0f7ad0c304436e9eeb973ee3f317bd2e2c2c5cac1705a21c0d3acc323cc0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
server: nginx/1.21.4
vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-type: application/json
content-length: 623
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 384ms
384ms XHR
application/json 104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

a8882ccaf2164a6b7851280a0a073966590d69c847cd1024eda5b4046c711e15

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:46 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: cb40c4c9-0008-4a39-a678-712a22080850
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://leisurelylifestyle.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK cafemedia Show response
direct.adsrvr.org/bid/bidder/ 0
406 B 190ms
190ms XHR
application/json 13.248.136.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/cafemedia
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 13.248.136.210 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: af721359bfd441050.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:45 GMT
x-openrtb-version: 2.3
server: Kestrel
content-type: application/json
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 0

POST
H/1.1 200
OK / Show response
colossusssp.com/ 2 B
249 B 343ms
343ms XHR
application/json 8.2.111.123
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://colossusssp.com/?c=o&m=multi
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 8.2.111.123 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://leisurelylifestyle.com
Date: Mon, 12 Sep 2022 05:31:46 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 2
Content-Type: application/json

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 18 KB
10 KB 606ms
605ms XHR
text/plain 74.125.68.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3277682631422013&correlator=3368466267385825&eid=31068457%2C31068929%2C31069183%2C31069332%2C676982996&output=ldjh&gdfp_req=1&vrg=2022090601&ptt=17&impl=fifs&us_privacy=1---&tfcd=0&iu_parts=18190176%3A21726097356%2CAdThrive_Content_1%2C61d877f7514b73001b093e34&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C728x90%7C300x250%7C320x50%7C336x280%7C300x50%7C320x100%7C468x60%7C250x250%7C120x240%7C1x1%7C300x300%7C552x334%7C728x250&fluid=height&ifi=7&adks=3477178229&sfv=1-0-38&fsbs=1&fsapi=false&prev_scp=location%3DContent%26sequence%3D1%26id%3DAdThrive_Content_1_desktop%26ATF%3Dtrue%26lazy%3Dfalse%26refresh%3D00%26nref%3D0%26amznbid%3D2%26amznp%3D2%26flag_slot%3Dfv%253Af%26hb_format_appnexus%3Dbanner%26hb_size_appnexus%3D552x334%26hb_pb_appnexus%3D0.07%26hb_adid_appnexus%3D622495ac70070889%26hb_format%3Dbanner%26hb_size%3D552x334%26hb_pb%3D0.07%26hb_adid%3D622495ac70070889%26hb_bidder%3Dappnexus%26hb_bsid%3D11882&eri=5&cust_params=flag%3Dtarget%253Aes2018%252Cadsmnche%253A1510%252Cpmp_elig%253A1%252Cclson%253Atrue%252CclsBranch%253A484004f%252CclsBucket%253Aprod%252Cintegration%253Aplugin%252Clmdv%253A1.7.0%26siteId%3D61d877f7514b73001b093e34%26siteName%3DLeisurely%2520Lifestyle%26verticals%3DTravel%26abgroup%3Dwvtls%253Aoff%252Camzn_hold_load%253Aon%252Crfii%253Aoff%252Cflr%253Acm%252Clzflr%253Aoff%252Cebho%253Asharethrough_ebda%252Cloglevel%253Aoff%252Cidho%253Aoff%252Clzhb%253Aon%252Clzcvp%253A1.25%252Clzbpvp%253A0.75%252Ctripleliftdr%253Aboth%252Cmagnitedr%253Aboth%252Cpbs2s_appnexus%253Aoff%252Cpbs2s_grid%253Aon%252Cpbs2s_gumgum%253Aoff%252Cpbs2s_openx%253Aoff%252Cadt%253A0%252Cito_ds%253A2800%252C3pho%253Anone%252Cvebho%253Aoff%252Ccbt%253A2s%252Cvast_to%253A10s%252Cproto%253Anv1%252Cpbm%253Aon%252CreqTo%253A15%252Cvadv%253Aon%252Csmhd100%253Aoff%252Csmad300%253Aon%252Cs2sbuff%253A300%252Crmos1%253Aoff%252Csocon%253A1%252Csab%253Aon%252Cdco%253Arelaxed%252Cmxrpog%253A5%252Cdajto%253Aoff%252Cjwb%253Aon%252Cvpred%253Aon%252Ccrtvmon%253Aoff%252Cpba%253Anone%252Camzn_hold_disp%253Aoff%252Cbmetrics%253Aon%252Cconfiant%253Aprod%252Ccnfep%253Aon%252Crefflr2%253A1.2%252Csocbe%253Asovpct2%252Clogcls%253Aoff%252Ctpcapi%253Aon%252Csidp%253Aoff%252Crebuildslot%253Aon%252Cupl%253Aoff%252Csekho%253Aoff%252Csospp%253Aon%252Crmosnv1%253Aoff%26bucket%3Dflex-30%26sens%3Dalc%252Cast%252Ccbd%252Cconl%252Ccosm%252Cdat%252Cdlu%252Cdrg%252Cgamc%252Cgamv%252Cgrq%252Cpol%252Crel%252Csst%252Cssr%252Csrh%252Cske%252Ctob%252Cwtl%26domain%3Dleisurelylifestyle.com%26plugin%3Dadthrive-ads-2.3.1%26hi_au%3Dod%252Com%26vpwxvph%3D1600x1200%26ri%3D48%26pvk%3D01GCR2X4B7FJF6KKGKM2Y5KPHN%26sess%3D01GCR2X4B72666RTK6J7CQK4KF%26branch%3Df56a6a1%26deployment%3D2022-09-06-5%253Aade-249%253Apr2618%253Af56a6a1%26hbho%3Dnativo%252Csharethrough%26vbho%3Dnone%26gptv%3D2022090601%26connection%3Dniet%253A4g%252Cdl%253A9.3%26fpv%3D1%26mcmp%3DAO_DATE%252CBA_WSKW20%252CAO_CHLD%26site_code%3DMSFTA_2022%252CTRGT_022020%252CTYTA_22%26marmalade%3Dtrue&sc=1&cookie=ID%3Dd16bda535cf163b8-224325f95fd600d0%3AT%3D1662960705%3AS%3DALNI_MaOEnxtfZV6bX8JAgKzfs6asYwvGQ&gpic=UID%3D000009bb39ba46eb%3AT%3D1662960705%3ART%3D1662960705%3AS%3DALNI_MYNUcWnHf_vgJ_vRZY69QAZUSO-qg&abxe=1&dt=1662960706056&dlt=1662960699576&idt=3135&adxs=601&adys=3562&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=4&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&frm=20&vis=1&psz=762x9386&msz=762x250&fws=4&ohw=1600&ga_vid=1266557791.1662960702&ga_sid=1662960705&ga_hid=335300354&ga_fc=true&cbidsp=Co0FCAESEQoIdHJpcGxfc3MQ-QMgAjgCEg0KBGdyaWQQ-QMgAjgCEhMKCmJyaWdodHJvbGwQ-QMgAjgCEhAKB3B1Ym1fc3MQ-QMgAjgCEhAKB3J1Ymlfc3MQ-QMgAjgCEhAKB3lpZWxkbW8Q-QMgAjgCEhEKCDMzYWNyb3NzEPkDIAI4AhIPCgZ1bnJ1bHkQ-QMgAjgCEg8KBmNvbF9zcxD5AyACOAISDAoFdGVhZHMQjgIgAhIJCgJpeBDSAyACEgkKAml4ENIDIAISCQoCaXgQ0gMgAhIJCgJpeBDSAyACEgkKAml4ENIDIAISDQoGY3JpdGVvEPADIAISEQoKdHJpcGxlbGlmdBCMAiACEgwKBWthcmdvENQCIAISDAoFa2FyZ28Q1AIgAhIOCgd2ZXJpem9uEIgCIAISDgoHdmVyaXpvbhCIAiACEg8KCHB1Ym1hdGljEMoBIAISDgoHcnViaWNvbhDEAiACEg8KCHlhaG9vc3NwELMDIAISDwoIeWFob29zc3AQswMgAhKyAQoIYXBwbmV4dXMQswMaoAEKEDYyMjQ5NWFjNzAwNzA4ODkQ1bIEQOO3BBoDVVNEIgloYl9iaWRkZXIiB2hiX2FkaWQiBWhiX3BiIgdoYl9zaXplIgloYl9mb3JtYXQiEGhiX2FkaWRfYXBwbmV4dXMiDmhiX3BiX2FwcG5leHVzIhBoYl9zaXplX2FwcG5leHVzIhJoYl9mb3JtYXRfYXBwbmV4dXMoAToGCKgEEM4CIAESCgoDdHRkELwCIAISDwoIY29sb3NzdXMQ0wIgAhgCIiRlMGE0OWQ3Yi1lNDQ3LTQ3MmUtYmVhOC02MDNlMWU3NjY3ODEqAggDSgBAxBM.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

827abf58519d9f0deac6bf28c13af45c570664ede51a1dfca3a506d16d5b21b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10018
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 18 KB
10 KB 657ms
656ms XHR
text/plain 74.125.68.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3277682631422013&correlator=1685630757214606&eid=31068457%2C31068929%2C31069183%2C31069332%2C676982996&output=ldjh&gdfp_req=1&vrg=2022090601&ptt=17&impl=fifs&us_privacy=1---&tfcd=0&iu_parts=18190176%3A21726097356%2CAdThrive_Content_3%2C61d877f7514b73001b093e34&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C728x90%7C300x250%7C320x50%7C336x280%7C300x50%7C320x100%7C468x60%7C250x250%7C120x240%7C1x1%7C300x300%7C552x334%7C728x250&fluid=height&ifi=8&adks=3720558085&sfv=1-0-38&fsbs=1&fsapi=false&prev_scp=location%3DContent%26sequence%3D3%26id%3DAdThrive_Content_3_desktop%26lazy%3Dfalse%26refresh%3D00%26nref%3D0%26amznbid%3D2%26amznp%3D2%26flag_slot%3Dfv%253Af%26hb_format_grid%3Dbanner%26hb_size_grid%3D728x90%26hb_pb_grid%3D0.01%26hb_adid_grid%3D62347151f604da33%26hb_adomain%3Dmarriott.com%26hb_format%3Dbanner%26hb_size%3D728x90%26hb_pb%3D0.01%26hb_adid%3D62347151f604da33%26hb_bidder%3Dgrid&eri=5&cust_params=flag%3Dtarget%253Aes2018%252Cadsmnche%253A1510%252Cpmp_elig%253A1%252Cclson%253Atrue%252CclsBranch%253A484004f%252CclsBucket%253Aprod%252Cintegration%253Aplugin%252Clmdv%253A1.7.0%26siteId%3D61d877f7514b73001b093e34%26siteName%3DLeisurely%2520Lifestyle%26verticals%3DTravel%26abgroup%3Dwvtls%253Aoff%252Camzn_hold_load%253Aon%252Crfii%253Aoff%252Cflr%253Acm%252Clzflr%253Aoff%252Cebho%253Asharethrough_ebda%252Cloglevel%253Aoff%252Cidho%253Aoff%252Clzhb%253Aon%252Clzcvp%253A1.25%252Clzbpvp%253A0.75%252Ctripleliftdr%253Aboth%252Cmagnitedr%253Aboth%252Cpbs2s_appnexus%253Aoff%252Cpbs2s_grid%253Aon%252Cpbs2s_gumgum%253Aoff%252Cpbs2s_openx%253Aoff%252Cadt%253A0%252Cito_ds%253A2800%252C3pho%253Anone%252Cvebho%253Aoff%252Ccbt%253A2s%252Cvast_to%253A10s%252Cproto%253Anv1%252Cpbm%253Aon%252CreqTo%253A15%252Cvadv%253Aon%252Csmhd100%253Aoff%252Csmad300%253Aon%252Cs2sbuff%253A300%252Crmos1%253Aoff%252Csocon%253A1%252Csab%253Aon%252Cdco%253Arelaxed%252Cmxrpog%253A5%252Cdajto%253Aoff%252Cjwb%253Aon%252Cvpred%253Aon%252Ccrtvmon%253Aoff%252Cpba%253Anone%252Camzn_hold_disp%253Aoff%252Cbmetrics%253Aon%252Cconfiant%253Aprod%252Ccnfep%253Aon%252Crefflr2%253A1.2%252Csocbe%253Asovpct2%252Clogcls%253Aoff%252Ctpcapi%253Aon%252Csidp%253Aoff%252Crebuildslot%253Aon%252Cupl%253Aoff%252Csekho%253Aoff%252Csospp%253Aon%252Crmosnv1%253Aoff%26bucket%3Dflex-30%26sens%3Dalc%252Cast%252Ccbd%252Cconl%252Ccosm%252Cdat%252Cdlu%252Cdrg%252Cgamc%252Cgamv%252Cgrq%252Cpol%252Crel%252Csst%252Cssr%252Csrh%252Cske%252Ctob%252Cwtl%26domain%3Dleisurelylifestyle.com%26plugin%3Dadthrive-ads-2.3.1%26hi_au%3Dod%252Com%26vpwxvph%3D1600x1200%26ri%3D48%26pvk%3D01GCR2X4B7FJF6KKGKM2Y5KPHN%26sess%3D01GCR2X4B72666RTK6J7CQK4KF%26branch%3Df56a6a1%26deployment%3D2022-09-06-5%253Aade-249%253Apr2618%253Af56a6a1%26hbho%3Dnativo%252Csharethrough%26vbho%3Dnone%26gptv%3D2022090601%26connection%3Dniet%253A4g%252Cdl%253A9.3%26fpv%3D1%26mcmp%3DAO_DATE%252CBA_WSKW20%252CAO_CHLD%26site_code%3DMSFTA_2022%252CTRGT_022020%252CTYTA_22%26marmalade%3Dtrue&sc=1&cookie=ID%3Dd16bda535cf163b8-224325f95fd600d0%3AT%3D1662960705%3AS%3DALNI_MaOEnxtfZV6bX8JAgKzfs6asYwvGQ&gpic=UID%3D000009bb39ba46eb%3AT%3D1662960705%3ART%3D1662960705%3AS%3DALNI_MYNUcWnHf_vgJ_vRZY69QAZUSO-qg&abxe=1&dt=1662960706091&dlt=1662960699576&idt=3135&adxs=601&adys=4752&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=5&ucis=8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&frm=20&vis=1&psz=762x9386&msz=762x250&fws=4&ohw=1600&ga_vid=1266557791.1662960702&ga_sid=1662960705&ga_hid=335300354&ga_fc=true&cbidsp=CtcECAESEQoIdHJpcGxfc3MQ4wMgAjgCEqYBCgRncmlkEOMDGpYBChA2MjM0NzE1MWY2MDRkYTMzEPN8GgNVU0QiBWhiX3BiIgdoYl9zaXplIgloYl9iaWRkZXIiB2hiX2FkaWQiCWhiX2Zvcm1hdCIKaGJfYWRvbWFpbiIKaGJfcGJfZ3JpZCIMaGJfc2l6ZV9ncmlkIgxoYl9hZGlkX2dyaWQiDmhiX2Zvcm1hdF9ncmlkKAE6BQjYBRBaIAE4AhITCgpicmlnaHRyb2xsEOMDIAI4AhIQCgdwdWJtX3NzEOMDIAI4AhIQCgdydWJpX3NzEOMDIAI4AhIQCgd5aWVsZG1vEOMDIAI4AhIRCggzM2Fjcm9zcxDjAyACOAISDwoGdW5ydWx5EOMDIAI4AhIPCgZjb2xfc3MQ4wMgAjgCEgwKBXRlYWRzEJkCIAISCQoCaXgQmAMgAhIJCgJpeBCYAyACEgkKAml4EJgDIAISCQoCaXgQmAMgAhINCgZjcml0ZW8QzAIgAhIRCgp0cmlwbGVsaWZ0EJMCIAISDAoFa2FyZ28Q2gIgAhIMCgVrYXJnbxDaAiACEg4KB3Zlcml6b24Q-gEgAhIPCghwdWJtYXRpYxD1ASACEg4KB3J1Ymljb24QzAMgAhIPCgh5YWhvb3NzcBCFBCACEg8KCGFwcG5leHVzEP8CIAISCgoDdHRkELECIAISDwoIY29sb3NzdXMQ1AIgAhgCIiQ4ZjEwNDE4Yy01OGQ5LTQ3NjUtOGYxZS0xZjgyNTYwZTE5NTAqAggDSgBAxBM.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1dc49303e2d5e7eac2e74fac4fd8dfd0cf0dadee53f8456c5bc1c59f6753d309

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10108
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.com.au/adsid/ 107 B
122 B 178ms
176ms Script
application/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com.au/adsid/integrator.js?domain=leisurelylifestyle.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 184ms
183ms Script
application/javascript 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=leisurelylifestyle.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 18 KB
10 KB 562ms
560ms XHR
text/plain 74.125.68.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3277682631422013&correlator=524731701999243&eid=31068457%2C31068929%2C31069183%2C31069332%2C676982996&output=ldjh&gdfp_req=1&vrg=2022090601&ptt=17&impl=fifs&us_privacy=1---&tfcd=0&iu_parts=18190176%3A21726097356%2CAdThrive_Content_8%2C61d877f7514b73001b093e34&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C728x90%7C300x250%7C320x50%7C336x280%7C300x50%7C320x100%7C468x60%7C250x250%7C120x240%7C1x1%7C300x300%7C552x334%7C728x250&fluid=height&ifi=9&adks=3461627224&sfv=1-0-38&fsbs=1&fsapi=false&prev_scp=location%3DContent%26sequence%3D8%26id%3DAdThrive_Content_8_desktop%26lazy%3Dtrue%26refresh%3D00%26nref%3D0%26amznbid%3D2%26amznp%3D2%26flag_slot%3Dfv%253Af&eri=5&cust_params=flag%3Dtarget%253Aes2018%252Cadsmnche%253A1510%252Cpmp_elig%253A1%252Cclson%253Atrue%252CclsBranch%253A484004f%252CclsBucket%253Aprod%252Cintegration%253Aplugin%252Clmdv%253A1.7.0%26siteId%3D61d877f7514b73001b093e34%26siteName%3DLeisurely%2520Lifestyle%26verticals%3DTravel%26abgroup%3Dwvtls%253Aoff%252Camzn_hold_load%253Aon%252Crfii%253Aoff%252Cflr%253Acm%252Clzflr%253Aoff%252Cebho%253Asharethrough_ebda%252Cloglevel%253Aoff%252Cidho%253Aoff%252Clzhb%253Aon%252Clzcvp%253A1.25%252Clzbpvp%253A0.75%252Ctripleliftdr%253Aboth%252Cmagnitedr%253Aboth%252Cpbs2s_appnexus%253Aoff%252Cpbs2s_grid%253Aon%252Cpbs2s_gumgum%253Aoff%252Cpbs2s_openx%253Aoff%252Cadt%253A0%252Cito_ds%253A2800%252C3pho%253Anone%252Cvebho%253Aoff%252Ccbt%253A2s%252Cvast_to%253A10s%252Cproto%253Anv1%252Cpbm%253Aon%252CreqTo%253A15%252Cvadv%253Aon%252Csmhd100%253Aoff%252Csmad300%253Aon%252Cs2sbuff%253A300%252Crmos1%253Aoff%252Csocon%253A1%252Csab%253Aon%252Cdco%253Arelaxed%252Cmxrpog%253A5%252Cdajto%253Aoff%252Cjwb%253Aon%252Cvpred%253Aon%252Ccrtvmon%253Aoff%252Cpba%253Anone%252Camzn_hold_disp%253Aoff%252Cbmetrics%253Aon%252Cconfiant%253Aprod%252Ccnfep%253Aon%252Crefflr2%253A1.2%252Csocbe%253Asovpct2%252Clogcls%253Aoff%252Ctpcapi%253Aon%252Csidp%253Aoff%252Crebuildslot%253Aon%252Cupl%253Aoff%252Csekho%253Aoff%252Csospp%253Aon%252Crmosnv1%253Aoff%26bucket%3Dflex-30%26sens%3Dalc%252Cast%252Ccbd%252Cconl%252Ccosm%252Cdat%252Cdlu%252Cdrg%252Cgamc%252Cgamv%252Cgrq%252Cpol%252Crel%252Csst%252Cssr%252Csrh%252Cske%252Ctob%252Cwtl%26domain%3Dleisurelylifestyle.com%26plugin%3Dadthrive-ads-2.3.1%26hi_au%3Dod%252Com%26vpwxvph%3D1600x1200%26ri%3D48%26pvk%3D01GCR2X4B7FJF6KKGKM2Y5KPHN%26sess%3D01GCR2X4B72666RTK6J7CQK4KF%26branch%3Df56a6a1%26deployment%3D2022-09-06-5%253Aade-249%253Apr2618%253Af56a6a1%26hbho%3Dnativo%252Csharethrough%26vbho%3Dnone%26gptv%3D2022090601%26connection%3Dniet%253A4g%252Cdl%253A9.3%26fpv%3D1%26mcmp%3DAO_DATE%252CBA_WSKW20%252CAO_CHLD%26site_code%3DMSFTA_2022%252CTRGT_022020%252CTYTA_22%26marmalade%3Dtrue&sc=1&cookie=ID%3Dd16bda535cf163b8-224325f95fd600d0%3AT%3D1662960705%3AS%3DALNI_MaOEnxtfZV6bX8JAgKzfs6asYwvGQ&gpic=UID%3D000009bb39ba46eb%3AT%3D1662960705%3ART%3D1662960705%3AS%3DALNI_MYNUcWnHf_vgJ_vRZY69QAZUSO-qg&abxe=1&dt=1662960706314&dlt=1662960699576&idt=3135&adxs=601&adys=8169&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=6&ucis=9&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&frm=20&vis=1&psz=762x9386&msz=762x250&fws=4&ohw=1600&ga_vid=1266557791.1662960702&ga_sid=1662960705&ga_hid=335300354&ga_fc=true&cbidsp=CrIDCAESEQoIdHJpcGxfc3MQnwQgAjgCEg0KBGdyaWQQnwQgAjgCEhMKCmJyaWdodHJvbGwQnwQgAjgCEhAKB3B1Ym1fc3MQnwQgAjgCEhAKB3J1Ymlfc3MQnwQgAjgCEhAKB3lpZWxkbW8QnwQgAjgCEhEKCDMzYWNyb3NzEJ8EIAI4AhIPCgZ1bnJ1bHkQnwQgAjgCEg8KBmNvbF9zcxCfBCACOAISDAoFdGVhZHMQjgIgAhIJCgJpeBCQBSACEgkKAml4EJAFIAISCQoCaXgQkAUgAhIJCgJpeBCQBSACEgkKAml4EJAFIAISCQoCaXgQkAUgAhINCgZjcml0ZW8Q4wIgAhIRCgp0cmlwbGVsaWZ0EIYCIAISDAoFa2FyZ28QgwIgAhIMCgVrYXJnbxCDAiACEg8KCHB1Ym1hdGljEMQCIAISDgoHcnViaWNvbhCWAiACEg8KCGFwcG5leHVzENcCIAISCgoDdHRkEMMBIAISDwoIY29sb3NzdXMQpgMgAhgCIiRiMjJkMzVkMy1iNWU1LTQ4NjQtOGQzMC03NzdmYzViNTE5ZjQqAggDSgBAxBM.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

579712baec83a99ced9c93d07e76290076b5dd3843032589041d574f8a04e9e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9929
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6C0A 624 B
559 B 693ms
185ms Document
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-f5AEQn5zmARiNqoXPATAB&v=APEucNUBRULNjaxnuFFc9qREyO1ju40jpstB0Ize3LRJtkjz03w3ARByV1IZykg0H7r-ibyy4-ZbT5mhPNYJBltmhLtDORD21g

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 05:31:46 GMT
expires: Mon, 12 Sep 2022 05:31:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 0DD0 93 KB
36 KB 729ms
224ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C1n30PS_VhlLlvX77NiXbU6lWdzzZwiujZZAov0t3s4Pkii3eq6PsZBK9fUneBxjtkR1p_ZWj5Rvyn-t1d7xi3ApZgkdtJGl0hPzHT5Fn91iII8E12CSCqIwKPv1jphYjOeY7NYf7LXHE4WvaaQrQQsjY9KQ&dbm_d=AKAmf-CJK1947dhMb6IBCHZSJ3t58TIZuawGgiXpKi2585tsMkJVQw_iSRBqPANDuZkS5_SpLlGpz8K7ttHwUNiIRJA4cUW09N6Zyqy6TsmwCYWDvaIGnY8HYAN-4l8WOMd-1x_NmnLJs7GTNRS_whhMHW4iDCuf9oUh7fAdZSx_iwwRZgKfABuvjayeBqqbrfLCRHJtMQjV975DQvOpyHhhrlf9jhTnFc1VFv4-73ZkJDZgp8jrpac4sk8fTa_gpGiLUIOECOhRvJLmoqj0yqcQ9xUOZcpeQT_vGpeRxnwt0-A6dcySdqcpubSc22LdcgY3Nm8h8C0YMJahv2JyM5VBHETi_lzrO0yhI_3v7FcPj6gnEjzW2lYwcEZVOr3fXP-C-3Pc9NTPSgLikyIK4WNsmpM5kGylmB--xGkIu9n1JfS4om9mkBjjJaLfLSvJw0-TK61G_dhqHLaBH1e6oDfH-tltFE9kNf92hPPMxioAxCMNwhbgtYy3UFO_ATQgngrNYukdjzf920pCjmC1UwZi-9XqVBEYlY6p6V_MmTf0zt6wPWgtp-qAhaHR186CwvMi4LSuDLKzg8D4ajR6iHNQ7tnPfgCN9rb4UsAmgu8BW97ibSVPgVy1nr-Pzq5ElXI05qvgxdm3Y7hGskIy8TrWBcluIJF_OsJDvFoz-C7O5qMpg8IuzLlEM445dhWQVqknjKUNZWr24rqBzQLxgL3l3a2Rr4WS18kfRdj-VVox5l5Sk7lSSc3Fn2CviVhISBumMVcXA1D5QBIpbkWJg1-eaWfLnZK5jD0r8gYB1eQ_XDpK4iq2m4kzZMaiOFPgqd3pPLttNnfsIaV5OuaaEiLsvphSI3QdWfwfev_Tyet-bqjoLfrOEaThlulWfMV0-wAuJxBoKHTMygjhu6U4GUA5mUPIpi55oMiNk_9RV2mnq3xZtvYl1zWl8CQ_xJVSbh-jZSnBqSf8_DWDTr0oOlN50W7Wzzk1K9WKW9UwhcSsr7E0M-dzVUvDIVZvJbm5rAV8vtPWXIpS0gVnegU1FcmQ7RZvjHQCx6EXqwKY82UkDQNBnF_H1Q3cm1JKU42JIbXzY5JYZXXHtFqPZ9L95ccYAd8VKbTsOuedgfN9hgjPOwfadWIbDliFgokcz0zIpK-ZUaPfDoGbPAaaBTgweOR-kF28wBlaOdI95_Q6IypVWDrLVIba9OQuV7enPqBOgVPl6mZ1eBwtTpd2XhVQLxWMo9s_6oo3hQJKCSGAsmly47fZv50dtU9JAdXGU0_RE_U1t163rXEkfrWdN_T5DNueG9q39CxRp1Bd3cegAFFYvrX_cpTU4XlmkShXSzZS_-hTpHw8CA0UleT0jdd7_-clr6w-qkh5vl-mlrEEq4nQj05f-z6cY5WaCWLti_B8wQSL8Z2ed84Uo_Vcc3D1NRbnyKAZ_DqxW9HExlpYgLMOryIZ-hIbsepBPZX_VGE7sAZGOuxNOjInl3K772ddr7GDZKeAF2C6QB7Mo9vG2sTAB70AfcNRkj7qJcAsjpH3wurYL7YtWWPZAFkJWlpgh95Fzy8sCMtm5IY8VvihA-MkuvNlIECRmQwSy9JJxisZ4r0Q0S44P3JXgTWyT_yvZrpyg2TEYOXdN3usxTDEP079Ss2n0_CrkPl1oK40i5hi3Yw6oHVSs4BCnprH3x9DzaKX2wdyVUgAxqmKxyS7j2s3jALTbD26iejIZGs-MTvbvwf7k-6-OqooTgmbC1QdkaL0BuSqMFf8PwAzbTwOOzKcWm9rdBtPn134gisdddxaqgZeNbZsQJMEMGAC1mqQiruEZBGlIemNEwh8d99K8_Ax2JiTllbmSDAYNs2F1P72K4PQWUszARLQ3U-XdxL31ZnXS37zQpqkEnk6xm3p1S7kMTNhl_Xk3oq0No7iNG_7DHCwSInxEMLssAXHqn-YjCqTCOP6JkPEphMRxWRc9Xhzhm2HVlZVkeCK1rY1ILQkZ-1tjTF_dMvXroL8PN3iiaKAOU2Fsvdqw-BszIpG2ec2QhiiI1rpeE1OK0Al1cChQUze6KCdRz6O4zjyx614rgOBuTCLc1_wTIC4WryUUCpmi6ozj7lDF7JhNbJQVLDN6vuCTvkCFFhvjKzjzYknr-ordHfeR6ELEwpFhn_zqDf60ALaQHxHHfcmla1lI7Cw0Ua0EX3QDuUbn0Ds0pUzDT1DIWRTuXp5x_NC4qICYCOlIqScKh9IqvdqiNwzkPdkNKvV3Acy-U3QpyxXa44GaVqhLQzSPgP4DNEQgX9zoRGsqYoSUsKR57WLB5idyqyr35yVw8VoCoqIt-Ty6PCYsthrZE8VpXkFH2PjKiHaoxW-YVZT8GYoGMH2IqrOhS5UoqfR6A6kelpzdv3n3tGGhRzVbOW779bQ3zNWsVwhSfLjAy1JvMla4Q4wcVfyZT2yCZ996p7SL2r9kn1vZh5qaKa1rWnOZbtkW29xttvCWdAANND1UkDjYd6x1wshlXXQeKkifnSCVakyj3to___P0B6NuHxDC2hGlZ4TRnBy9lMv0b3zktUNnFPVmGinTegg7e7TzQ9Vka5pilAorBA4-vdOr-e9mJJuge_oBJ1K-LHqXyHuwNvw9w7gF-Yg3a7xAEYIZd-Hw-JSG1HK-1osiw3Giw3rC6if2Hob0M5TVkBAMDp7Tvk3VGakQAbnySt6CmnO-Yd5fZJkCDcWYDkzPHPnfonHfy7eB-WucV1obkiPYpC1Go1kCZZtj5C2MRKoofJpApQZ8JuSY9XkhCtJuKLdA42-hIase43VYqMNZ1_5ww4rJcsESs1z6QCFPd7bwTq18I3EjRBes9Hsf-_pW5QIF-AKShtON9Q39iOy_mdJxgIVuN-cPI7qqDt3DN1qxG6YgGdVaRC-WyPZXTldB0GqUedil2b_1bVFguMmj2Gv-4cv9AWVWWmHlkaRXPVRLTV2gdDuc87IAEwP-TWcaRzTNc3JrwfPw22_yZWzDo1ACqPG_ZZDrCA22r4OnN3q-XWxUqdY-fMoCwcs-qJisZY_xslVB5Pi_gNMXMw0urvbMvTg3kFqjFFIw1I_4hoQV_vsvN1Sn87DU_umiAUKE0NlJs1e2jbU2U5Z44m_rIinWMKlSrXkWP3WeIhrc-c1tJThC1IE9O71PJdJJen8vqj3q20Z26VG5iBKK_B5NqC6_hRtAhWl7mkwOdWDmjbQFVp9NElZAtYtAZOyepDN0r_t3GbhQKJn8ADmif0Lvq_pCY6hJRe6oU4iUUhomfGGbNHR_PS6Cmm-SR90OFxGjgHb33uLoAXzXA&cid=CAASKORofbN-v9adE1uRlH8fkPg4FPLOTqppqmN5SPwEnytRDgu4h_A4qw4&rfl=1%2Chttps%253A%252F%252Fleisurelylifestyle.com%252F%240

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eef91ce302215365aa2eea2510116748cc4eed7357786ccdd2f7f9ad42e373c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36682
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0DD0 42 B
107 B 683ms
183ms Image
image/gif 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B5tA8khlAxNjxudD4Ir4toaC88PfCHb1aCmmxfhiBo84SMKJnigUYYQNYWKOtxGYsOiXVFiPIcjGz41HW3wl7ukPo8O1uSR6EB2cyov_vsqHG6Tn4

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 0DD0 3 KB
1 KB 196ms
194ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:35:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3399
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:35:07 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 0DD0 17 KB
8 KB 174ms
172ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:35:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3399
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:35:07 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 0DD0 0
0 719ms
221ms Image
text/html 142.251.10.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQFaOPwCuR_GnckyE4euxNv8RFa52Dvk0l3G3kO6tE0HmAsgH5DcHLca8_4Zmx3uoEeQRQoq0eqN6sJvb5WEqDh9lTWow
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.10.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f147.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0DD0 141 KB
44 KB 679ms
181ms Script
text/javascript 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 05:31:46 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame ED89 624 B
975 B 623ms
185ms Document
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLvOowEQhI2rARiysIjRATAB&v=APEucNWY95ihW-lqootuqEqiyJK6T6o1ms8vOI2CvVsTHZNeAuG4Ybo9pczNj40cZgOW7JsH6QACn1m-JSBUnemdavHJ2dPx9Q

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 05:31:46 GMT
expires: Mon, 12 Sep 2022 05:31:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 04A2 15 KB
11 KB 880ms
441ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BQ1wDSFqCqfyml1uiP4DELfLCsLPqdLtVdC-M3ZVmXr4-Pm95B2HfBJPaby2OiNKfi3pB-l-4o0gPOtHHtQb6ZwWOalZh5UTWanNULSdQYkRW1ZfUVIY7xCLHZeowsYBBfkaoZdnDVSSGA0S_TW1pIhLe0Rw&cry=1&dbm_d=AKAmf-BxNt7pnsaxkgW0eT4r3I-7-jX14MKgDZYOcZMC_jdn5VjscIF471Rwsz9bUsO50W8UUfvWunpiQEuLkDuyGcI6FHauXMjpMz8eeWOkoTB4fHNGdzgz6ptcnG3ci_gtKHWAhmlJWBbQw6hNCANwtC2lnlzVTt6t5n0VQPh_LM6DAX2cbYssaHnG8gxzR8Y-SN0aRSBqsy9SdHj2ecxJv3HxLnIMcVQwRzlyJ55xw6m1rdl0qOVcwcLoltfVDlPDKCOQDsR1RGJ9XzZtFV8LiZ84fHeTvJOhcCO1y1fd4pWC3aTTX6Y6ZudLtMSjvpN8qmjX9Fc-A7ePeQkAFiM8mnpT9IWLDjAscHr8C1e4_S0RJ0S_X30IbvQcFheBK4ixdKHHOKIYzaRiJ_rslAD0gd28fBMloFHLmw2m8No3fUDdfgwC5iyfO4Jgqo7UKGfYNo0s2ikATP2T4Ma14nUZ_6GzlpH8J5kDxfs2K64jZfiYMX4_lWGoJmwaesAl259smUEvWmBw4GzdgqeBCiIQPm1qqtqMh-dRhi7P8MhpTL-lX2QlizolPMGhHgoblmVXirUW5wp32PA1plRHrQ-BMsps0DOap17okXpv16fy9jwqwNtlJ4a95Cq-XaWj20aiKAihHL0UlOgXLUjSYdh28xLufF3mntmxlJkb1d1rsKCABT_3wFqSbzPx6iI0boO_j1I9rwbvrqAuoTYZUm06dvY7H-j3HjykGTPnZtP7sjF8ppAoyR8iZ2yW6i2we60nmEijwELRqE8m2XRJa83pFcxHwAZUs8EBZA84n0ps-Dix6q1bC-DE7zzPDLZLC6lMbmByH-b50kOqz6oBgN3DIPmm7X36-Eb_SCt3qQ7Go3WHEWlc1P8IrmR9CVZXtwnRaIv3vmsN1kLJ9njdOBrXyP9Q2vAIx61dc7Vj9sQ7WGV7xVFZbCxPrqPCopLRAEpSWk8_j7uOKUVMvJbMEDSisw5ARlVIo_IGreGbtDdZbAk2Tnze7TC6AbDje1mopABcsaTGTPvPcxNG0JBecSkCtR9HH8VqKu6_YvGcXAtwXvDw7zXK4LHOJNka8pr_MmgwzRci39ONQ1fk-NAxttNz-Wn7GhPboowCBcG_Z-McSOrWEK-3RMspT6R37-fFDMQpAW0Bi2OSWxW2JXVR2a4HB4nrUC5ihbuf2opWZ_mfmVfblzdQMwiCpG6CLiDMc_3o4WtNnlo1DgITjOV9rif1XpNsAyUFlVMoHxr2VA_byrdu0aVl70Zk7pJFTKcaBsvjXFNzb8xjSENx1ZOq8muk3RjUMXoVA4IOVXYilnJj-iKqkrAOUMgXwV7AQzprWiiFdJa6q-TBdkDSLmr9Gvt4bsJdt24p5A8osg3s_sy3DKEz_ojmfz5JJ-p_BF6SQA1cN85BNqxUkiOkzHk35a3KLTUckksB2QktWSbyb1G5bRtaPP5W0BxvLPiqcLp5mlZZgusjlwMrv9L3PEZ1Nmf1k0ncW-nHwJxPzTKhY_d44zo2U2V4ibrXRRShhvqvQ2MwD7ZttOqPFmE1NAqZmJYoAp0od1WkDCbY-uLdYQRmxONpkkAFsGQwqBCFFJNfJ_8pWBLac2Xst-F7oCmKemwr9x4o7oM_UrTT_BIDhnjXdeE6MYbWtWjl24NIKDB92B4pz1ASz-yvfqcIAIjfh4gOt_KQ4IcJdkWZhyoN7lCj7c7khIup9LbDBP0qnkyGCubeOtflH-pPzekTBGU2nqEyFrO6mZf53ZuGnc2IrqIGQ-PWJeUmGRHIvFt-S3ifvCWl6p0kaMamgs-bAwsNq_2-FE3DvkAB_o8AjAebRxK3hh-kZJ9dVmSANwSLIhJWtnJBaGAbWnC3dNkREwH3Ypa2VjXvLU8eI0AICeO2fw6JDJSikJzwUjKAzbdtEuITRjhyo23ujKVVvhqkLY041yeyJ3uSe5j1FdVGfKpcgcEAZjXaW4wlK1zVBJ7pAee4Y37J1DwiqFopq0y2gNmddj1Ica18P2g0e5feuaTHG-EdE-UpNZSnb6g3RZgaZXQpeYSADqIf2FeyuEVQq0k0BGWqTN9_g7s8ngauOTten9oe6MCGuuP228OmYX48_s9hvD8QgJv8luaOw2vZD43lTLut91OKZd4LII4ItBPXxzGeJI6sLFh7p8EnwMWpS7hFZKiv2tbtn84oImRpLIiWBs6L8YO-kTJlflVaJBA0ScJ7LwKCKAhxba2KX9xbsTQl4uWRxLMZhFDCZ-7KbpC5EG4FPNYAg0xp1uGVO7zOSeET7MDZJaCuhn4IDdgWn1ZG_5aQvaOVkAJR6ReZNhgJ6k3DljYyFkq7eTXw-n3nuBSPBwVGernE7mIT0E_hKk7fw226i5cUeVsd8SwjCnl9qtZYnpuJzaXlvcQPmVK6-Cs_Flep2EHM1ure_6dV3SEi8_Xcb_BhQr6PuLNSTD2juDekI4g_H9-kraYydR_Sx8xFu_a4tn5prvDzFCXidLm1VEFLFzbM9odtMz15C8yAAjEa5ivGjr_fD6GuWu_KSHCFEpuvCv-Ytf4yOIKQD0Tnu_0UIv6n_0p8DuJxe2ndKYh7rVN7aO-WYzz59p1ObbNoU3tAHEDE3jV4hnBKwHm5a3VmwnT4qz6m9QGb1ZpPvON_ATaXzkWk07HFWGsHSjRLEaLOQzZ5Vdicb1_WEcFLi-Bmf50LOBoDYfiviReuOkvQmT3sRZXF6IPZ_j3c15k6j0FYJbKd52Vh9z__LF69dEtru4W9gin2PWlL1oTpGPs3CgAt2XpPtVxuq6zGED2SFX2KUn4VF9BzpkqQt1rB_UUzGSV5GaRE6lp0jTw3L9C5FzjhNP3-oZ-NIMwnndig1KTs7YTKMfX_rHlnFe6B7YgusGeIsAI5ocIIgMI2DWXUG7dgt5DwriGCv2XcOZ3gD0SdwDVdqNhWLhpPBlFyH3TXIYXV0K_fRo8-QNX9sCmq9_M0uSaTxg&cid=CAASKORo8uV5P427KDgXkjANLdKgFJoApK7MXUsJV4R339Ch57OTRt2TeHc&rfl=1%2Chttps%253A%252F%252Fleisurelylifestyle.com%252F%240

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5e43346472b432069c31753dd5f86c693218119096fc55434b141f41efb47f8f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11222
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 04A2 42 B
107 B 613ms
183ms Image
image/gif 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Aldo16AYsAs_glaNRGGx0eEps3dccuxVwElJHwkey-4MyGwLECQ7Q1MIKf-Ze9LEx-6JAFHhuBtphsRkDQ5Ouhoba9a_ngG98u_WnZcej4oG30eyY

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adj Show response
fw.adsafeprotected.com/rjss/bgd/1133689/65389534/xbbe/creative/ Frame 04A2 242 KB
73 KB 729ms
241ms Script
application/javascript 54.92.10.205
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/bgd/1133689/65389534/xbbe/creative/adj?p=APEucNWlDCKZHKnA3anPDAyCMBgcBBd2T_Wi1L3GdA8uDMwLkm8BQpA&d=CnkAoCZ_4HDYQTaoOJB0GLJN0X9w88PocxGxakiP5ZDHEaVf9GuxHhXoVPRNXxmwk5XKnkIirCg8T5IB74sKzMr538FvBV1CbyPpKzD6gu3rvRQhQG-WkO-qgo8Mz--sbicJNeQ6dVpoN_emttiyGblKxbIci1F1cT-dEskTAKAmf-CEEm-ZjyaJfCIBVG2wwEv290fV9RIVJOpuaMNVdUGZeS2rBdrqsu1Ju-ynVH61XMHmnNVyr9yNh5-DoTcuaBbRUH7O77JYD5ET5S2v335gNUIGfgKt1tDY1Uc129ypqyEO4FIoICvXbpeZxf_si01Z03Ya3B2Sw5Mxg5hfR6HU9Yb9ljBQQXcFxlupQBgnVv6jSX-DzrIyL5-FvZqpAl3sWriNKjPEV-2nIBmhD9oQukh3E1H60Ofe0UDvJm1OldTe-LOSBK3cnwZzldMpAYx7zv1_0s_gMDD7j1Z4COIU0dWq5IqMPuEc-n1B0W2qk7wR0AWZPQCwYSbNsOpd8ECIUbJ5L31L9LkVug6tFBYXm4cuYS95ekUYAzmmuT6IVXFWlRmz3sb0ubnEcyYZDRcgEawwwn54KShXmQDTb-5aB7o4KngiPISRIXJlUoMnBK7A1DAV5N8TnNCQdnvE82JaMQtr708vfTlb75ioomy7ansAtFMPWIauCj1t4SfU_p1v6IyGqv0EgDvHD9aewxj2yCBBqWv1cP2YIc9H5ibZ-1-zK54vVvR9l069AzNZ-acSGxRu_bD9xD8pRlr5z6IgWZbhU76apWyt0IRFslYqH1Ld3QDsaDtVuU_qVCjuXvAl4LI61vqJwobDAz3ESGHxn_cb4ubSVJOqpCPanlxap0FKE1uz5vYcTF6ENPIIXWe1ezDlUf9S6ULCbMHNayTxUIsGpkoyqXoDE4Tj1Gakx7dL61XJ9hp8Jmu55TTO1ve_aJSfTmHl1QttE0nkA1wh4Z-q_N7Spyp9MtIren0EnfbckqXwcSDBGBMBsnli6-DJMDvQ3FegBfixjytoGBPw5dFF-NqxQZILEuF5Sl7EO_CuHyJ_HO2u3aAYKhtXNjrvxALRVc1vb_VW2c7GQtO3r7NKAVMVqfXghI9wHm7YqtBMw1iO8DuP9OeQk-0MXs3TC7qvI7T8Q8g5UxByqfWtToOK5pc25k_MQEJbfQh-eUPdwoWihmG9Xw7uOuaJ8ydcQemWadDs7jBQFOvsbluMPGjxQ65tY_p3Xk3urQsbcWF4AbWV7h1j_gZNLckydSfIh0t-ZohfBOrpk6KBkjTGdY51_yCHbgm1ivv32kZlKcuAaBLamZ3JqWCqmyPDTtHcAl3R7NmPxBKtOAXeB0yu7APGT9nJFkapAbAcAaCpddYLnpv4sgn1mFbmD3NVBrIumTLvVACz-4aP9j-oeNeOtCldytUBqD_rSLvU6OUR0aejKnNFplOcFzXJw7lCm6l6WzcFsMPqPWZ07R0GVTp0MAUro9clr4xKmCJns7T4e6nlWzF18UqFq1Ez8ICUf5oKo1Ds3sxMCeVPasm5ei3BY2It0xRmnXNPYXa3xdoSp4Q1SflA5g63tVWJRxD-qAfr5wb5NZh3I3SnLjB09dlMOFG-InF6lHZafaWHCpaM50ALxN_-m31aSsSqqb1N8NfZmoDiHF8atak4ywqZF_3Ke7CNNENU7WV1t7fkmTk5MP2VnaflDkEOddnco0EnvryoFvP_L8_sNRsJ-Ji_EALyyl6TbhoKtxN83H7lm5h2UKytsi0lYXE_BJh9koXNDoWnOI8x6A82Lq5SJxVECtpSZpHcngO3rkDUVdxZ9h0p9lQ2myzRjJHArqPkv8hxagJtOBLExOcSHG8fV1RxBhIpydsyTUN0pqjNgfznsf-FiUR64ZrrWPMm4iTt11668uWr3q_Lzzlv1iUJebOEBz-YeWuSo6vun9zgmmQ6nISJjr5UUludCMOGJfaEkfp2bA5aHc62TiGfzZ8Bneo7dKtW1Vmni6P3SLcubgHcEA9Uv1Cygov30NVmerKEQ8juG3ZyKLg4l8MOZdtEamv4W-M5jfztR02EUlqok66OTxcodauvw_d3Ioa05km2doGTUF3nYxE_gq8EqCu662M2f-OBSmbHL50aq7jhdRYMIlaolweWzmNpCx7-c6yDKRo37rhzLWKW-lJuCQc2kuTx2IwG3-FGkZgrdXocJ9-sI96waCtMu1LE6uHl3WtTeTqlrGXuraaAskE81-FKHbCa21eK3lDi4GZ2Vdgyy7r4ZbsrGUiYuD9lVd6BBKXCrYdSPUi_3-DgvxtFlHx21zf7pSuCI1yQBfYEUZqmTfifxAaDHEspE6mH-8zVjphNqI39-nEqC2wiH9RmCwtexlnpST_R0RgWQkt-eY-IKnyazOx4zMTJh-lLRU24cjsDsqXsdnzgdNKM7IUtrRKGk9qH1difnoH6_S0FCloju736f2cxNLVjMLYFCSnrd3vxN7utZvx2StWgzB1eCFgRV43HpQqVpLGuG9am40kVQJSktp9DX-q9ddAUpyUMUIWenTpZ3wYsGgqj97GAn5r7pdks8GwhtZ6fWUb2GlBqiElUwmybEn3pGrmqzL-KnVnk-g0arwZ9D010PyJF1gXH14zD07wNcek9k2HKLvXL7zB8SGyS5DhdFn28LTFZOmCYTL593h6x6e04YbHTS3XfGXrrbIUPSDSofwZnABUusa6sPrfB3OJV-vLWJuNUw2q1MJFyl_AjF97MrrXSosJ4otvl2q3Sof5XIle-GtoJTrul3ZT7jtgDx4be2XncTo0jM0OtKqmEK4C9iIW85jrKOTHPBeReCzBAXy4UETbgcIhMVP27dfSuABE2gAsd8o7uelY8ay7V8aMQxJmgDPEMQCeYtqaV24_80-Ik31jF9oaMcWvMAVlWk5mZmA_NWK28ef5Ed76tyW3M5Aun434JU0ub26EvdKN9MCJWm8AGmNj9AhYDVHiY2enmbdGy5RN8QMR9DFQIwf0No3rIk4okJSpe-I3k-HkHPpMmIJr0yuYxvHlmJpNrgg7acmQ662o1KRVfNkrwtGpsuNO0TjC_lO4cv3H-pGFXXB5v9IPRKbOYAAX0XkVR_oFbjEXBvXiW_plCzdQOSEGhZ8_zhKF5Wsn64cJn6o6OQur_p7T5aW4mHvopKlD31ieRBNn2d2d_RbuzjECCJSLVcJ_Q_HkVISMuptD98tESiWlgTpL_vsMLjngj9D0mcHzNIe0DYi44rwr6J_c0lsZNh8xUxAkxPjiFirr1xrBN7X1rx20Fx8cvEvzq6zlghaMFt8U1PyZrNKHKaepAwrcX2L5T5Z0PwVfWC2_4IGtPms0OGn6VxBgXZ4Dup0GZKpGS5-56qQIwkEpCIdD8DVTE3pV8IgQHWAKkXQ4fpjWi9DyNmQ3FTGllVv3Tmd2XRpsv0rMq3CUWXuvSyI2CTomQWSaxOYYK-51heh8S6pJLOGkyR0sSyxcN2NCjWKYu9SNss0HdipKELmmQ6YQm8QVRGiwIABIo5Gjy5Xk_jbsoOBeSMA0t0qAUmgCkrsxdSwlXhHff0KHns5NG3ZN4d2AB&ias_dspID=3&ias_campId=1008779776&ias_pubId=pub-8501674430909082&ias_chanId=1&ias_placementId=18006246121&bidurl=https://leisurelylifestyle.com/hot-springs-in-california/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0hykEmJ0cHy5nDsDLvCNNOE
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.92.10.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-92-10-205.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 83b281b708e03c249ee1c9bddd6d3f95d715fc7a8a50e1538a0c3d94ac62cc61

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 04A2 3 KB
1 KB 173ms
172ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:35:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3399
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:35:07 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 04A2 17 KB
7 KB 178ms
177ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:35:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3399
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:35:07 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 04A2 141 KB
44 KB 977ms
548ms Script
text/javascript 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 05:31:46 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 7B72 624 B
559 B 602ms
194ms Document
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COjKmNsCEJGanYADGOim4NEBMAE&v=APEucNVGws9fOiFjzFgRdR3xQMbtC6Ta3iT-TD6rWSSZ__hkySbnaCfwHXaDsFfu_fVwdcqxwwoqyEQM_J0P-5SJwkDkYJ-llg

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 05:31:46 GMT
expires: Mon, 12 Sep 2022 05:31:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame EE34 85 KB
34 KB 973ms
566ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AVJMbmZCi84qMosNHMjA7ztM22StGVDVHvwVQT3rwIWZyUa__DcctHRtOFqmm97TWfeF5k72LgtzG-55DK2H88dYpLKW5jWzpJFlrmck5fNrW2yYwnR21CoPEYbpHVfRMJzFVXgfGK2-GbT_UxYEu-gs0ybw&dbm_d=AKAmf-BJ26-d1QG-zv66sjt0VhdyaW3Xrh_sW1K0PDH6xWrdFJ_j-7PLYEX0pi2wXHvWP178I62BMhPdMKYyzlc82gTi4lSWabFVgZWZUbJpAjmWxlNSmfElNoXF_Xv9hgbnJQtimaV7niAg5U0xwlVHDXkpDs15yrW_YHSvfERTwNXDM6q_zeMOTfoXUvXetDJYF1SDY299HaJ6yGpAj2B5Nyz_Z6x-g8OBNWzPc6yg6IMbW6WkyOcvxT5r_dHJ4_0Nwz7XAm6bRY0LvS_DgPwwJAO8zv6sd7Fsl65qnguPAruBdVZ0zaglADiYZTwWANvxMFYKyhOROWZPMWlNE4SMEvK3xM0mb5_mlkAwVncDMyZMJZBHoGNhfarpNzPzb7r4v6tyMV99G5q4L6qlfiSB2wvV5Jh05I9EVZPAfI2xu49vMyVeYr-2Ps3YuuLd_XsA4ZM73nTtGd9ZVMry8Uw9IkOT1g1EOwOy1WkxdRDTvAz21J-43sXKPlFFAmyYf_fUKWE2XBPjRAdQzoE4gPmr_h2r9qWKAuObOZKaLU-3COcKFo8iXLoZoXawcf3g68vkUpercMOwVOWk-Z9Gs_VpC83t2-GZsWT92F_3VMCXSSqY674I7B2yVswDyOmjjSUvbp74Ho8QnBftSQg_wFjrdqaV3pMSmYbCpWzDWamljA_3FhHF13h45eLGoWgXxwW7H_X3Tn2cDuOyxVebhQjlULOFnv1rNmCrZ0QJbkFcv2Gy0vWu9lOeNh4TKtEX6zr_LMBhsYgJOxOOO9beGUpkty4V5iEb09C0lB6wdLT-ohQ_qdPekF4t0lVkWm2aJFU_VqO4Xt2I_mhKmBeIwc5xlUOay9oBOuhwrbTVaw-SP_VSMyjX1mDoPOa-DWelRoxJUlqeruiiv_mGGzt9J31m7bclxJ_Cy1-u5os6ejqWu_jBJfz9l2Oyaq8Id6i2N4X5EiqM6ILzo2j3rYJUocpWpxJnl6mHloSzYoztxPq3pP5WEOKa1YicFHWBkHl40mmYRBVPO37ClXoRgwYzWV8kKfDfu3y6FRyMKJelkSRsADqlMJgqSAdNW9_s5blolq6FgYvpqPxQRxWXGX2gYNxy2MY9f94XwV39uEhu8he-o5_Nc9sokhEp-QFw2HEZje0kiV6cYp4FEfYqFp4j7zYNk-clfyvWS45imKbk-4Ap78_O18CrAo27LUhrn5SigY-zY-0K7x3TPVhVdQ0wNUxnjHrHj-B2TkSTue4FThZNY6ojJGrFIUBmoHrB3Uq17iiewkPkyzCicrHdAjSBcfuDLtePMB7JWFMQzxlYTNTbKPukWysG2IgMcdHNK_1b0TRJf94L275sjruF1Aa54bOd2xO68YDq1qRAStqd9m8e1jWs_mk26P3uAk64FqgH5lewLH-MnCFhScgoM3ixwM_8XgzuTs69kRM3NLrNXgkW6tzWUvCbd03AJRsgGpI06pcuZM41C8sMu-VvIQrZ0ZmHBWvAX0-7t2kYTcH4S_MTToHshtlJGAPPnqwWthXY5bzu2Eu-TqpzORjW1YhaZ4TQ59wgZ1nV7TpMOWyUVYCBxn9KcFfwWr9NwRVeBeJFd64Y0U3O4hNFQyM07QIdOvjsDgbi1dkbd8g3Lxvo7F0tCiNiH54ybG7ipOJVSMG_BG-rtVRyzNaC9poHapnMSEIGNsisErPdtxfdQFDxvfl07O6tFFKRSH0nFxrV9VM5LiHK5o_ukphs23gEzWkULmD1hhk0W4Lmc4lpmLvW0s3q07HARNeqWRjMWEgIQ3k-MG7BwFYt_CHdfjR91RtdUb699UsAXcP7fG4iiWoGd9XNtxyIhNWPgxhUJq-oEZxcs0nErobv87ygR9wBBLBtyc-WbgEc6oGuvtc4HGmgUSOV5nX6ICI0qM9REgQ3GbZKAk-NQpZVAP92P5Deyc-GQtwk1cbFfXS6DWEbe1YDZbRtBVx58QRn7lSEIqdbp0cPQiuVhlUsesoKgzcnE2whYUS1UoWtHBr3S2uIzkqvI3sNiZ3vobCbN9gzexQKF5ZDNR_mb1X1sR5jyvWQC5PO-Y5WPk9jEai4Bm8_kkEwnkUHYTOwqvJ07nfoFZ6M73wJuY4BUx8VvmGd9Bpbf4W-3f19qLay7jCnTTik4WaatzGe_OH8u2XRBI0oqCzyFv5d6FRtWg4rDAqoEFLq4fpbJVaz2kwyGqx6P8O8xSrNDhTSgce-Al0xug6JoI4voQhhvkTmDnZzqb6FDs5Vvu_nDvOcrUbIJPzMriibf_a5defVChs-e0phM97rZ_3FXLqOM9-KiwgL9BR69xoA9NO0C8fdRHrlcfSg3UFvszEX2ulPkGnRaV48PcfuD0Qrf_jiEVJUtnC0-Pd7eufrhcJQPIaMSA1_CX2U7YL0sv9w7wPc7FcHh_ZQ6bmQoP6OC-Lu27TTLGte5UVa3vD5jePgWvg1yFuIRtohFtAlWmqoBHVJtjWNvnc0MC-X2WEcMsFoJk6DWGIQnvJiG00cqz25_eoNObW0Hl-vJgPxH4SMASxPBx46iAf4WVyQvT7mBnpbtdaRiw0rAThVy8FAlCy7l6xmLljrTI935zzQbwxKMmWS86qVTIF_FHZuJxPpSHYSdIiW0o6EOR8yN1mbNovr3Dhd6S4RGuLtlQRyI-B52CG8GqKajedoZn2xDpDEHwfyLEk6vi0HNGi8LSVQbdh-N0Y52EQpEZGf6Mx0Ndj3Mg1Qpl4LUxcGyYqpnqGoP6NfLpuhiVgvh87lV466sxdY03NlviWEowSeLV0lRZ2XzF_gfEKU_jHCv4VQMxooHz95AUpzF5zEo_Bu4wbvLSshmerBcfZOLRWBrr1EpG5lU4wEUsZLfR3ekUW_nf_jkHuNVv9orbrZ4705ikNVT-R12eavAP00AkLZJ_DugUHI94cEgFKT6dZBytnBO4YA8MtyvEopE7eivQkBgM8DOKskYkThCN5BioSqjrhQHY4VW2LzRq2vahqCTuimhUq-3hPEkcymS1g00xg6FhPl_5Zqf1r8xTTCNEwN0umzocMwuycwruTDzd5ugQ9noHkMWoTGXCdm9DnMOm2bytSVXxBjPLmATDyqFJaGvncXJLHwHPH-E9pW2V_BUMY-PkXkiaH5pXUtAcYi00hWyIRShGGXGQrQ0_Nb8awsZHbQkt9qgU4JMm0Z42S9I54NtJsABM2AOMNuVPeWOR4UraxsWAIF4ddN9C0Az8kMPHSXXol9PRUz34Nhfp-VPbcM1VTllWXSG99Tpfo3Yy-Z&cid=CAQSLQCsnQUxGAd6bZrOSGbQMlIqUbeosicI32UfwZkQbv2VwKHXzQIGWUVwY2SxSA&rfl=1%2Chttps%253A%252F%252Fleisurelylifestyle.com%252F%240

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2774ed6bb7f3af77c69b23fb3cd56a1cc5c06c8173073ffc6dee0eb0ea465cbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34703
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame EE34 42 B
494 B 583ms
182ms Image
image/gif 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-D9dtcXPcdDdm-ppnEcLhdDvT7oHdyFJ18uH_XhZ4cKpzTxuCuGPOjss_OtAGCT3sIFDvGczyihYUCttLnBOgDSvFT2ZccGOgVMsSS5lbrHRUTYGTQ

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame EE34 3 KB
1 KB 175ms
173ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:35:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3399
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:35:07 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame EE34 141 KB
44 KB 813ms
412ms Script
text/javascript 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 05:31:46 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame EE34 17 KB
7 KB 179ms
178ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:35:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3399
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:35:07 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame DB58 624 B
558 B 564ms
186ms Document
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJiByQEQu7zuARi-05PTATAB&v=APEucNWQ9quRMg_h9RwJvn5fV9-UK3rVEY-r9tIAzqlWBYd2lqFK9aVeksdewvxdsOfDLqm9pLdOxgb53TKBpdW4F2MUjSlgMw

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 05:31:46 GMT
expires: Mon, 12 Sep 2022 05:31:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame F876 81 KB
34 KB 851ms
474ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CkOmjsuHXhMevZ1P02nP67RuQ9BLQNUsYz6OnuZBnywaFpTNxO2lPqDKCKG8AUAlK4U0pUS_60_NAmh6xF1fwf-u45rw&cry=1&dbm_d=AKAmf-CCL8_uSvGBEzITrWCOKGW15XDp-d7r76IfJtSZDBvAUOOYV0WAir0PSCrq3wCengfdY6qqhShaS_v0veyI3Q79lBTOOOqe3yWrlTq4LA2jzW3N6Sbo36tzTSV1ZAwntl_t4kOG27EHjnDLmuA3hnDYlIoTVqV202R2q6z0mAeOiwlRhknhbM0VlHMGOEwzrQnCSMBwGKd9y-MLHunqqqf8qOuqAZ7P97jMz2-VXahJXdq8P3UgVU8QTE7TGn23MYuH4OzHI-XWlp42N_0-yEy3ltqOkR87sKkXYQKQ0CdnCjfRnygD1iimMZJvtl_y7lYvFKhtHaCZbuCBmwOuVvPvKpSf-h-gUoWsbFEkDPZdM4TxUzi08u_af8trMT_QoYLTNIouZ9ahksT-2EzqiWV1dFkdjrwa6Y63I1iEbsTcFKsC2qAs7IQUztyTeVu9mndtPQCtjHKCzL5bsuuTXrjjjsnN-8CtOoUuawVsr223F_xrt4IhXuwAeEhB7BAzzy9gMMSS6opYRHs01JFYXuVKCT6FhHmipQ1rUmI13lTxnoChL-IuCZ-iD6X_gwvaJ3gppwG88bqappN7WmlwcPYLA9XcWMvCyAYWoMWYGD1mcESjJA1kKXF7MmAEpoIk7XCk7mCQCHrhmP2uIlg3W5xAkhn3tbPK2iA9IhIKOxO9QYCdbH63ahhnE7aoM0LR9bH4hWSXlNG9rdeIi7iVqdiZEGAZPNvkQLyKCLvlcZ4bvyHzjtjZPBi4iuekzCuT2dn-J_KPrKqEw01DjUIuDCaNE5tE6BaBlnG-v3tJ4xYE5RAf79UQtqVCVyTinkfIDkSSxtji4rTwJXkQF_VkgjiBrq7W9nCWSrZIVU7sqTZP0a4uszXSsW6qwBT7pG9vUy7xsZjg-dwQNggE7SnMQs2H5LFIuQ8yqK1DHXi0oC27n9ZIkRJTnuYBkoBStaRSTWTU2MTL7eDWUtNEEHv2RjMCaRcFtXaDiMYcP-59W9THUhictx3dHk5Q5tSZsLo83Ph7YUbFGSyVzJTTaQjxsBQoG1XxObnY9HTQjf9vkeOdB7pic72IStfyAH98llaqcL16QtgqodcehLePb458J3UlyKku2S_d4X-rCxaLGXX_Yy2RLMajLc4uG0jlOJczvVcqSIFe2G40xQqf2SOm6jlt84OySqDqmkazfKqmlYoJNptcx5VdG5qZQsCbDGpxisjw1ldbVfgOqrIgPoDKjJpSkYzAYBSju_Ds1ZWjOeuloaKec_br93aJH0dDAsqrzAajgQQUNHxk9VXa8-0GdHGiyMI5Bo_xFpjV5FVLVDJON1g7QTwtsMpHV2V9qfXt_fRKsvbWkjNGhaFHa0q3TFcg2UXKd4oWsbflVcWCwC_ANJDw3pHaq0kh6YYTJbPBSCJUh0LSwGA9lGWE3jyZfammUlWiZ2DVdo_-FZM2QJMTXl4Y4LV45_4hZMsmevI25TPzhlM4OLG3Fkj8hjjFL_XaVWJYkAkoU9ol2941kvxpiDDCetkI5BeJ5EBSSX9uSEiZwpGK_9nC2_DduLjfsyDwFVZDp7K7Oon5qpVruySBQwhSQBizBDJUyag0iPhzYmAsj7tlYZymNRK_hpL-RW7dIzQHtTOy6ytaHOBEYbzT1nwEswifvSTVQ4Yq5ef56b5h6G8X8U4CfWPesVdOkCIiJ0gCI3ALUzfsTKgw0wo1DjoGnZkNpl490L8Z3hoB_qyc8X2aA1wQnFWwAoaWuzqleNtCrHQTLX3s8t4E_bCjk1kWofV_HFoS7IRDNsxwiLgzBORmFjTxhXyPhnC0fiLmrbqI94_5Bmtg2f3qgU-P7wLjOYRdPYcFewdCDFLOMSKNUCboZAbgsddVbX49ZECDJw4WdHDlsp0rblIxLjcOqzy61hkGnQAmvn1iBHgpNEnyh1-tw2QdVYBPac4u3eA7JWts8WvJjVu55lOf7Vq3_MRuG9KOOCVvl1uuBu6BbppnrLm5sXecp1hm2cogbhO1B98hS-BIff3wtQ3lk_9qYnzNzsN-Q0FOqR59oSPDn6VZ5rgL5FQZG7GqKmQNBURRoyWm9phXcXD28b1Qdg80L5ayBG6jhZyp4_scoTsY75L2nUPB4l0NaP8UuD4j5z4dS-boNrqB17bpVJJbM98nrWTpK1hUMtKjJjSSKmQVVFG7W3TUbQy6j5N54eV4uB6ktOeJxorSYfXTR_9iYC0egN5yMtGmfFo4khDnIgwGkoBvu6Nm1VUE_56dQpMcVeRM0EF4NsHeVJssSbgHXYdKSq1AwMZAzcgDT9gMmt3WbLEBMwBzDT1ECIvkh7XvJWpVH6lSU06g36zSp6h80wtMuNJLHcyPz2ufWkiPCslDBkBgYbyTZt74kXmRJs8i-A_baDovgX6QKXpVaeVrhH42-ma-pd6C-zj3JyGPlF0dtJ4lM8fqzjuaUjUGsRu7H1s_P-ijr5SvYqV6KUzV8XMK9_ypxi_yPqC975Lk44koYblXaJ--70WYsRcqCDiHZRDgs7SABjJWUVxULdn2opiY0weXK6zp-EaBKWiwtxNULCXcRWhes1asNxg8Pa7bXH2G6tm7BdmoVcRmqUWgN9vLtJN7oYnjz4uXInzH6UC_0UN-eC0yF2SwTakyZqSVCsUeJV_dKwRC2j8hLdVvjI9kd6afBi_-XR9AvX768o7RO85YBCq0TAId1bCIVp91e1Ut8fnvP7pv5eVu0Hol1GHOWf7QikJdyQxpMs74fTgBuEb2kTKJThygFETO_w4zlXslaPnKqvbXIidVSqDmYX_4StO9ZTreV3VfiX4sJwUiAWhVUersT70nWl8lBIGOhcul-3ebqIT180ql_ltaMQYmBZOBMUHBDhchz-NnT2XvY2sgjvDZVy8Hlf4FHpYofOhUOI8-_AAAmsVCw11QHEffwIv1wW_UhNkyjf_zh-_ZqTTFPIjfm9_ADZasizlpzv-KBhxqkiJPsQ_odEmGY2M0dJc-qVRiihlcGGtfoKlFd_2EccobFJSrLZ1gEJZ0Nf-SycQborKUK9HFIuRohFVNgLZHuoUYjKR_W0w-qqAuCR9HhEMiy9kr-6N3mz9fXxk7A-2aRQjdKhpgWL1K1QaeIaDpv4TSTfP-AfziIIjAqhJzNCy3K8Qdw5_yJ1BLrcChQZWHj36dAkI-jkc1rqppZ4RpwuZe-k_shbQGcZ6JRoTgfDF8_dMcHdoNMEHLD2uT62kozg5_Xm5ktEE-eadplujKkI5vpc0d1vnNGvFgczAPF-FIXXRSZKvYaLhyuhMTTJ0AhIT1Ipeq7t7oLk8uqFmEK128cefTeh-uBjU3a0qkvf4C3EJmqk8sB0c5lnTLnkrYZ_DiWmsuWms4fLFekr9dyhmAGKFxGDmh5v0FrGEDQ1LH5a2_crGVBiWUdYs7JCstZSjXMJH7EhAWr0rH7SgMQvczeCDlAm3gJS18O_53irlSw0f_pFaN97aMjH3hkrAuw7TlKivIJKei-KZsrOsJz8A&cid=CAASKORoXhRNQzye7Y7Ilvs_7ACSiot1v9xQeSyVBVUAmndTw8K7T8GdWpE&rfl=1%2Chttps%253A%252F%252Fleisurelylifestyle.com%252F%240

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

abea84c2184b7283ef6d62a3538c2e75e2244fcabc0f59a20744982cace951ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34672
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F876 42 B
107 B 555ms
184ms Image
image/gif 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Az41jLzDDuSvzL6weSRIDfMIGseE8DEOU4O_eMkq-leJHDbvf3qLdfnW0hM4v_odF6hwybL31pWflpdCASw7OsdHAsKMG0zTEtlK_ZHOykhv0BPD4

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame F876 3 KB
1 KB 218ms
212ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:35:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3399
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:35:07 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F876 141 KB
44 KB 983ms
612ms Script
text/javascript 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 05:31:46 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame F876 17 KB
7 KB 178ms
172ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:35:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3399
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:35:07 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame F876 0
0 592ms
221ms Image
text/html 142.251.10.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRdQoqciMslh5uZacz8kqKsDNpp9RMe4UC7uiYD-SV3PFjzUT4Z_TuovlXJyCWsCRZ4bOCj6kjoFiI294KfehyKqP9U6A
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.10.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f147.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 container.html Show response
379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 0C94 6 KB
3 KB 169ms
168ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202205091138/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 05:31:45 GMT
expires: Tue, 12 Sep 2023 05:31:45 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com.au/adsid/ 107 B
122 B 175ms
175ms Script
application/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com.au/adsid/integrator.js?domain=leisurelylifestyle.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 183ms
183ms Script
application/javascript 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=leisurelylifestyle.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 18 KB
10 KB 566ms
565ms XHR
text/plain 74.125.68.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3277682631422013&correlator=3653906085444738&eid=31068457%2C31068929%2C31069183%2C31069332%2C676982996&output=ldjh&gdfp_req=1&vrg=2022090601&ptt=17&impl=fifs&us_privacy=1---&tfcd=0&iu_parts=18190176%3A21726097356%2CAdThrive_Content_6%2C61d877f7514b73001b093e34&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C728x90%7C300x250%7C320x50%7C336x280%7C300x50%7C320x100%7C468x60%7C250x250%7C120x240%7C1x1%7C300x300%7C552x334%7C728x250&fluid=height&ifi=10&adks=1889330807&sfv=1-0-38&fsbs=1&fsapi=false&prev_scp=location%3DContent%26sequence%3D6%26id%3DAdThrive_Content_6_desktop%26lazy%3Dfalse%26refresh%3D00%26nref%3D0%26amznbid%3D2%26amznp%3D2%26flag_slot%3Dfv%253Af&eri=5&cust_params=flag%3Dtarget%253Aes2018%252Cadsmnche%253A1510%252Cpmp_elig%253A1%252Cclson%253Atrue%252CclsBranch%253A484004f%252CclsBucket%253Aprod%252Cintegration%253Aplugin%252Clmdv%253A1.7.0%26siteId%3D61d877f7514b73001b093e34%26siteName%3DLeisurely%2520Lifestyle%26verticals%3DTravel%26abgroup%3Dwvtls%253Aoff%252Camzn_hold_load%253Aon%252Crfii%253Aoff%252Cflr%253Acm%252Clzflr%253Aoff%252Cebho%253Asharethrough_ebda%252Cloglevel%253Aoff%252Cidho%253Aoff%252Clzhb%253Aon%252Clzcvp%253A1.25%252Clzbpvp%253A0.75%252Ctripleliftdr%253Aboth%252Cmagnitedr%253Aboth%252Cpbs2s_appnexus%253Aoff%252Cpbs2s_grid%253Aon%252Cpbs2s_gumgum%253Aoff%252Cpbs2s_openx%253Aoff%252Cadt%253A0%252Cito_ds%253A2800%252C3pho%253Anone%252Cvebho%253Aoff%252Ccbt%253A2s%252Cvast_to%253A10s%252Cproto%253Anv1%252Cpbm%253Aon%252CreqTo%253A15%252Cvadv%253Aon%252Csmhd100%253Aoff%252Csmad300%253Aon%252Cs2sbuff%253A300%252Crmos1%253Aoff%252Csocon%253A1%252Csab%253Aon%252Cdco%253Arelaxed%252Cmxrpog%253A5%252Cdajto%253Aoff%252Cjwb%253Aon%252Cvpred%253Aon%252Ccrtvmon%253Aoff%252Cpba%253Anone%252Camzn_hold_disp%253Aoff%252Cbmetrics%253Aon%252Cconfiant%253Aprod%252Ccnfep%253Aon%252Crefflr2%253A1.2%252Csocbe%253Asovpct2%252Clogcls%253Aoff%252Ctpcapi%253Aon%252Csidp%253Aoff%252Crebuildslot%253Aon%252Cupl%253Aoff%252Csekho%253Aoff%252Csospp%253Aon%252Crmosnv1%253Aoff%26bucket%3Dflex-30%26sens%3Dalc%252Cast%252Ccbd%252Cconl%252Ccosm%252Cdat%252Cdlu%252Cdrg%252Cgamc%252Cgamv%252Cgrq%252Cpol%252Crel%252Csst%252Cssr%252Csrh%252Cske%252Ctob%252Cwtl%26domain%3Dleisurelylifestyle.com%26plugin%3Dadthrive-ads-2.3.1%26hi_au%3Dod%252Com%26vpwxvph%3D1600x1200%26ri%3D48%26pvk%3D01GCR2X4B7FJF6KKGKM2Y5KPHN%26sess%3D01GCR2X4B72666RTK6J7CQK4KF%26branch%3Df56a6a1%26deployment%3D2022-09-06-5%253Aade-249%253Apr2618%253Af56a6a1%26hbho%3Dnativo%252Csharethrough%26vbho%3Dnone%26gptv%3D2022090601%26connection%3Dniet%253A4g%252Cdl%253A9.3%26fpv%3D1%26mcmp%3DAO_DATE%252CBA_WSKW20%252CAO_CHLD%26site_code%3DMSFTA_2022%252CTRGT_022020%252CTYTA_22%26marmalade%3Dtrue&sc=1&cookie=ID%3D016ad2502b9b8a1a-223d580860d60036%3AT%3D1662960705%3AS%3DALNI_Ma6KNLyB1GXP_JcDCKHrTkB4d3-nQ&gpic=UID%3D000009bb3d277422%3AT%3D1662960705%3ART%3D1662960705%3AS%3DALNI_MZuIVFK1xLAjunndhyH19mRR_LvIA&abxe=1&dt=1662960706599&dlt=1662960699576&idt=3135&adxs=601&adys=6958&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=7&ucis=a&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&frm=20&vis=1&psz=762x9386&msz=762x250&fws=4&ohw=1600&ga_vid=1266557791.1662960702&ga_sid=1662960705&ga_hid=335300354&ga_fc=true&cbidsp=CpwDCAESEQoIdHJpcGxfc3MQwwMgAjgCEg0KBGdyaWQQwwMgAjgCEhMKCmJyaWdodHJvbGwQwwMgAjgCEhAKB3B1Ym1fc3MQwwMgAjgCEhAKB3J1Ymlfc3MQwwMgAjgCEhAKB3lpZWxkbW8QwwMgAjgCEhEKCDMzYWNyb3NzEMMDIAI4AhIPCgZ1bnJ1bHkQwwMgAjgCEg8KBmNvbF9zcxDDAyACOAISDAoFdGVhZHMQiwIgAhIJCgJpeBD5ByACEgkKAml4EPkHIAISCQoCaXgQ-QcgAhIJCgJpeBD5ByACEg0KBmNyaXRlbxDnAyACEhEKCnRyaXBsZWxpZnQQpwIgAhIMCgVrYXJnbxCKAiACEgwKBWthcmdvEIoCIAISDwoIcHVibWF0aWMQ6AEgAhIOCgdydWJpY29uEK4CIAISDwoIYXBwbmV4dXMQ_wIgAhIKCgN0dGQQ5QEgAhIPCghjb2xvc3N1cxDTAiACGAIiJGFiN2I3ZThjLTExOTYtNDI5YS1hM2EwLWExOWY2NDlkNTlmYioCCANKAEDEEw..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2d52f84177b862429baa1de761b3cd49b1092f41069907ca719fca4de1a87894

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:47 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9986
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
8 KB 578ms
578ms XHR
text/plain 74.125.68.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3277682631422013&correlator=3025075295585943&eid=31068457%2C31068929%2C31069183%2C31069332%2C676982996&output=ldjh&gdfp_req=1&vrg=2022090601&ptt=17&impl=fifs&us_privacy=1---&tfcd=0&iu_parts=18190176%3A21726097356%2CAdThrive_Content_7%2C61d877f7514b73001b093e34&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C728x90%7C300x250%7C320x50%7C336x280%7C300x50%7C320x100%7C468x60%7C250x250%7C120x240%7C1x1%7C300x300%7C552x334%7C728x250&fluid=height&ifi=11&adks=3866542168&sfv=1-0-38&fsbs=1&fsapi=false&prev_scp=location%3DContent%26sequence%3D7%26id%3DAdThrive_Content_7_desktop%26lazy%3Dtrue%26hvp%3D80%26refresh%3D00%26nref%3D0%26amznbid%3D2%26amznp%3D2%26flag_slot%3Dfv%253Af&eri=5&cust_params=flag%3Dtarget%253Aes2018%252Cadsmnche%253A1510%252Cpmp_elig%253A1%252Cclson%253Atrue%252CclsBranch%253A484004f%252CclsBucket%253Aprod%252Cintegration%253Aplugin%252Clmdv%253A1.7.0%26siteId%3D61d877f7514b73001b093e34%26siteName%3DLeisurely%2520Lifestyle%26verticals%3DTravel%26abgroup%3Dwvtls%253Aoff%252Camzn_hold_load%253Aon%252Crfii%253Aoff%252Cflr%253Acm%252Clzflr%253Aoff%252Cebho%253Asharethrough_ebda%252Cloglevel%253Aoff%252Cidho%253Aoff%252Clzhb%253Aon%252Clzcvp%253A1.25%252Clzbpvp%253A0.75%252Ctripleliftdr%253Aboth%252Cmagnitedr%253Aboth%252Cpbs2s_appnexus%253Aoff%252Cpbs2s_grid%253Aon%252Cpbs2s_gumgum%253Aoff%252Cpbs2s_openx%253Aoff%252Cadt%253A0%252Cito_ds%253A2800%252C3pho%253Anone%252Cvebho%253Aoff%252Ccbt%253A2s%252Cvast_to%253A10s%252Cproto%253Anv1%252Cpbm%253Aon%252CreqTo%253A15%252Cvadv%253Aon%252Csmhd100%253Aoff%252Csmad300%253Aon%252Cs2sbuff%253A300%252Crmos1%253Aoff%252Csocon%253A1%252Csab%253Aon%252Cdco%253Arelaxed%252Cmxrpog%253A5%252Cdajto%253Aoff%252Cjwb%253Aon%252Cvpred%253Aon%252Ccrtvmon%253Aoff%252Cpba%253Anone%252Camzn_hold_disp%253Aoff%252Cbmetrics%253Aon%252Cconfiant%253Aprod%252Ccnfep%253Aon%252Crefflr2%253A1.2%252Csocbe%253Asovpct2%252Clogcls%253Aoff%252Ctpcapi%253Aon%252Csidp%253Aoff%252Crebuildslot%253Aon%252Cupl%253Aoff%252Csekho%253Aoff%252Csospp%253Aon%252Crmosnv1%253Aoff%26bucket%3Dflex-30%26sens%3Dalc%252Cast%252Ccbd%252Cconl%252Ccosm%252Cdat%252Cdlu%252Cdrg%252Cgamc%252Cgamv%252Cgrq%252Cpol%252Crel%252Csst%252Cssr%252Csrh%252Cske%252Ctob%252Cwtl%26domain%3Dleisurelylifestyle.com%26plugin%3Dadthrive-ads-2.3.1%26hi_au%3Dod%252Com%26vpwxvph%3D1600x1200%26ri%3D48%26pvk%3D01GCR2X4B7FJF6KKGKM2Y5KPHN%26sess%3D01GCR2X4B72666RTK6J7CQK4KF%26branch%3Df56a6a1%26deployment%3D2022-09-06-5%253Aade-249%253Apr2618%253Af56a6a1%26hbho%3Dnativo%252Csharethrough%26vbho%3Dnone%26gptv%3D2022090601%26connection%3Dniet%253A4g%252Cdl%253A9.3%26fpv%3D1%26mcmp%3DAO_DATE%252CBA_WSKW20%252CAO_CHLD%26site_code%3DMSFTA_2022%252CTRGT_022020%252CTYTA_22%26marmalade%3Dtrue&sc=1&cookie=ID%3D016ad2502b9b8a1a-223d580860d60036%3AT%3D1662960705%3AS%3DALNI_Ma6KNLyB1GXP_JcDCKHrTkB4d3-nQ&gpic=UID%3D000009bb3d277422%3AT%3D1662960705%3ART%3D1662960705%3AS%3DALNI_MZuIVFK1xLAjunndhyH19mRR_LvIA&abxe=1&dt=1662960706620&dlt=1662960699576&idt=3135&adxs=601&adys=7580&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=8&ucis=b&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&frm=20&vis=1&psz=762x9386&msz=762x250&fws=4&ohw=1600&ga_vid=1266557791.1662960702&ga_sid=1662960705&ga_hid=335300354&ga_fc=true&cbidsp=Ct8DCAESEQoIdHJpcGxfc3MQhgQgAjgCEg0KBGdyaWQQhgQgAjgCEhMKCmJyaWdodHJvbGwQhgQgAjgCEhAKB3B1Ym1fc3MQhgQgAjgCEhAKB3J1Ymlfc3MQhgQgAjgCEhAKB3lpZWxkbW8QhgQgAjgCEhEKCDMzYWNyb3NzEIYEIAI4AhIPCgZ1bnJ1bHkQhgQgAjgCEg8KBmNvbF9zcxCGBCACOAISDAoFdGVhZHMQmQIgAhIJCgJpeBDEBCACEgkKAml4EMQEIAISCQoCaXgQxAQgAhIJCgJpeBDEBCACEgkKAml4EMQEIAISCQoCaXgQxAQgAhINCgZjcml0ZW8Q-wIgAhIRCgp0cmlwbGVsaWZ0EKECIAISDAoFa2FyZ28QkwIgAhIMCgVrYXJnbxCTAiACEg8KCHB1Ym1hdGljEKICIAISDgoHcnViaWNvbhC9AiACEg8KCGFwcG5leHVzEOADIAISCgoDdHRkEMEBIAISDwoIY29sb3NzdXMQ9gIgAhINCgdyb3VuZGVsEAAgAhINCgdyb3VuZGVsEAAgAhINCgdyb3VuZGVsEAAgAhgCIiQ1NTYyNTc2Yi03OTdlLTQ2ZTctYWZhYS05N2VhYThlNTU5ZmMqAggDSgBAxBM.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

97d7a5d021d6e6e07362d6a6c90efe4e94b2418c4c1faff205559220d1c8ff0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:47 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8146
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012208121708000/ Frame 41F1 221 KB
61 KB 529ms
178ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012208121708000/amp4ads-v0.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202205091138/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

622cd4a2d30e2b367e91504a877c0284d39bf4ff04c3fdca849996e4df5553af

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 62635
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61526
x-xss-protection: 0
server: sffe
date: Sun, 11 Sep 2022 12:07:52 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "b1753c5424806777"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 11 Sep 2023 12:07:52 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012208121708000/v0/ Frame 41F1 14 KB
5 KB 911ms
561ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012208121708000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202205091138/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c6cd6437201b0cf35c1eccffc8e99291167d496c73ab43ecb3cfeec5a5dc28f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 476352
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5202
x-xss-protection: 0
server: sffe
date: Tue, 06 Sep 2022 17:12:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "23fb7130d171a0c1"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 06 Sep 2023 17:12:35 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012208121708000/v0/ Frame 41F1 94 KB
28 KB 824ms
474ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012208121708000/v0/amp-analytics-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202205091138/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3f2c0c4e4c89eae172edef7969867243fca9370249d772d7724ab3bca286e1e1

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 451050
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28840
x-xss-protection: 0
server: sffe
date: Wed, 07 Sep 2022 00:14:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "bd6960dd2dd8774b"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 07 Sep 2023 00:14:17 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012208121708000/v0/ Frame 41F1 5 KB
2 KB 812ms
462ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012208121708000/v0/amp-fit-text-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202205091138/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8de5be317de0e910d5ccea3ce5a604f6fe59df71dfc30b8d7272bd1fab48617e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 245382
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1914
x-xss-protection: 0
server: sffe
date: Fri, 09 Sep 2022 09:22:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "6b6863aa0ddd5cf3"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 09 Sep 2023 09:22:05 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012208121708000/v0/ Frame 41F1 40 KB
13 KB 922ms
573ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012208121708000/v0/amp-form-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202205091138/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c8356135a2910f429eaab41d100680627e417d126cbed99c410f0d5aad490ab2

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 42423
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12954
x-xss-protection: 0
server: sffe
date: Sun, 11 Sep 2022 17:44:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "008ca125395468a7"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 11 Sep 2023 17:44:44 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 41F1 6 KB
768 B 492ms
180ms Stylesheet
text/css 74.125.68.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202205091138/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e0be1d222e2e367ac5106f4aee4830c3de18af1d266f8cde53915e11e8b01bfd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Sep 2022 05:30:40 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 12 Sep 2022 05:31:47 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Sep 2022 05:31:47 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 41F1 3 KB
3 KB 181ms
177ms Image
image/png 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/en.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

85a64faec356c3a72f249a98a037317adc730ec6d38e47653cd53be5485d80a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 13:14:03 GMT
x-content-type-options: nosniff
server: cafe
age: 58663
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 15880770647744369592
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2982
x-xss-protection: 0
expires: Mon, 12 Sep 2022 13:14:03 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 41F1 344 B
368 B 183ms
179ms Image
image/png 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 14:23:01 GMT
x-content-type-options: nosniff
server: cafe
age: 54525
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 6766994032117382215
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 344
x-xss-protection: 0
expires: Mon, 12 Sep 2022 14:23:01 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 41F1 0
0 196ms
192ms Image
text/html 74.125.68.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CjoJsQcQeY8WLHvaGssUPhLCikA-95vPra57s2oODEP3X4sHPMBABIKivqhVgpcCjgKQBoAG8mcv1AsgBCeACAKgDAcgDCqoEuQJP0MxJ0OkCqPvYVxKHZkWi5XjB_cI26yRfDKeUWtoglrLG9rqRbc4LNhT9m-NpCXhyQeXeacMWRpD8SXTqvTxfmPVbQygiOzugfsMBJRZxfeRIMaCDLmowYom7D4BtghXFlhIg5dUbqHMQQci5nUfNUCAvqxVf8G50_fxztC7bA_61ihtPs3WlF8vrdY22HF1l6W1ThHc6ozQ4R0d2uj3ZTR8sWnMcsGrjJF0Kf9S2EiNxKvpQyi9ysjcRy4sWrn1VBuGkTLX_adyeN-wd05XVMbLnx8Nvcu5-eE5dHEvKL1IxzxJKJC0k7rVLUqDpgibW9s5gIMCAAA314-oavHNtVgTtnlT6gjL8RrbCi3EzJqn95XElD6miuSzYbitCPpjbgKpeeF9rBFCV4yLOnGuhCzV8TraLFJyIwAT8ltqKgwTgBAGSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAHrOa0igGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBDW8wTSCBAIiGEQARgdMgOKggE6AoBAgAoDyAsBuBPkA9gTDNAVAZgWAYAXAbIXHgocCAASFHB1Yi04NTAxNjc0NDMwOTA5MDgyGMDgEA&sigh=WTl7slB8dg4&uach_m=[UACH]&template_id=484
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.68.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sc-in-f157.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 pandg-sdk.js Show response
pghub.io/js/ 14 KB
4 KB 288ms
86ms Script
application/javascript 35.241.45.217
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pghub.io/js/pandg-sdk.js
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/es2018/js/adthrive.min.js?deployment=2022-09-06-5:ade-249:pr2618:f56a6a1&experiments=amazonLoad,prebidLoad,gptLoad,rubiconFloors
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.241.45.217 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 217.45.241.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: cb260fbfa3add6553864bf1c8dd753a45d7a1504b159c8aa6cbec89f9223a89d

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:46:33 GMT
content-encoding: gzip
age: 2713
x-guploader-uploadid: ADPycds1menOxG_CXtZr58KYO9JW7vLCi_LTrofxV0qC3W3IeFsknsDePHoQ9w_j_cv2QYEe1k2TzpeTm8wXY8C2dQDgxk-UolF_
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 9
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3690
last-modified: Tue, 05 Apr 2022 17:08:24 GMT
server: UploadServer
etag: "1f39af8c4109e6a95d6895228aab0692"
vary: Accept-Encoding
x-goog-hash: crc32c=eS3F7w==, md5=HzmvjEEJ5qldaJUiiqsGkg==
x-goog-generation: 1649178504809914
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin
cache-control: public,max-age=3600
x-goog-meta-last-modified: 2022-07-11T15:04:42.732Z
x-goog-stored-content-length: 3690
accept-ranges: bytes
content-type: application/javascript
x-goog-meta-cache-control: public, max-age=230400

GET
H2 200 ats.js Show response
ats.rlcdn.com/ 109 KB
36 KB 526ms
174ms Script
application/x-javascript 13.224.250.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ats.rlcdn.com/ats.js
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/es2018/js/adthrive.min.js?deployment=2022-09-06-5:ade-249:pr2618:f56a6a1&experiments=amazonLoad,prebidLoad,gptLoad,rubiconFloors
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.250.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-250-82.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4b05d7f4339a505c65d2fcb1b21addd2a13a0c155ddf7ca766d1e7203b2b6cae

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 17:03:09 GMT
content-encoding: br
age: 44919
x-amz-server-side-encryption: AES256
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:eu-west-1:469675294282:build/ATSLibrary-prod:598424ed-c6de-48e8-8068-45662e39c3ce
x-cache: Hit from cloudfront
x-amz-meta-codebuild-content-sha256: 57180e34d853b9e6be67670dae22a049fb237e6bca37c60f7ba138272a8487cc
x-amz-meta-codebuild-content-md5: 58acf9e97c03c481f490be71338f7f57
last-modified: Tue, 17 May 2022 11:35:33 GMT
server: AmazonS3
etag: W/"148e21f812b555a13b2a9c6b616141f4"
vary: Accept-Encoding
x-amz-version-id: qhkEQKrW4Gg_gxbK41emvSsDXWYdvDMl
via: 1.1 501f8f2b34478d387447d1479e77dfd2.cloudfront.net (CloudFront)
cache-control: must-revalidate,public,max-age=86400
x-amz-cf-pop: SIN52-C2
content-type: application/x-javascript
x-amz-cf-id: oz5XL4L9IFBR7JZrOdil9kzEbMjAroiRt0OySzssPT-QIeQI-Q_ZOQ==

GET
H2 200 idsv2 Show response
mid.rkdms.com/ 2 B
466 B 870ms
287ms XHR
application/json 52.52.242.170
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mid.rkdms.com/idsv2?ptk=17c1789b-e660-493b-aa74-3c8fb990dc5f&pubid=CAFEMEDIA
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/es2018/js/adthrive.min.js?deployment=2022-09-06-5:ade-249:pr2618:f56a6a1&experiments=amazonLoad,prebidLoad,gptLoad,rubiconFloors
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.52.242.170 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-52-242-170.us-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: https://leisurelylifestyle.com
date: Mon, 12 Sep 2022 05:31:47 GMT
content-encoding: gzip
access-control-allow-credentials: true
server: nginx
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: application/json

GET
H3

200

rum
dsum-sec.casalemedia.com/
Redirect Chain

https://insight.adsrvr.org/track/evnt/?adv=z127r4i&ct=0:p21aj7j&fmt=3
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=Nzg0NDVlNzQtYWQzNC00M2M0LTlmNGEtZTg4ZDM2OGM5ZThj&gdpr=0&gdpr_consent=&ttd_tdid=78445e74-ad34-43c4-9f4a-e88d3...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=78445e74-ad34-43c4-9f4a-e88d368c9e8c&google_gid=CAESEIpx2c2jS4Sr2v9eT2DZBPA&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=78445e74-ad34-43c4-9f4a-e88d368c9e8c&expiration=1665552707&gdpr=0&gdpr_consent=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=78445e74-ad34-43c4-9f4a-e88d368c9e8c&expiration=1665552707&gdpr=0&gdpr_consent=&C=1

43 B
842 B

539ms
326ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=78445e74-ad34-43c4-9f4a-e88d368c9e8c&expiration=1665552707&gdpr=0&gdpr_consent=&C=1
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray: 74964249cd8d17cd-MEL
pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MLyl3cRD1NcA5VmtUgdJ0uJEL0Qm69C2qRP%2B%2B1fYVO6y07WXe2zw3WX959TdS3zs9ME9xtTFyeQSI1V9xXNB1jarq9cEi3qg8%2BKq1U072lsjAC0P2nMVf4LWJ6MN16dYN4ABPydN2CQPMg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lKP0Y7VVYihdekmAfTcCcY42m7iKKEdec%2F9lNfNJBxo0mNC%2BT5XJc0hVg13%2BFQeztKS8sbGkz0SCVPEwoq4TJZZ%2B64hPEahoLRFt6Yxdsg%2F%2F1OTa14VyTlD6Toi2x2qByxKGA3QMN%2BkFkg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=39&external_user_id=78445e74-ad34-43c4-9f4a-e88d368c9e8c&expiration=1665552707&gdpr=0&gdpr_consent=&C=1
cache-control: no-cache
cf-ray: 74964245e8695a85-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/272739386282700543/ Frame 41F1 2 KB
2 KB 199ms
196ms Image
image/jpeg 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/272739386282700543/downsize_200k_v1?w=200&h=200

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7122668ea226c35c2c09486fd136efdf5a659f40d4707ae947832bfb9642fb68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 02:26:42 GMT
x-content-type-options: nosniff
age: 97504
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2067
x-xss-protection: 0
last-modified: Fri, 10 May 2019 17:53:35 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 11 Sep 2023 02:26:42 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/6241106329380406542/ Frame 41F1 6 KB
6 KB 192ms
190ms Image
image/jpeg 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6241106329380406542/downsize_200k_v1?w=400&h=209

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

abf89af85632c4538d19fab3c986b357a9f07e57c7e6d07eefa2484a3fb1c8ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 03:19:07 GMT
x-content-type-options: nosniff
age: 94359
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6471
x-xss-protection: 0
last-modified: Sat, 07 Nov 2020 00:16:06 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 11 Sep 2023 03:19:07 GMT

GET
DATA 200
OK truncated
/ Frame 41F1 221 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 41F1 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e8a4771452be8e1153a8e90b5d60ae404855006911affc68c100cd35641f52f3

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 container.html Show response
379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E942 6 KB
3 KB 189ms
168ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202205091138/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 05:31:45 GMT
expires: Tue, 12 Sep 2023 05:31:45 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 302A 6 KB
3 KB 197ms
178ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202205091138/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 05:31:45 GMT
expires: Tue, 12 Sep 2023 05:31:45 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 490C 624 B
340 B 427ms
427ms Document
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJiByQEQu7zuARiU1ZPTATAB&v=APEucNXqkFL8Bcoaaw8QHDlKw4zXQpNaNLiP_mmPp2oF9GnubFkBASHxlFEyeqFP0wYjvQd0ClAKGuIOW_oXKMuR-sQwwCQwyw

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 05:31:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 0C94 81 KB
34 KB 630ms
629ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A755zF6neyXMeyZba_3cVg9G6O0c7b1nSMGTuy92wHM5vus67QGidkd5z-KDOzghQo52nloN7nc_Wu8g6EzXAmOgNVBg&cry=1&dbm_d=AKAmf-BMamcNi8sahtZ7kttmbd8i9wvCC6AgxSNZhKd4gH5kZHL6l6X2uQVEKGRnOnGRQIN-rkLu8ZG0TpOqfXzo1RVdg12AYsiPvF7-Z7hDeC-CkrKSI1qNLwnPZeMVvQYYlONO0_VbsGlAU_8dQ_snWfSqIi2YtaWpmw7bOmbkmOnKU6PZcvq-izpODQWhKTcTG5QojKZcZV6HcvTxl67EJNz3UopnQl6wNHJIvd9DqZXF1crf9yZ2uc5bsdXExDGkxEB7WyHiizLgyTe8x65fHuObJTA7lhWJsTbSxBZ-SICRXOfrVNV5XHYMD8X6r7C2T54QbzvmLiXA-AFFQWHdGzF6o-FqBhzw-Uu-he8R6DZRGl5DY0M4NujfH6hcwKfKF4EDY6QGx0N8MKpeG0zdML75K1ocdTGeZszi_6jkHe81cwN0wVvbxSZch7XzzbjBUv3UuIna8LaHLmhdPaIgCdf_jz8KM5Jel2HRpPvciZ98twDgKfcf0ViyTMby3oF2PsQKfCY5amU5G1C_jUb-Ce3sIBkyZgNeTMsZ9EK4aY0eovTP7nuVUNaiBy6CA4Igr0U6tCDJdVQ3GJ0gKfwD6nuHgGswk4uIhKgDvuVVhoOwjTCC_1fZUCUHaf15ulQ6vnHTQvd1ZtMBEMQg191nXEIBgpTMmqrVkE0Di58ITQzr_oHSZbn4LPLGEXcq3Nsfd5XmwG54yf6o6QDLuqEKpm1BNA6TIgVjNW8Q6de2CHelLPE1V62m_3Dbcm-AABn9VwvEuo_B87Ff_EXPnVdxnZBjjTWJJ_wLCRvLirguUE-Pug0tufcDVxojMyaxjwzHwmDQ_lPlUkeBlTKT13IObb0p99ZU_wPrjHTWWNMS4fwdJGxAQGwxgzpergfwm0guGy43jy0jlCm4sCwihJbMlCV7LFpwcpqapS6hXqy9FJuU5GIFYPTjGb05NEXR0RIaFmEttnI4AKz_AmUUk4z8AYwHpZsXxoQI7Tx0lbHr7B3DBEUeawfLrO_Amfzr97-bBGlZfBnnrB5Nxu_KjolSymBiiZgo83yylJWgK4wNI97epgy48Duope1OnnJb5f2A25akMcIBIO4JMbDcfGY3Txumtu_prjtQvclyXWxa_kiPGSrMSHYjdMDxAblZl9EbbQ6ZmGPw_ELa4YpPbsAU256WjyONxAjUZjDXicORnXb0S1q1E08w1z2tCCfHU3_4Zn_hf56RDx1goFqQVxlB-r8zoZuDe4XiwEkbIeYW281oeTJDC7ScZKcnBW7DF_JuNfgRUuMYMJ7ExS90EeBebAgIbXHWthl74R6TTTRKW1sib5DFzM2Oe8dMjxU6Az6vgNK5JeUel5qQ7pfCTCGqjNBIu_df18UfhVJrWYZAyuktjMGsVBIomCPFR6R63btJyGIPCJas0RU_r-qpldJUTnIHR_eS1J67Vqw4B1QntMLtRM3D4AoFT30gvGzhADhd_NcAeh6hwsLMGkgS1SNeT6W1FjiqJagsIUynE01Y3oLZ-_nEoojjqq-GjKFqQ4n0Z6qgDg3tko56hY6vwFxuKFYQ22WSqyDFxIM9y8DlKkI7lcbo-iJB8XErHdke6p11scC0yfeOMc6BQam_csWH4kpWsk-q-a6f6H5SUnJOD2Vi88v7eoN22-q8ivH5G7RJO-bA2oonR4wvaO5QICr5ReWXb1AXn6D7CmfjtJOuYQJK6Y22RPUttMDTkccIqhybpgP7ipBeESLDxkyBn_75yEehZk7DRWPkSCYpBB734QPwuNTZyiaihbYljUIp5zd0NK1TE1GRh3uZvFA8T3cz9O6XgxrrfuuKOgv3fD65S8e9guMntRTNtQEieVymyYF6faJPoNjQp8oTAjizmFdD4-FmwjBmNA8FiUHgPuptl2-KOPfZ8YqndQjhEi9MHuFnqOk5I3kJZ7mDPgMASHQ-ugROFUrV7Ogs7BhXl5nN1hw-SLdlZxNETwjGPUMSaDndLq7P7m6htgqaltHYqejDWpvj6tCeMBYfWa9gaqKg_qdMVjMJ15WqIkn95w8tGL0M09ZG7E1wMdPttT-bzg1E3SRAo3K3RdugSpWe995jmEV67scKbu3M2KCi6wn1jDTmyoUax055J9opNHp-KdgywYACa6P7PNZKTX84obdxNMVilbvRcN5TOYvpGQokNp3miHw6LNiOGHdS1jpOPj3QCMqe49eRKtbA_-oZm66XLalLP1mcicjbgCgSrU59oh0JO06kVvgCwKBeCbiN99PEaBK6cIJrco4UUTzn21FAlFcHqRkNyAKAh3jVtWpOR2G2RcSs7Pk8Ru34uLSKZCidQgirr1lYIrsnkY0jObOBXw1RjEw3-S1YoGn9pGdT9E-M6E105KeFj2WR6qiJGP6Rvzs_5jUhLmy6Jl2_eoswOYjlAIiihYEvDasDStAsg0kljoByJ3NalHLb8kcsI3o5cUgBnxqbL8cfYd14sD3hdKw9o_BAL28u8PpzoNNX5JLcJoTBuCDd9K8fZLvou0qCJENb1pftM1sdSPRy45uMA0Ab1COFawuAHkTKrUhXrKvjqBoFvkyJ2XWgyO5e3_jN2IcB9dkUW5XWGy9waNaSkMFjTcDiOPX5v8_-jYDCMSztn3Kc0VwZDS2e4l0xFq3fHS4HvgWeiemvrmv2VagkCeGT3GPUiNZqcqM3o7geR66fgET29eRFo_fxr9TI5j5NTxSlqVJQWcP04K6xyoLuhM9xbW5bI3S6W5Irmbnot4QOW0y0jsO1F6HK7rqBTfcCxbwrhYx7u0OPyyjOwVnARhCCBucFGzgIBwFSwxeSwCzLQq1S8FQb1yciWFZfcojF1GcjU0mCHfJQjc8_td-Mv-V8F2N2j3BYVCBRpkrjAUiqdSgJdn2Q9WCUKeRYPvLkJvy2KRh5JVNLqnTcoQW6qhKSdCSfja3x5umxQtKjODxbUZf06xVHl_tCobHf21ZsRNdDfCW7DNfg2HGHI4UToJljsHg4lAiPmaZF5vznff76-aJo0pqEIAaNsLV7nQlTjhXGVbqkfGaWAINfN_nDuyVSV29VcTmj8sKTyeAb-qvfjeQM-jOfOs4iBRmXTpdEsaeZiSrJdOyfQtEggluPkKo1ydg6zmsDTLARVF0BX1e27J3pvxOva8ysQ4Th6dna9FSDxDcMgJoklcZb449eOam_4OzB_6Sdmxtg4Kb-CaIcMHcGh4h-k0qiPGNSR0m-dSV7ovDFFP0FfHxIOgLCw0j5PzEhSLE9yQiTgFuY66sff0mNRM8yP6LDdISZF2DneLEkAUXTYhRlmQd0QYeF_rvto5mijg_EMTLqKa65UCnhwkPjUFGmMA0OlWhzMmUlNT8Ap1-Qk7wShfztQwBWZr67p_hOTr7sv7fQI6JMyHtdKrPl_c1Lb4IJMXygrVRXfEm1cn-KgaxZSumXasgV7LnULQVdlWJr6fOUMspcPYEQcLKrnUcpLSeLbzpS_joeUNVLYZKCwj2FiJkgc2LJbxUha_Mpi51Gpgmbtf6TCimeS-LZnp0W&cid=CAASJ-RoN1dZlOBODV3vCB8bHw11IRgq6dSGf9mk3FkTwH42CKvs027geg&rfl=1%2Chttps%253A%252F%252Fleisurelylifestyle.com%252F%240

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fcb61255af35daa753c12c472ec3e8cbc58963e8cb73af02bb8883d4885a3ba6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34397
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0C94 42 B
107 B 182ms
181ms Image
image/gif 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AB8TPdjSbVZ4yy9OYrX3MmBV_Lds_SmLyJgKBLJTvin0S2d4Y9j2dMf0iNpRTmW7N1gbxX1H5cruzqxasNy3vvjY86KFlU_jrV7BGtRtEw8kK0mn0

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 0C94 3 KB
1 KB 203ms
202ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:35:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3399
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:35:07 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0C94 141 KB
44 KB 704ms
703ms Script
text/javascript 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 05:31:46 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 0C94 17 KB
7 KB 177ms
176ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

38.243.102.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:35:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3399
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:35:07 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 0C94 0
0 222ms
221ms Image
text/html 142.251.10.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaR4FYfDO7MJY9XDm6SXX4uFuXsEaHGCDUjaLQmZbi8bTWeXjwRxRP7VNPscZM-3_p-8CmIsrcF4irHxUemBynUBH8cqqg
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.10.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f147.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 tag Show response
pandg.tapad.com/ Frame 5C44 370 B
926 B 396ms
222ms Document
text/html 34.102.243.38
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://pandg.tapad.com/tag?referrer_url=&page_url=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&owner=P%26G&bp_id=cafemedia&initiator=js

Requested by

Host: pghub.io
URL: https://pghub.io/js/pandg-sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.102.243.38 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

511cab5ff03015940e5c41d23104e766f84e52ad67e4b3ea6a44ebc132702a2e

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';img-src https://*.tapad.com https://match.adsrvr.org https://sync.mathtag.com
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://leisurelylifestyle.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

access-control-allow-origin: *
access-control-max-age: 300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 370
content-security-policy: default-src 'none';img-src https://*.tapad.com https://match.adsrvr.org https://sync.mathtag.com
content-type: text/html;charset=utf-8
date: Mon, 12 Sep 2022 05:31:47 GMT
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
strict-transport-security: max-age=31536000
via: 1.1 google

GET
H2

200

sync Show response
eb2.3lift.com/ Frame 8F88
Redirect Chain

https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26f%3Db%...
https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26f%3Db%...

1 KB
1 KB

189ms
188ms

Document
text/html

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26f%3Db%26uid%3D%24UID&ld=1
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: fbaf5a579c05c740a6e21e683fd7eace61ab7e9c86527cb109545ce3533a2293

Request headers

Referer: https://leisurelylifestyle.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 505
content-type: text/html; charset=utf-8
date: Mon, 12 Sep 2022 05:31:47 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Mon, 12 Sep 2022 05:31:47 GMT
location: /sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26f%3Db%26uid%3D%24UID&ld=1
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame E281 640 B
363 B 492ms
189ms Document
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-f5AEQn5zmARjvtoXPATAB&v=APEucNU2xspH3uf8WT8cQSL-owXPjEsjPPA6UxWe7N4SEosPSyrjoXeAtiGbEI0m7k9__lYpHqrx8ExVQqeqDRozW6gG8A_2Xw

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 295
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 05:31:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame E942 93 KB
36 KB 531ms
229ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BYFd7LgXHv6WLRzrJYi86cqaR-2grEj0oDenHdLu2VX_iRIrPb7d0q_LWfWV_pKfTbFDQe5wOcif8hlGUT1jQjFLmrsJ0ftlIigDGVnk8eZ7n37AwqbK6GSCJCiDkqnMkFr-Tag7hARdDhp_RA737lW0_HRg&dbm_d=AKAmf-D9XpbTZpIlcozMdCPxZp1HNYAR3yTZQLIKx0-Au9qQwYyR0LDpxEk54Pck7HTnI3T007YtFIOS0h4sdfODpH6C5QqGo1TBWwD32IuhkGYDFNxb3nqICWTCP4R43gGvXUin7I3M0Q9-Ak7KNr6OJs76gJk66qbacvvhMRAPsM6WzLpPW7nmTaz-xQLfPW0JILCn1li7a9FkRyxvqjPuaGXG58nt2hK_9myPy4qUCuUkRdBgUdZsJqv-UwCCKMW-nNZj-DhBqh6pQrZUEROs3G0hVsNcCUaClER2jtgjTxrzmiRtKmG3V7eFdu1txZ59lERy4yeIElXCUJ1yEYuvpO5eZBNXEcve4Ksx-MMB6HQ_pTauQy5U_c6iYzpf4_Sl6N-Q-ib5nTdP6qNSVf1SFo-FUiJFDCIpjf6fnkOIYHhBLnNSjcumer8ja9FmXi09z63voxregiXkspdHGGqCtrTCaNaT8YWLRY23PY86kKwMT0zOJtRzPFPtlSl8SH6swKZHAiN1okh4ogUKZhZguApSmJGdpnObNwJQCdD-PGojpwiyLGh9Qn2K96V5bGl1Ba1NODe1pPaZnHJkbW4IIoGfaQjHAMHiGPnRASM66NjW9YGFwMct-8oYPAbWu4ZQjxU0xNA5EzO1X2bPsj5zl__LJN3XwTeKHPQrIvgLhbcBYB6ngm1-Bvbn2wo_TacfZOo2eI9qmYWVzBOydpEQFNdUKRBzq4y5PgBlmiXAiXFIEFuCXiJBAjYRzJJwxqqfcmp_Ky-fMHqmWKv49VuPoO-75V3bmIWwsSHNO1_tnAostx1ozfe6olKh5Y549HQQC_hE6lq0uqxHOG9d0MCe-YOlwQRHo210ygKLh5Iggcu2JQHld-wIQPz0Pv9_PLKEui7CZBCWNdLNOnPIVd3D06vXcvWgDiO8pjj47wfG_6vlpgWXURwucU_ToObSIT0rGafSh3GXilpAe2BNbCWcloxTvDOe363VkhINTph3NOcgRKjW-o18zOXhtyWE5Lt30_iFauld7Q0ToLe-acALCNQkIpmSp-fpz54-lPRZbjlNl4j4Rha4f53yq-3C1BQ-pIKLXNmURY3D_2x9zfcr8xJrtPx3oo1YvcALqX8AiKM4N1tGLBg9gMwZbtdGPTBO11X1lR9QUhmH0SvKVJquamA2C9-95BiGtidZWiNIRRfPQnDDjNCURW62kbZ0ld7bhmt9b3iPIwZZVycXNtPEGLk3Z2fGgkDWC2GfCDzjNwbRwG6VFy-CuOpsvHOfNit4Wsb620lTe9O05oUuEP88MDnFB07s_ineatHf_9pgaiTPKor3sceCvEehNs6qvlW74k1s8Fs3iEysSwhgMaSMtio0lf-52SQ0ancu50MmvhWeWhcCn2MHZBXinwYDnFovRdD1ckXuWLHEARqmoXmbAum3Ff_8CedpQ5YiEmMOZvrAn2JKSVdr1j2pr3wH5-x2deKZbcgpr7EduaIqPOpQdTp5KaSVNrODK0-0Y5CAeCCsjSxFtDdTwa1w1wKsqA45vLKdFE3Te-eKZBU58MbEfYWiq2xaLnUId-XEvjN7925cMirgZsov4JamvQjJ6gwEiA6B8aB2B7rd6lk7XcB2G8y6OqGNdrKRqYF16bh6mt_sROZwyULobVeBvM1YqMC_c_FnfDT_zrqMAAdcJqTBMPPLx4gYOPGOXwhDx5sHnQ3ILy2rN7Q3qalMMsOfo7uf_GlZnk4N5wffLvJky0vb88Oo1nghCCgLMjrXsQNvClR3EpVBvbgIuFC-q8hzp0Wl21iSx2EBR89kM1u1gZYf2pt8BbgL2nZzarw8ym42_fVle9S8Jdn5pK7DzC486WbCSqfa6v-zestETm43Sy6aNh_814q3MMXHfeVsj1HXlnfdv6gdvgh14HK3uCEpSBvF1bjeYAoMEqaSutySMqJ74g5Ru-WJeuti9jUWiSe8W0zyqiHWcqnND8wd5hZPahkFnGf9I7oTX2JnNOzVi8GZoz3q5eraog-9Qc5u4IyIlvzpAbG9B_I6UGbJk-EWUKleQYBIpBsWjxPUQuJFyqRI1MOORuU5alaivSpihSg-7KBLPkiBM3Z-nMG-cJAf8IAHd8vrTs4y34VA0h9nAt8eZAl9NZ0VcroDHAQoprmfWBQzbP13VPf1EmMgaa8vbJolMkWLCJEnvAu-wX7XOfkyTeY8HG4HpIaDfR_BD0w4UrHY9mM9j7Ak4wR8-KLoaI9O9Wrso0Obuec7cC99w00gjNuMzYiWO3rJTsvlvO9DNixS2LTHpKpYZoMzBc4_iHgZiV4vvwvgv97KreR7d_6dTs8rqD9uO7jE3IwbQTPhROwXQOCOGBSq0q_Kcv1Ti9r_bkMF7lolUsKKHP_z_qTpXGswWeky8oZ3l0s8KEDW-yIRCJmMgkA8RFpjJwUcYJaXUHcQ7rCMSQS8KZPT8KBWX5yRfC04CC_stc2M_eiCtQJawoTN74wVKd7lLnlElIxnkFdInFEXzY6zvsZQYcxQJbQUQo5GUpyoAXSuBP0RPYAQMfpAVDqt9nz0580qp_7ennoiM8_7_kOkmRnVW6GR54MHZHJRhJ8weEBO3NJ4iUdXsCocBSELq6Ospb7udhNbGnpa3-_UYYvqacYx4SiP2v4p5yq4_mllqcnDgHKkSoyyU1WnguGjaZsuucCbNYT1ieC-1hj85rgs2XEbaFc3D1auNPSMrWcVx6AS7BSbdk7tvwSGW2JLzLACR7iSIMloQi-ytFW_DnT4XAMTkORO7ve5c5HAiy6tPq34fYfdIjw-LVCT2vVuSNcnfOtjUNwHVJ6P8D7DCp1gEx2PUPpx4tkxziiYQtD5apipIOxPWsi-plwUxUPH-d_VYNqV3X6Z3kX0L9dv7uLcOy6R3Xql5zcKL-wM_fPKhnIA1plW_wniuvjXPI3Rx935pFkqIv3pvvyAzehydQux_fjGljUjQRA-eFX6yurtAlPMu9JrO0vj7C78tOhqFTISQ9vkon10Vb93VK_xI62WXszIuNEwT3lH7Tdc3T3OOVnyYC8NJ1JXe_-GHhMI0ihXA4zZw_0t-nCn9JbhSV4J9sFdxhqcR0ZjsBaRBGfT_MQ47eVOSuTB6KjWV425t9eIT2qLtk8GU-jhtH8j49sJDeYCNrwC3BYfVVOUg8DLV1pQ0q0TQD_tBOOeCuPuEbMYF8AfToNaEm3pyXV621MnjB2dwMQHoGB8dX414uB_9ePedtSZUd6i_4xkPcR5PKBvLsJMg8r-n3KHZ5wzjTegA-KtF2sHm1haURi3vdEFJX3kklyODtikVKaiQq8&cid=CAASJeRo545Yv6DvuKMPZw_IWWKMvRbX6rBZvVnHbVlxCxDbBdo6Qik&rfl=1%2Chttps%253A%252F%252Fleisurelylifestyle.com%252F%240

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

801c1c7db97ec7d1c003d025c099c423cd55b98560f17e261ef1d49a5dbe93aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36544
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E942 42 B
107 B 484ms
181ms Image
image/gif 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A-Sb8afBcs-V06f6mwdto6yYUcBkqkrckvqnlVa8rNvx-CUM2uy1isVa55yF9s7IgWTWQS_ewwJ0yh9hM-2_9hR3k39-QZdwH-I4JiC3mkZHEoOAY

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame E942 3 KB
1 KB 171ms
168ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:35:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3400
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:35:07 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame E942 17 KB
7 KB 173ms
169ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:35:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3400
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:35:07 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame E942 0
0 533ms
229ms Image
text/html 142.251.10.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRCCJRO22UXp5vWGCWhPbPxjrdeJn5T79w6aIcGoaOtsNbBM1KQ-_651E7R0aBmqvl8lB4aRFEe2wBtNErR81k8PstyhQ
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.10.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f147.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E942 141 KB
44 KB 539ms
236ms Script
text/javascript 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 05:31:47 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame EA64 624 B
297 B 487ms
203ms Document
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-f5AEQn5zmARi0toXPATAB&v=APEucNU8eB2Hn7xA72f5ER_-CpUx7xuLwi4zANSDBiEGs007bBPrI1oYNOQpETgfyTM9mj-rLbeXikGnA6NZ84p2SLGeSYL8cA

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 05:31:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 302A 94 KB
36 KB 521ms
237ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DorFZ9cajGTJnFpulaT9PpqHSXcidraOljD43h2i7GNN9MA07qw9VBVjPSs5E82FboRJmDqO9RnHzO7TMPRNtFjKSYVLkQ19369tzL7fDNGgPwrahzZSrAttQ1bX2yd_UAPfvzlCWu9bFDeetBLqADOH9Agw&dbm_d=AKAmf-CV7pcKfmUYJxYsPRCMLzwgzkrr5xxDqV5IlYvK5CrMTr71D5W18zyh_EwlqSjjFs69KwHx7DAXXiezyYmbJJlo-28TpsWso7Rii4agujV8BrC4Gkgqt9_4LHv3xqhiclf5abmVJzHbWQAH6YzIkNxFd9Cv8vu7b4pyXX97xILdaYAMv-J7pp2fIPqC7bND_xFbUnB5tkEIgWTNJ0HFtj6CU6NnTNdrVPNYi6g0lC7iqIlBuhIqhnROqmoEVDe4h7wCpJC7mNUzS1iqlb2gevvt2e-vWuMgp87s-wBuAl4lmiCeB3pFR_j5aha1PnfjaXKVqmb6xyAdKOdeQaojAC7pKrlHP8TXRARPZsy_-Gdqb4tl6o_3Qw7WprSC6-uQJROp1WeppbLvuTkpXk5z7heOP7BDCgCIskhPsCLbl1p62jXVBYZFWhlGSZxd6mhGIJXd37NreCjPnLhy6ZXGesjzyqJ302YwB6w6J9xMg_5h2QVp7B8_d50GpnFU8pYtg1KIg8mR3DHie0UuSr5bwoXheWcN8hkOykPIHxCshglFS31WcfJuA-pfffYWlMp3w0dRcV_-r5Q4OkNdhfFiEB-koRM8Mj6qSUB6F70sRBSIsVdiaRT0x2-RfIHVNYUg9rR9EQDGBevT0ZEaEU_K1xOjwtfWfX2M-n_vUT3Lm_z-N6JSwZ6fTyyThkH-7mye4h1yUvHMIrsIxotQnUMK9aP086bba8d66B5KoFZMMWswUW79dC2S3cbd3aYGDJ6XEdXLURuG9-VzxZQj7HndlVHNiXqT-emM7bpp7g8CudQYIadB1KlTsqyzhYmJ_taH5Dr94kFXX1QMWhJrLSRqEuw8il8JQkcLot0UKo2vtdstkJoscUi7ovj0futscjmgTZNXCHS_yN20rDx8OCbFG7kqPL01t6MyyVjJQCMvmOw_VhBeTM7G9lcOZokigtxLmRs0tJ6KFcjKoQ1JtNzydHeyjFCpW5mFSO9kGZh0u6HMqswVX1t46SJ-IFTG1wznsFqLiIKDWjgHRMN07onvSVew11ciWFKHYbnRNPyKSt8-Zwr5Fhs7jmS4yqqD23WfgpO00dUMgSBhC85NqY0IhtvP2wnpRqIPqVR6bLXvDBbtLXXR4pYsJQUJH2ZhsTnXP-gpxxODuGwY_Kn7uz59UwHLJV7pJbd874xzyhbTBJOJayeVpyq_u9SFNstS8ifQmmcXUniXjjp17HGyU8wPP3nks4aRYmHxv9-csF4-1XDApAKTX5mu4Uf5vRKx8XCjhMxP9utGM677Fvz8vSibsU_WDgIcrxl_RbQtLXb6RM5A2N-SP5xYnO4mHyWRH7mbM1jawvdU8IQEvn8cuwqCrOxSX07MEzpcJLFJlSYlCkGFQljh0EEtIazUAllGRU89LE_gPOO00t_wqIVYqTzNUgLRGkOsjiH4d47bFBJXWP2I-V0_CnzyrDSxQQvVI1UGgYdq2d2zu9ZzH0kB7hUGGKKh6_1n3mNJ24ls4bMKMF5fdRO_sv-dxJUghjlwFH-mE8gLNGunkw0u_zXDQN_Hw25XiRSgupOX1VmSyJlvgG1fY_GEL0DGD6OTh3JxnMB1AN8Maktqb6wa4hUXf0yg1D4vztRMZF77FKd3lWGSMYRPXzNubMk7itn_H_8CLbiLkGP4T-m8Bl7VRmP1R5t7ynLl9xuHHydFtpDne1r9SgYXKAm8TBbsBHb0ShmtXoGvJthm-IXW2yCItsWiaHG3d00FJj5a8c58_v9kQMVMjjq10gWn5-izNVg-2DvduKonyQXkQTy1HRtWKm41Hf6PIhmtHE6mfpA7gdQBhVm5YScAYXf-RfdRT-URYtnkdGwhDULx6DkBTti-qtU2RhFB1zlqbKwoJtBA0DHU1kTajkA50GX0GsXTw4T6GSzq9-PqR8_ilvS9xFwAnOOgQdjBNasOQmKdird1Qli6N703ELCGeSToeeuZvLNUh5FU3JhYW0wrnQvvImnrYd-rQanK2nWXNDTzFkVRJvbfO7fNljWL9oVCTaHLyEmKqEK_f8CzCg7HyBp_-ai8AB01xUGwL6pdaB8Qh8Ycp22_ZHkCS94vomaDr6FTg5dUGsWAupq-JS6knVytNKny69mdFiVc97dXBPKDWwUfqVZyZSMr2VNMeVxcjuUonZvVmn0DofzzeWuCAec0m7xEkfKMFX5ToJG8CmqaLzEmDfmzhwz9qM3t8E3AZyEWeRsPtbx5NYAtF09-6DkklTAho1_J2wyLwbBLitatsLTeM0sEgvYrqr6ziiIZ7hAzq0JVfP4MQx4DiG8W-wK_cdlVXpWkiAJNMGh0CyQtvsmTflJIl2t1Qcg1aNeihpFJ2sG4PPf3VMOI1enDu_wGuIMtxhrkRsE6b64jWFrt78dttBW8aKUAMV3Q9nSlz0OhrENqk5aLcwD1EZrqecxsnjlDhismH6tU0Mvd7WLuCOq1C4IDfqRXt5QzWS7WS5MMGA7LSKox8AB9uBdhg23nJ6zzjNk3elE5Kdrs4xYTZ663SpkEuor45dMtfUM5f88dtF9Y9KetVJLqWSk_JxniMseUlpbN5lRGYrtR4RLn2u1saJEfkwDmt51JzJgien9jj4cgkK0S0JTDETL_OPI2Dq9TwfRcN3Sk_W8DydHptuqTLKpq5kMDzhXYE6ywzdaM6BZ2RElmmU41ScBVFpcIUEmfbKOdAeYg_roMcHMhV9q2q1kVvb0M3NCxjZbec93qJpBeABtgGYbyteF_qejXhk5nrF2t-S8tP8ZwFeWH1MUU5fUbmYkmUg5Me0ljdyBc-ym6DFfZYr5s-DHpmIkBeylwiUb7TjWM4jgnLNxbRzbevyuEi-gFubSSnpFAey7CYESQHW3mTuefGlzplc6cAvplgnvd2L4ntVEiR2fEEfkiKeQRlhD4qnNq5-kMnMxjlF3xh2YIwJSQFCHxmlyoZDUHkMryXJuSAeUAs8qNzirhGvtYom-gsmSKw7lRvjUJh8qpnpJl4AzwsUPNvtZ3EOR-qtqJLHBn_F3-JESEhQ3Z6iylKmR-vdQPlDoiME3xb--X0xb0eWygM5xOGcJIwfGaFSbjADp4tSqoT53pk3NelfykD9PikGokJLomyPb-fPu6TBaqrv_1GoLfP5BC_FhUvPcbNKYnl9xAbgAdKFkBFaDIxAWsewLXP3t68xLmthi6qF04CN71NwqbQXPMPlEIyELUGn418Gi_1XugnuU2Nj4QnjjYhJIt5gtChBCUNljwRIse560h5fTWfcZ55KwCWx0BrjZETpyxB-c8We2mKkD426HGLHVE_wjf__A&cid=CAASJeRozUIFCUUjx61FNetGpImfms-04lRm99bIr07dLH1cScqDgmU&rfl=1%2Chttps%253A%252F%252Fleisurelylifestyle.com%252F%240

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6794c1bd1893a9f22b5a0a97d25c02aa6027be6aedfc245399df3e815f450fce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37024
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 302A 42 B
63 B 572ms
280ms Image
image/gif 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CxmcqVrkpUjchugkzjjmhukw5hvUimlvJt8TAcXBwFoNNLJYZXbUsuThLbY3eNGfaRp-ilg97j-6lvNZydWl9aTxRMJX4ae2gv1wX1jxs8j1fed6M

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 302A 3 KB
1 KB 198ms
195ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:35:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3400
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:35:07 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 302A 17 KB
7 KB 170ms
168ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:35:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3400
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:35:07 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 302A 0
0 516ms
223ms Image
text/html 142.251.10.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTKnZ3gzrkIw64LwiuKWWLKDgTc3r9Q9yHpoMLm5uKMPEWa9VYzQ6rHNvyBfFptEsBOxwhouvFfxcx5SSjmF1KGyd3D1Q
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f147.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 302A 141 KB
44 KB 482ms
193ms Script
text/javascript 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 05:31:47 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame ED89
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM9BuxVf7BXTGtpNRlBuBZg&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM9BuxVf7BXTGtpNRlBuBZg&google_cver=1&C=1

43 B
842 B

611ms
550ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM9BuxVf7BXTGtpNRlBuBZg&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLvOowEQhI2rARiysIjRATAB&v=APEucNWY95ihW-lqootuqEqiyJK6T6o1ms8vOI2CvVsTHZNeAuG4Ybo9pczNj40cZgOW7JsH6QACn1m-JSBUnemdavHJ2dPx9Q
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray: 74964249cd9017cd-MEL
pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BuJaYd%2Fuofzh8q2Qj1c%2Fj71lvstSWVWdMSiHHcJSl%2BDRwtrlNqp2DSlIEWTd3eY0WEiw2hY39Se6HGdFb8oh6EefYdiF2FltoNwmkmT4DDHGl6iq4tZ6exClo2gNw2q0ukmXfB0ymlRYBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KrTLofgoCaYg6AWmZRXKxeegyVjB%2B9ON8BV%2B%2FvBHBsivlClG%2F%2BQXdCWRqYGkNIP4dd7QI2cbl1N1E5YzPPTDClc7cBHJGNyxhp9CWMxdlpdIRg7iroDOf4AgG2MnPt%2FakxRJB0eE6V5wKw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEM9BuxVf7BXTGtpNRlBuBZg&google_cver=1&C=1
cache-control: no-cache
cf-ray: 749642471ab15a85-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame ED89
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yx7EQ.9koZaAzakQEtVTuQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2

43 B
846 B

330ms
324ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLvOowEQhI2rARiysIjRATAB&v=APEucNWY95ihW-lqootuqEqiyJK6T6o1ms8vOI2CvVsTHZNeAuG4Ybo9pczNj40cZgOW7JsH6QACn1m-JSBUnemdavHJ2dPx9Q
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray: 7496424ebdcb17cd-MEL
pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mvxsLcHnKiGe8O9mSp%2Fz3%2BqKXeMHtXcf2ISkAzY9Rwnzz92nTJnRumDs5BScLEC8ZeyVqiWCXuKHShowo3CKZnwMLPOcS7OGA5g2DIUzQxQjPHm6%2Fm77qhb41%2B0xhgxPWVSCwkDxyXF8gg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame ED89
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEC-0idJLwg5_D53O33VkwNk&google_cver=1

43 B
1020 B

270ms
239ms

Image
image/gif

104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEC-0idJLwg5_D53O33VkwNk&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLvOowEQhI2rARiysIjRATAB&v=APEucNWY95ihW-lqootuqEqiyJK6T6o1ms8vOI2CvVsTHZNeAuG4Ybo9pczNj40cZgOW7JsH6QACn1m-JSBUnemdavHJ2dPx9Q

Protocol

HTTP/1.1

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:47 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 5c43de5e-e3cc-4c9f-8a41-b09f1155be58
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEC-0idJLwg5_D53O33VkwNk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame ED89
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D

170 B
188 B

423ms
187ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D

Requested by

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:47 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: e6bda111-40e3-4c48-b4c7-adda38a37f60
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6C0A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOYO4yD_V0GLN8gEL_eA6UY&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOYO4yD_V0GLN8gEL_eA6UY&google_cver=1&C=1

43 B
843 B

410ms
347ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOYO4yD_V0GLN8gEL_eA6UY&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-f5AEQn5zmARiNqoXPATAB&v=APEucNUBRULNjaxnuFFc9qREyO1ju40jpstB0Ize3LRJtkjz03w3ARByV1IZykg0H7r-ibyy4-ZbT5mhPNYJBltmhLtDORD21g
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray: 74964249cd9617cd-MEL
pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FZnj8EwRI%2BCFdQ2gHoREx1s32OngmOPYcS2H6bX2nsOU51SjutfZFjBBl7tCdT1pYeV3FDIwjwtzQK%2FNyHlJLMMpwt7sKwuK8IwH5cmPwcTN044DQNucfv%2BP35bANRA4nKS3Q3sJjZfnqQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8igIZ4uuqyQMDm1Emf%2Bv6VTaKHg%2Bta5YGPou%2BABlwXcpbiBJQaugXwL9Mb5c8wN7tDgxNZQ6ydMbPh%2Bex8nYohiuscZt4XiXnZupbuGzuhBihfP3atuykCkUSr1r%2FiBTJu0H78Of20BvEw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEOYO4yD_V0GLN8gEL_eA6UY&google_cver=1&C=1
cache-control: no-cache
cf-ray: 749642471ab45a85-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6C0A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yx7EQ.9koZaAzakQEtVTuQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2

43 B
843 B

339ms
336ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-f5AEQn5zmARiNqoXPATAB&v=APEucNUBRULNjaxnuFFc9qREyO1ju40jpstB0Ize3LRJtkjz03w3ARByV1IZykg0H7r-ibyy4-ZbT5mhPNYJBltmhLtDORD21g
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray: 7496424dabfb17cd-MEL
pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xchBZ0iZBMIa%2FQFXJAxJYhAPIxXgCyHfNLe2eaSFWa28m6pmlbfXMoAfYSM2krrl7n1vEWV9Ec4WXpQX3AogbJD8EgvUb8Chq4wQ2KTRzpLZOmFR%2BFdsFqJDmD1TJlr%2BPbCncBDtWKT30Q%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 6C0A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEC-0idJLwg5_D53O33VkwNk&google_cver=1

43 B
1020 B

260ms
230ms

Image
image/gif

104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEC-0idJLwg5_D53O33VkwNk&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-f5AEQn5zmARiNqoXPATAB&v=APEucNUBRULNjaxnuFFc9qREyO1ju40jpstB0Ize3LRJtkjz03w3ARByV1IZykg0H7r-ibyy4-ZbT5mhPNYJBltmhLtDORD21g

Protocol

HTTP/1.1

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:47 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 9971a01b-72cb-4e46-9afe-4e35e3ef570f
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEC-0idJLwg5_D53O33VkwNk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6C0A
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D

170 B
188 B

443ms
193ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D

Requested by

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:47 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 42230087-7bc9-4844-a7d5-2d954280af44
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame DB58
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOYO4yD_V0GLN8gEL_eA6UY&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOYO4yD_V0GLN8gEL_eA6UY&google_cver=1&C=1

43 B
842 B

358ms
357ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOYO4yD_V0GLN8gEL_eA6UY&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJiByQEQu7zuARi-05PTATAB&v=APEucNWQ9quRMg_h9RwJvn5fV9-UK3rVEY-r9tIAzqlWBYd2lqFK9aVeksdewvxdsOfDLqm9pLdOxgb53TKBpdW4F2MUjSlgMw
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray: 7496424a2e3717cd-MEL
pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dmruNwj%2B64UKutbMbhDF2R7U7TotVUKAlGnKugSpawUsXprRMw0b851kPCZl6nAjjHpNTrVtSSw5o%2FaGyqawr78ddTbcDrC2Yd2o6xPiUoknl%2Frnth3V%2BJ1FGxoL3GD8rhNZlvthp6S3xw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZTQ9MvMAfS0QjhpfXtZIDDpIE5sMCdmM%2FKgBiLa8phsYFEC4%2FplWAEznZfjnr6BKk1xckcwONC4bOSdUYE%2BFBMvSNPA%2Fsimz%2BGVXA6XZ46imfTtizig%2FpHGxOoD8nQ%2BVQQk%2Fax7IpdIOcA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEOYO4yD_V0GLN8gEL_eA6UY&google_cver=1&C=1
cache-control: no-cache
cf-ray: 749642471ab85a85-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame DB58
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yx7EQ.9koZaAzakQEtVTuQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2

43 B
841 B

340ms
334ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJiByQEQu7zuARi-05PTATAB&v=APEucNWQ9quRMg_h9RwJvn5fV9-UK3rVEY-r9tIAzqlWBYd2lqFK9aVeksdewvxdsOfDLqm9pLdOxgb53TKBpdW4F2MUjSlgMw
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray: 7496424ebdcf17cd-MEL
pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AnF7RGLdr6SiB5DQwsLsFcbcCXwxhk4JS%2F5kJm0HdkifbiAZFKJjd6sCZCT7wS2E33j1XbnVTt2NHrdgxNFG4yFhNoZAEMzTpahA1UeBiqz7WAFjTXdVPZRXmwt3JB3RD0IiTgBbGKnTQg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame DB58
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEC-0idJLwg5_D53O33VkwNk&google_cver=1

43 B
1020 B

259ms
228ms

Image
image/gif

104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEC-0idJLwg5_D53O33VkwNk&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJiByQEQu7zuARi-05PTATAB&v=APEucNWQ9quRMg_h9RwJvn5fV9-UK3rVEY-r9tIAzqlWBYd2lqFK9aVeksdewvxdsOfDLqm9pLdOxgb53TKBpdW4F2MUjSlgMw

Protocol

HTTP/1.1

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:47 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 051ec8b4-e8bb-4ec7-bb2e-7d77b9e9e578
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEC-0idJLwg5_D53O33VkwNk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DB58
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D

170 B
188 B

444ms
195ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D

Requested by

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:47 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 408dc425-060c-475f-8ce7-c0e0e59cf391
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 7B72
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOYO4yD_V0GLN8gEL_eA6UY&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOYO4yD_V0GLN8gEL_eA6UY&google_cver=1&C=1

43 B
844 B

618ms
556ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOYO4yD_V0GLN8gEL_eA6UY&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COjKmNsCEJGanYADGOim4NEBMAE&v=APEucNVGws9fOiFjzFgRdR3xQMbtC6Ta3iT-TD6rWSSZ__hkySbnaCfwHXaDsFfu_fVwdcqxwwoqyEQM_J0P-5SJwkDkYJ-llg
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray: 74964249cd9217cd-MEL
pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SpeEcmF62RxUxs%2BCGDw6jPYjMX3WSyClGqh5h2ATrIMdxT%2FWQmeJgy0%2Fmrvp22iAZp9kZqPOT5m9hU5Q86z73IiBy11eEdGEq2m8XE6Ad089OUPK3Kh8bsl88HJ%2F6rGxX45wkka6sQfnnw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AWWVbe94sytpt%2BoSh5d47zY2E8cbkAFimcvS7izuiG2cqe%2FyLIEbcMBBL4sFsBlUPyd96emhxPzuGWLctaT1HKGwmt5IAAV8QPeWFm%2BD41rbohYli8NdkOFrn1nwUFX5yWCtoS1kY3chzQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEOYO4yD_V0GLN8gEL_eA6UY&google_cver=1&C=1
cache-control: no-cache
cf-ray: 749642471ab65a85-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 7B72
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yx7EQ.9koZaAzakQEtVTuQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2

43 B
840 B

559ms
558ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COjKmNsCEJGanYADGOim4NEBMAE&v=APEucNVGws9fOiFjzFgRdR3xQMbtC6Ta3iT-TD6rWSSZ__hkySbnaCfwHXaDsFfu_fVwdcqxwwoqyEQM_J0P-5SJwkDkYJ-llg
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray: 7496424dcc1c17cd-MEL
pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WUTLUkVHfGkKUMOvVyEc1le2EA2RJnhZZvm3%2FWU2xW1vn6MEOdEjqnY1csdRnO0IRi3QeFArQ1egX%2Bgl2uc1gFa2lyMCrFFQStHQAVV7Rhv1ni63wR7e8FA5xTFdUeBLpgspG84oxjiL6A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 7B72
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEP5b7x1QIiybJqT6-v2HpMU&google_cver=1

43 B
1020 B

259ms
229ms

Image
image/gif

104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEP5b7x1QIiybJqT6-v2HpMU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COjKmNsCEJGanYADGOim4NEBMAE&v=APEucNVGws9fOiFjzFgRdR3xQMbtC6Ta3iT-TD6rWSSZ__hkySbnaCfwHXaDsFfu_fVwdcqxwwoqyEQM_J0P-5SJwkDkYJ-llg

Protocol

HTTP/1.1

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:47 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 0789e503-9f1f-465b-a913-5cc2cb7fecc1
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEP5b7x1QIiybJqT6-v2HpMU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7B72
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D

170 B
188 B

439ms
190ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D

Requested by

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:47 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 591f0164-72b3-4480-a4d9-49bb3d0047e5
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 41F1 15 KB
16 KB 479ms
178ms Font
font/woff2 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://leisurelylifestyle.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 21:07:02 GMT
x-content-type-options: nosniff
age: 289485
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Sep 2023 21:07:02 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 41F1 15 KB
15 KB 491ms
191ms Font
font/woff2 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://leisurelylifestyle.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 11:13:09 GMT
x-content-type-options: nosniff
age: 152318
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 10 Sep 2023 11:13:09 GMT

GET
H3 200 container.html Show response
379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 73F0 6 KB
3 KB 170ms
168ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202205091138/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://leisurelylifestyle.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 05:31:45 GMT
expires: Tue, 12 Sep 2023 05:31:45 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1102537/64448508/ Frame 0DD0 234 KB
70 KB 341ms
341ms Script
application/javascript 54.92.10.205
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1102537/64448508/skeleton.js
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.92.10.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-92-10-205.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 85f82ad60c691b6e9cefa6fc1599d6b2aa7f6bb5086666105f729f84c33a5472

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 0DD0 106 KB
38 KB 566ms
180ms Script
text/javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Origin: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 02:37:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10474
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 13 Sep 2022 02:37:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/elements/html/ Frame 0DD0 8 KB
3 KB 396ms
267ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C1n30PS_VhlLlvX77NiXbU6lWdzzZwiujZZAov0t3s4Pkii3eq6PsZBK9fUneBxjtkR1p_ZWj5Rvyn-t1d7xi3ApZgkdtJGl0hPzHT5Fn91iII8E12CSCqIwKPv1jphYjOeY7NYf7LXHE4WvaaQrQQsjY9KQ&dbm_d=AKAmf-CJK1947dhMb6IBCHZSJ3t58TIZuawGgiXpKi2585tsMkJVQw_iSRBqPANDuZkS5_SpLlGpz8K7ttHwUNiIRJA4cUW09N6Zyqy6TsmwCYWDvaIGnY8HYAN-4l8WOMd-1x_NmnLJs7GTNRS_whhMHW4iDCuf9oUh7fAdZSx_iwwRZgKfABuvjayeBqqbrfLCRHJtMQjV975DQvOpyHhhrlf9jhTnFc1VFv4-73ZkJDZgp8jrpac4sk8fTa_gpGiLUIOECOhRvJLmoqj0yqcQ9xUOZcpeQT_vGpeRxnwt0-A6dcySdqcpubSc22LdcgY3Nm8h8C0YMJahv2JyM5VBHETi_lzrO0yhI_3v7FcPj6gnEjzW2lYwcEZVOr3fXP-C-3Pc9NTPSgLikyIK4WNsmpM5kGylmB--xGkIu9n1JfS4om9mkBjjJaLfLSvJw0-TK61G_dhqHLaBH1e6oDfH-tltFE9kNf92hPPMxioAxCMNwhbgtYy3UFO_ATQgngrNYukdjzf920pCjmC1UwZi-9XqVBEYlY6p6V_MmTf0zt6wPWgtp-qAhaHR186CwvMi4LSuDLKzg8D4ajR6iHNQ7tnPfgCN9rb4UsAmgu8BW97ibSVPgVy1nr-Pzq5ElXI05qvgxdm3Y7hGskIy8TrWBcluIJF_OsJDvFoz-C7O5qMpg8IuzLlEM445dhWQVqknjKUNZWr24rqBzQLxgL3l3a2Rr4WS18kfRdj-VVox5l5Sk7lSSc3Fn2CviVhISBumMVcXA1D5QBIpbkWJg1-eaWfLnZK5jD0r8gYB1eQ_XDpK4iq2m4kzZMaiOFPgqd3pPLttNnfsIaV5OuaaEiLsvphSI3QdWfwfev_Tyet-bqjoLfrOEaThlulWfMV0-wAuJxBoKHTMygjhu6U4GUA5mUPIpi55oMiNk_9RV2mnq3xZtvYl1zWl8CQ_xJVSbh-jZSnBqSf8_DWDTr0oOlN50W7Wzzk1K9WKW9UwhcSsr7E0M-dzVUvDIVZvJbm5rAV8vtPWXIpS0gVnegU1FcmQ7RZvjHQCx6EXqwKY82UkDQNBnF_H1Q3cm1JKU42JIbXzY5JYZXXHtFqPZ9L95ccYAd8VKbTsOuedgfN9hgjPOwfadWIbDliFgokcz0zIpK-ZUaPfDoGbPAaaBTgweOR-kF28wBlaOdI95_Q6IypVWDrLVIba9OQuV7enPqBOgVPl6mZ1eBwtTpd2XhVQLxWMo9s_6oo3hQJKCSGAsmly47fZv50dtU9JAdXGU0_RE_U1t163rXEkfrWdN_T5DNueG9q39CxRp1Bd3cegAFFYvrX_cpTU4XlmkShXSzZS_-hTpHw8CA0UleT0jdd7_-clr6w-qkh5vl-mlrEEq4nQj05f-z6cY5WaCWLti_B8wQSL8Z2ed84Uo_Vcc3D1NRbnyKAZ_DqxW9HExlpYgLMOryIZ-hIbsepBPZX_VGE7sAZGOuxNOjInl3K772ddr7GDZKeAF2C6QB7Mo9vG2sTAB70AfcNRkj7qJcAsjpH3wurYL7YtWWPZAFkJWlpgh95Fzy8sCMtm5IY8VvihA-MkuvNlIECRmQwSy9JJxisZ4r0Q0S44P3JXgTWyT_yvZrpyg2TEYOXdN3usxTDEP079Ss2n0_CrkPl1oK40i5hi3Yw6oHVSs4BCnprH3x9DzaKX2wdyVUgAxqmKxyS7j2s3jALTbD26iejIZGs-MTvbvwf7k-6-OqooTgmbC1QdkaL0BuSqMFf8PwAzbTwOOzKcWm9rdBtPn134gisdddxaqgZeNbZsQJMEMGAC1mqQiruEZBGlIemNEwh8d99K8_Ax2JiTllbmSDAYNs2F1P72K4PQWUszARLQ3U-XdxL31ZnXS37zQpqkEnk6xm3p1S7kMTNhl_Xk3oq0No7iNG_7DHCwSInxEMLssAXHqn-YjCqTCOP6JkPEphMRxWRc9Xhzhm2HVlZVkeCK1rY1ILQkZ-1tjTF_dMvXroL8PN3iiaKAOU2Fsvdqw-BszIpG2ec2QhiiI1rpeE1OK0Al1cChQUze6KCdRz6O4zjyx614rgOBuTCLc1_wTIC4WryUUCpmi6ozj7lDF7JhNbJQVLDN6vuCTvkCFFhvjKzjzYknr-ordHfeR6ELEwpFhn_zqDf60ALaQHxHHfcmla1lI7Cw0Ua0EX3QDuUbn0Ds0pUzDT1DIWRTuXp5x_NC4qICYCOlIqScKh9IqvdqiNwzkPdkNKvV3Acy-U3QpyxXa44GaVqhLQzSPgP4DNEQgX9zoRGsqYoSUsKR57WLB5idyqyr35yVw8VoCoqIt-Ty6PCYsthrZE8VpXkFH2PjKiHaoxW-YVZT8GYoGMH2IqrOhS5UoqfR6A6kelpzdv3n3tGGhRzVbOW779bQ3zNWsVwhSfLjAy1JvMla4Q4wcVfyZT2yCZ996p7SL2r9kn1vZh5qaKa1rWnOZbtkW29xttvCWdAANND1UkDjYd6x1wshlXXQeKkifnSCVakyj3to___P0B6NuHxDC2hGlZ4TRnBy9lMv0b3zktUNnFPVmGinTegg7e7TzQ9Vka5pilAorBA4-vdOr-e9mJJuge_oBJ1K-LHqXyHuwNvw9w7gF-Yg3a7xAEYIZd-Hw-JSG1HK-1osiw3Giw3rC6if2Hob0M5TVkBAMDp7Tvk3VGakQAbnySt6CmnO-Yd5fZJkCDcWYDkzPHPnfonHfy7eB-WucV1obkiPYpC1Go1kCZZtj5C2MRKoofJpApQZ8JuSY9XkhCtJuKLdA42-hIase43VYqMNZ1_5ww4rJcsESs1z6QCFPd7bwTq18I3EjRBes9Hsf-_pW5QIF-AKShtON9Q39iOy_mdJxgIVuN-cPI7qqDt3DN1qxG6YgGdVaRC-WyPZXTldB0GqUedil2b_1bVFguMmj2Gv-4cv9AWVWWmHlkaRXPVRLTV2gdDuc87IAEwP-TWcaRzTNc3JrwfPw22_yZWzDo1ACqPG_ZZDrCA22r4OnN3q-XWxUqdY-fMoCwcs-qJisZY_xslVB5Pi_gNMXMw0urvbMvTg3kFqjFFIw1I_4hoQV_vsvN1Sn87DU_umiAUKE0NlJs1e2jbU2U5Z44m_rIinWMKlSrXkWP3WeIhrc-c1tJThC1IE9O71PJdJJen8vqj3q20Z26VG5iBKK_B5NqC6_hRtAhWl7mkwOdWDmjbQFVp9NElZAtYtAZOyepDN0r_t3GbhQKJn8ADmif0Lvq_pCY6hJRe6oU4iUUhomfGGbNHR_PS6Cmm-SR90OFxGjgHb33uLoAXzXA&cid=CAASKORofbN-v9adE1uRlH8fkPg4FPLOTqppqmN5SPwEnytRDgu4h_A4qw4&rfl=1%2Chttps%253A%252F%252Fleisurelylifestyle.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:22:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4128
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:22:59 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/ Frame 0DD0 30 KB
12 KB 316ms
192ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

efa230a3973395419cb2746d720c89db14d28401636f48514642360656c172ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:27:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3857
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11782
x-xss-protection: 0
server: cafe
etag: 11425859616848618248
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:27:30 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 490C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPCA06IAZQpiO-K4U7QcLXo&google_cver=1

43 B
883 B

532ms
319ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPCA06IAZQpiO-K4U7QcLXo&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJiByQEQu7zuARiU1ZPTATAB&v=APEucNXqkFL8Bcoaaw8QHDlKw4zXQpNaNLiP_mmPp2oF9GnubFkBASHxlFEyeqFP0wYjvQd0ClAKGuIOW_oXKMuR-sQwwCQwyw
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray: 74964249cd8e17cd-MEL
pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vDUSE6hsKAPRMwC5vOiBbOQlj18Jm9BVisboBOPQ%2BMDMZrj6rYwgBV36kZ7VhiCjXThnokxlpN1ZOZjOLQEdkyOVAy7fhP8XLex%2B61WOS%2FYJ5Ce%2BAa7HecQF2B38b4s817n4%2BLWPktTEhA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPCA06IAZQpiO-K4U7QcLXo&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 490C
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yx7EQ.9koZaAzakQEtVTuQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2

43 B
846 B

344ms
338ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJiByQEQu7zuARiU1ZPTATAB&v=APEucNXqkFL8Bcoaaw8QHDlKw4zXQpNaNLiP_mmPp2oF9GnubFkBASHxlFEyeqFP0wYjvQd0ClAKGuIOW_oXKMuR-sQwwCQwyw
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray: 7496424ebdce17cd-MEL
pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3DGvl5slL%2BcR2Qj05Ry8PovZFLdwn1aHnLmRWLN8RSl9lAe2UMT48ULCP%2BxQrZ8woqQifGlbgXinAm5FWa6qRPfPG%2FI381gHj%2F84VX%2BSaoTkto4uvZBRkHRrphXHfcOaFDIkNjkMOs81RA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 490C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEPBawlV0Uxpqxw_YINde7AI&google_cver=1

43 B
1020 B

248ms
233ms

Image
image/gif

104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEPBawlV0Uxpqxw_YINde7AI&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJiByQEQu7zuARiU1ZPTATAB&v=APEucNXqkFL8Bcoaaw8QHDlKw4zXQpNaNLiP_mmPp2oF9GnubFkBASHxlFEyeqFP0wYjvQd0ClAKGuIOW_oXKMuR-sQwwCQwyw

Protocol

HTTP/1.1

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:48 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 289dcea4-376a-4479-9672-77cd55144282
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEPBawlV0Uxpqxw_YINde7AI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 490C
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D

170 B
188 B

324ms
191ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D

Requested by

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:47 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: fc600316-6b04-4448-9830-2b1f0f3cfa91
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 04A2 41 KB
15 KB 170ms
169ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BQ1wDSFqCqfyml1uiP4DELfLCsLPqdLtVdC-M3ZVmXr4-Pm95B2HfBJPaby2OiNKfi3pB-l-4o0gPOtHHtQb6ZwWOalZh5UTWanNULSdQYkRW1ZfUVIY7xCLHZeowsYBBfkaoZdnDVSSGA0S_TW1pIhLe0Rw&cry=1&dbm_d=AKAmf-BxNt7pnsaxkgW0eT4r3I-7-jX14MKgDZYOcZMC_jdn5VjscIF471Rwsz9bUsO50W8UUfvWunpiQEuLkDuyGcI6FHauXMjpMz8eeWOkoTB4fHNGdzgz6ptcnG3ci_gtKHWAhmlJWBbQw6hNCANwtC2lnlzVTt6t5n0VQPh_LM6DAX2cbYssaHnG8gxzR8Y-SN0aRSBqsy9SdHj2ecxJv3HxLnIMcVQwRzlyJ55xw6m1rdl0qOVcwcLoltfVDlPDKCOQDsR1RGJ9XzZtFV8LiZ84fHeTvJOhcCO1y1fd4pWC3aTTX6Y6ZudLtMSjvpN8qmjX9Fc-A7ePeQkAFiM8mnpT9IWLDjAscHr8C1e4_S0RJ0S_X30IbvQcFheBK4ixdKHHOKIYzaRiJ_rslAD0gd28fBMloFHLmw2m8No3fUDdfgwC5iyfO4Jgqo7UKGfYNo0s2ikATP2T4Ma14nUZ_6GzlpH8J5kDxfs2K64jZfiYMX4_lWGoJmwaesAl259smUEvWmBw4GzdgqeBCiIQPm1qqtqMh-dRhi7P8MhpTL-lX2QlizolPMGhHgoblmVXirUW5wp32PA1plRHrQ-BMsps0DOap17okXpv16fy9jwqwNtlJ4a95Cq-XaWj20aiKAihHL0UlOgXLUjSYdh28xLufF3mntmxlJkb1d1rsKCABT_3wFqSbzPx6iI0boO_j1I9rwbvrqAuoTYZUm06dvY7H-j3HjykGTPnZtP7sjF8ppAoyR8iZ2yW6i2we60nmEijwELRqE8m2XRJa83pFcxHwAZUs8EBZA84n0ps-Dix6q1bC-DE7zzPDLZLC6lMbmByH-b50kOqz6oBgN3DIPmm7X36-Eb_SCt3qQ7Go3WHEWlc1P8IrmR9CVZXtwnRaIv3vmsN1kLJ9njdOBrXyP9Q2vAIx61dc7Vj9sQ7WGV7xVFZbCxPrqPCopLRAEpSWk8_j7uOKUVMvJbMEDSisw5ARlVIo_IGreGbtDdZbAk2Tnze7TC6AbDje1mopABcsaTGTPvPcxNG0JBecSkCtR9HH8VqKu6_YvGcXAtwXvDw7zXK4LHOJNka8pr_MmgwzRci39ONQ1fk-NAxttNz-Wn7GhPboowCBcG_Z-McSOrWEK-3RMspT6R37-fFDMQpAW0Bi2OSWxW2JXVR2a4HB4nrUC5ihbuf2opWZ_mfmVfblzdQMwiCpG6CLiDMc_3o4WtNnlo1DgITjOV9rif1XpNsAyUFlVMoHxr2VA_byrdu0aVl70Zk7pJFTKcaBsvjXFNzb8xjSENx1ZOq8muk3RjUMXoVA4IOVXYilnJj-iKqkrAOUMgXwV7AQzprWiiFdJa6q-TBdkDSLmr9Gvt4bsJdt24p5A8osg3s_sy3DKEz_ojmfz5JJ-p_BF6SQA1cN85BNqxUkiOkzHk35a3KLTUckksB2QktWSbyb1G5bRtaPP5W0BxvLPiqcLp5mlZZgusjlwMrv9L3PEZ1Nmf1k0ncW-nHwJxPzTKhY_d44zo2U2V4ibrXRRShhvqvQ2MwD7ZttOqPFmE1NAqZmJYoAp0od1WkDCbY-uLdYQRmxONpkkAFsGQwqBCFFJNfJ_8pWBLac2Xst-F7oCmKemwr9x4o7oM_UrTT_BIDhnjXdeE6MYbWtWjl24NIKDB92B4pz1ASz-yvfqcIAIjfh4gOt_KQ4IcJdkWZhyoN7lCj7c7khIup9LbDBP0qnkyGCubeOtflH-pPzekTBGU2nqEyFrO6mZf53ZuGnc2IrqIGQ-PWJeUmGRHIvFt-S3ifvCWl6p0kaMamgs-bAwsNq_2-FE3DvkAB_o8AjAebRxK3hh-kZJ9dVmSANwSLIhJWtnJBaGAbWnC3dNkREwH3Ypa2VjXvLU8eI0AICeO2fw6JDJSikJzwUjKAzbdtEuITRjhyo23ujKVVvhqkLY041yeyJ3uSe5j1FdVGfKpcgcEAZjXaW4wlK1zVBJ7pAee4Y37J1DwiqFopq0y2gNmddj1Ica18P2g0e5feuaTHG-EdE-UpNZSnb6g3RZgaZXQpeYSADqIf2FeyuEVQq0k0BGWqTN9_g7s8ngauOTten9oe6MCGuuP228OmYX48_s9hvD8QgJv8luaOw2vZD43lTLut91OKZd4LII4ItBPXxzGeJI6sLFh7p8EnwMWpS7hFZKiv2tbtn84oImRpLIiWBs6L8YO-kTJlflVaJBA0ScJ7LwKCKAhxba2KX9xbsTQl4uWRxLMZhFDCZ-7KbpC5EG4FPNYAg0xp1uGVO7zOSeET7MDZJaCuhn4IDdgWn1ZG_5aQvaOVkAJR6ReZNhgJ6k3DljYyFkq7eTXw-n3nuBSPBwVGernE7mIT0E_hKk7fw226i5cUeVsd8SwjCnl9qtZYnpuJzaXlvcQPmVK6-Cs_Flep2EHM1ure_6dV3SEi8_Xcb_BhQr6PuLNSTD2juDekI4g_H9-kraYydR_Sx8xFu_a4tn5prvDzFCXidLm1VEFLFzbM9odtMz15C8yAAjEa5ivGjr_fD6GuWu_KSHCFEpuvCv-Ytf4yOIKQD0Tnu_0UIv6n_0p8DuJxe2ndKYh7rVN7aO-WYzz59p1ObbNoU3tAHEDE3jV4hnBKwHm5a3VmwnT4qz6m9QGb1ZpPvON_ATaXzkWk07HFWGsHSjRLEaLOQzZ5Vdicb1_WEcFLi-Bmf50LOBoDYfiviReuOkvQmT3sRZXF6IPZ_j3c15k6j0FYJbKd52Vh9z__LF69dEtru4W9gin2PWlL1oTpGPs3CgAt2XpPtVxuq6zGED2SFX2KUn4VF9BzpkqQt1rB_UUzGSV5GaRE6lp0jTw3L9C5FzjhNP3-oZ-NIMwnndig1KTs7YTKMfX_rHlnFe6B7YgusGeIsAI5ocIIgMI2DWXUG7dgt5DwriGCv2XcOZ3gD0SdwDVdqNhWLhpPBlFyH3TXIYXV0K_fRo8-QNX9sCmq9_M0uSaTxg&cid=CAASKORo8uV5P427KDgXkjANLdKgFJoApK7MXUsJV4R339Ch57OTRt2TeHc&rfl=1%2Chttps%253A%252F%252Fleisurelylifestyle.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

193.244.178.107.bc.googleusercontent.com

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 12:36:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 147295
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 10 Sep 2023 12:36:52 GMT

GET
H2 200 / Show response
geo.privacymanager.io/ 31 B
596 B 1457ms
410ms Fetch
application/json 18.161.111.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.privacymanager.io/
Requested by: Host: ats.rlcdn.com
URL: https://ats.rlcdn.com/ats.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.161.111.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-161-111-107.mrs52.r.cloudfront.net
Software: /
Resource Hash: 9a421d7cf16a54029a14eeee9dfe3cba2293bfb393d90a06cb44a71fa80aa626

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 19:54:44 GMT
via: 1.1 29f7132906866b79866659848b3a3b68.cloudfront.net (CloudFront), 1.1 04c6517ef1a7f980b7117fb82ad4cd18.cloudfront.net (CloudFront)
age: 34624
x-amzn-requestid: 60b001b0-e172-4869-8d38-c4deeb9e79cb
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
content-type: application/json
access-control-allow-origin: *
x-amzn-trace-id: Root=1-631e3d04-39ae320d747177ee17de4de7;Sampled=0
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA56-P3, MRS52-P4
x-amz-apigw-id: YT54yELtjoEFpYQ=
content-length: 31
x-amz-cf-id: BD5IO8nN6y0-I6rXBAF1KPM63zBftb7-a1n0q8Evk0H-sdD6DDk6wA==
access-control-allow-headers: Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token

GET
H2

200

receive
pixel.tapad.com/idsync/ex/ Frame 5C44
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=0440c417-bdb7-4c3a-b6a7-1de9ed8ccecf&gdpr=&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=78445e74-ad34-43c4-9f4a-e88d368c9e8c&ttd_puid=0440c417-bdb7-4c3a-b6a7-1de9ed8ccecf

95 B
612 B

401ms
222ms

Image
image/png

107.178.244.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=78445e74-ad34-43c4-9f4a-e88d368c9e8c&ttd_puid=0440c417-bdb7-4c3a-b6a7-1de9ed8ccecf

Requested by

Host: pandg.tapad.com
URL: https://pandg.tapad.com/tag?referrer_url=&page_url=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&owner=P%26G&bp_id=cafemedia&initiator=js

Protocol

Server

107.178.244.193 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pandg.tapad.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:47 GMT
via: 1.1 google
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=78445e74-ad34-43c4-9f4a-e88d368c9e8c&ttd_puid=0440c417-bdb7-4c3a-b6a7-1de9ed8ccecf
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 347

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 5C44
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=10072&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3D2040%26partner_device_id%3D%5BMM_UUID%5D&gdpr=&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=2040&partner_device_id=f510631e-c444-4f00-bd19-e8cbb35029aa&gdpr=&gdpr_consent=

95 B
113 B

338ms
249ms

Image
image/png

107.178.244.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=2040&partner_device_id=f510631e-c444-4f00-bd19-e8cbb35029aa&gdpr=&gdpr_consent=

Requested by

Host: pandg.tapad.com
URL: https://pandg.tapad.com/tag?referrer_url=&page_url=https%3A%2F%2Fleisurelylifestyle.com%2Fhot-springs-in-california%2F&owner=P%26G&bp_id=cafemedia&initiator=js

Protocol

Server

107.178.244.193 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

193.244.178.107.bc.googleusercontent.com

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pandg.tapad.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:48 GMT
via: 1.1 google
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

Date: Mon, 12 Sep 2022 05:31:48 GMT
Server: MT3 4505 5b23575 master nrt-pixel-x17 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=2040&partner_device_id=f510631e-c444-4f00-bd19-e8cbb35029aa&gdpr=&gdpr_consent=
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 12 Sep 2022 05:31:47 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame E615 624 B
297 B 199ms
199ms Document
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-f5AEQn5zmARiNqoXPATAB&v=APEucNXtZZDlGnpa7tfBE0sm-t0gT5WMwDneSvi6xqL0DspiBrRcdERaCFHp1Bx_0n1KLDZH7MG-3uLPd8zWofeWfo1JVGASgA

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 05:31:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 73F0 93 KB
36 KB 256ms
255ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A_2TUvuVrILnhZLH27zXKIAEWZXOE1_3DwXJqz-ZTyWyWLjOPAvVqaCKY0nhP-GPRXv9rXmF4pb77x2tEz7XpVCw6VLvXXsXAiYBJgx6srONawkFiyZHXWPinV6HhEbAixUDU7XeXnwDKbMrQqIEp5_Y8wVw&dbm_d=AKAmf-AiXbmkwpZDN9pSaVw9SeTNQjJO4pVbY0EUR3uD4dmnIYyYvjws1U6znerKFB49qjrNMHQzMKQiVpaOdW_FePQWydH2UDF0KiW_luL8lX7nltVhzsYXh3TCwu_eBsIahzAAzUKoONBGs4CLmDD1x9orLUP9lbiAcNUQfC0VHt1E5TGAVS21RZOJ1Im3Nxw3Mbc4dFSD1qnmvdJZ0ZWufHU12Ojj3S_XSlNL1E8QNmUB5krTNIAFFbl1r3YUQo5sxWmSmyrAU0Smg3qK1vKprXnJOIj-nNqv4QuKUdM3KiUjt9NOann3Epj_ORPoTIsBsIXBQ0fRPqXVxXIgjdvxSyix44FLUe--RcjGydvROCTI5HcW-MPaML6KBs0eVAuWBxGC6p6ZHV5-u8if8m4P-cfuTrhfPIZ5ZFtYLf9ooI-RzlxFl8ScEbPf9GtC5jm3oZ3wmc1u8wyBEolwD7g6qq_nEEH4Exh0RJ_MF9HZFmolnrPnATxzxh9dwSiegNgKYKt74tS24U3ht5ERpc34Ah8UtXc4NIwn9wa2gTWll2yX9TaoxfyC9z5oiOTbokYtdqv-i83a00ZoV1n4-ohvfs1dUwMJczZaZl8fkIRzMEw5jHZgB3d0_11yyHiZa-mcec_6VVakjGj9RZ9Yb_ll6tyHt7PpIRlSlZE928QkFIhIFeY3M6gE3b4GEgTC7SqsBDTlOuQa9akyeWECg9cwx2WGCX78miq8zz2q4lqddTYlpRwCNvaT4fbgbNoWqz4yYxBP_t6wmnd73v4EXwfj-SqxdVUGw3pkT37iSBTWv4k3K9m7EgT8xXxCI4M2UG_YkJQ314qoXhzd7ACcRucUZAptZnWylUfeFbhK3HeQXnEfdI8T64pTJ9NOmjrLmtFhtmgsGyP7D_LI_mblKGfEj6twOw27S7hxXNlye6huDavuJkQu5OxZWylqm-7CRzyn11o7qbhCOlWQWEcQUX7BGVMFpWdgW4QK4WEXB0Gj1lvYjKtpOuDhzGbhAVjNJi6SkaCWrrvj7609BudZLrMugjgcYSuJL4k6sJhuqd8UM4GbBDDhMA1ChN6WjI02gCHg6WJ9TvsQ2V66kDpJ3bE3VE-xv8HlthRTclbR8tUFkx5m15c4eavEOzW6lgG6xlN6Hrgck2uR4Ke5yBPeCs8hNF3rgcbYWY1nyFq7QZYWovPveFEMR099ght48LiiFTPj06ysyk-BzBOZV5c-FH_aoOO90nNrp2jziWyurmCzEiYJnoibd2eTYhOckWon7YgM5I5OCJkGXh-kscW3fyBkGfS6tD9jB-Fi1PA1l6h2GVPKGaHYZFxayy8tny1XQ_0Q3gVF8jJrASnMuDFGSryhqiSMlUDcMsVHopHDeYiRGAiBHBh3WvAH7-udOCz106RDKyIYH2Mq0dQ0Vn9jFDslzRFZChvJIbL4K5ck4iQixbXqM-RvhwCvxMaEOaXrqDiOTJiMvPrARIeP2WVtJU5toXexhPEpGr9N6yUATcUiKrl0K86g4Vr5HkpjdQuAhaiYcwjhI332lmJUHS1Hv0dG5NCQ3eCfUxmJOXFiCTJfYfqCS4l4jrsjwYnsyfe5HUhju5Xe7KAZo_gKhOd3IAKr5TgqXSkHO8s1hGAz4zASg-6pVMNxmTybLZEsNyn_oCBNLt3X-P9HdpTSiAD8wP19NAYUs6DY9qKSnsmuvdJYEwaHNvoWHbpLeddTmhThbCxCDrickG2dCgD7AftlvRUAnabuCqR99yctUrKO6eVvXrvGf4_ZmmMe12ho1E2r2sMR5pWJgg0LXmgZQ0K5Thtx0jxygyshTEwn0ePBIZ9E8UhmC-0tn776w7VnP-bE6RBL54srRF_608CEasN0NjoQNHpZK_d1PibuZmCUbG2Q08ms22YsXwvAtXffiipzLbWFCFSlLf-KLV3yELmpLc8oOD2S785jd_kHxYIyG4tquzNmYdYGyiK1de4oEjNjfevPx8cEjMtJnCiM-7yTlNGkG7PqkhxK3hJtQk_F5d8ZJjmDmwyJIgJEX9ZAK13GZjJxkP9QywGvy7dRUlR_T_XOMURsNsUyLbBQ-1tWxnVfxY_HC2hr4va_0haycrT-AfAARoRn43Gjc3QgVTJPVtFxLLtZ_te2E8JVPROmTWaBw6uRxL_CL7rRH4Bif2WJAvcwLluW5iRuH_dzUnpH1X7PTw0k7UsknxNeki65vB2nXY6O7jJQatoqItLQwadrC8FaEI56j4VhtKv7q1zHg20rNL7_U2AC3EjxUG_ZtFA4aYFmkPlODWm6Q7YYsA49xEiMQy4k5G8OEe-AsqEXCQ2PLHePYKWstyMS-PeXU-aZkZYIXKgJzmAXTz-xANtcGMNv9BRXFeEknT58abONLYAdZvQkc-D-khjukNbxyQ9vb45OKLy4Dt_OeuccgszO-Yy1qZbpoz9TK_06t5WID-7yJ4RhTde-wYgf-HmxNRuULfXiOaWTy0-XGVPc3MSrlXNhroR-n_4L--Yq5MutQZeZ_62HgT2tyHsD_OURN5llU9f4YTbPiDJgMmoYxrexUCEEPTpy-qbgTFY2TVFuV3DMmaPD9fBSu-5HKB_gUTzpBNj0OvfR29H80mqOx4rd_6mNPR8YQSJ2zz6XJSSpv7Tp7sJxK65P9lvHXBpdWOJxLKM575F7LPHzfYT1Q7vcgFJN-K07QDw9KUKeBVAE-Zs8zukHvRZ4LHumvp7ZS9DA90UsM2GPJV0pCJft-aXjUXsBQMULh1CfDvt0WvbSUPndyOfL6BM_cX6h4XAFnSVjN6hzixywAUfw6PMC5jo7ey6-Kx_nYTuSPTol3RML9XzUtCuojXRD6JQt82UXx4CniCvJ67Wj-mtJRaZYWjm0WpiPVGz2ucXwiF6GCVhfZgTqwYJaQT63iipDKse3Oi3db_IAB8BJchc2XtePk3iVyYljkTjQwa1xitRS0PwfLXQODa8wbfCKap0pe77Ccr8c1sst_ZaoK07ubZ0O243Tge8YJCWEwVLzoVpzOmyZSfcu7rDLJga1zDx0JmndBjCRnWzTIY-wBi0lQMkTg5hHaosxhl6GxU5hhAw8EM3glG9hYtnMaSC1z9UgSeclcci9EmGU28YKeEvRY3CPbqOpSK1PiWOJ4rNrSFIKZnAvpVf5Y7gKXE3qtNokmpCdlOmRr9BdGbaCtHi1zdSKf8eLwXvT7k_J2hsmJ2ghCeQg3PXnclW1HTfF10sZU6mj0RkKeNGi-Wp7z5XTnjgpXo-5ZW9p91KGNSnJhEjTcRVfwesqzjfMTtmOig&cid=CAASJORoOYm1qMmMKCIZBKLzxrcCIbU4Iaoi3j9zxBy7slNd_-gMwg&rfl=1%2Chttps%253A%252F%252Fleisurelylifestyle.com%252F%240

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

acedd4a884bca637c0e05db95e5f4119cf446796cf3b02d20a920ef8556905fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36713
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 73F0 42 B
63 B 281ms
280ms Image
image/gif 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A8riEQg5aBIXcBQCSewzW-BFkQfj0mOB7HGkxaAlzyPq6-rtlIzcg-dUrumO-YoJrp90WFCH_Jx2YCJfYKCtELAID-rDKIr4yvf5TLaKEPbtew_e0

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 73F0 3 KB
1 KB 189ms
188ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:35:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3400
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:35:07 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 73F0 17 KB
7 KB 189ms
188ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:35:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3400
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:35:07 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 73F0 0
0 226ms
224ms Image
text/html 142.251.10.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSoSM4Hx-gz-GLJIJcCNpa_GkJKwZdCaFmz8ExS0jjoLAPu3ZWmIGhod9tv5kIfMErlvkIl_T4hyySMvrsuQCprTlQsnA
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f147.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 73F0 141 KB
44 KB 253ms
253ms Script
text/javascript 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 05:31:47 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame F876 106 KB
37 KB 830ms
587ms Script
text/javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Origin: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 02:37:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10474
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 13 Sep 2022 02:37:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/elements/html/ Frame F876 8 KB
3 KB 269ms
269ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CkOmjsuHXhMevZ1P02nP67RuQ9BLQNUsYz6OnuZBnywaFpTNxO2lPqDKCKG8AUAlK4U0pUS_60_NAmh6xF1fwf-u45rw&cry=1&dbm_d=AKAmf-CCL8_uSvGBEzITrWCOKGW15XDp-d7r76IfJtSZDBvAUOOYV0WAir0PSCrq3wCengfdY6qqhShaS_v0veyI3Q79lBTOOOqe3yWrlTq4LA2jzW3N6Sbo36tzTSV1ZAwntl_t4kOG27EHjnDLmuA3hnDYlIoTVqV202R2q6z0mAeOiwlRhknhbM0VlHMGOEwzrQnCSMBwGKd9y-MLHunqqqf8qOuqAZ7P97jMz2-VXahJXdq8P3UgVU8QTE7TGn23MYuH4OzHI-XWlp42N_0-yEy3ltqOkR87sKkXYQKQ0CdnCjfRnygD1iimMZJvtl_y7lYvFKhtHaCZbuCBmwOuVvPvKpSf-h-gUoWsbFEkDPZdM4TxUzi08u_af8trMT_QoYLTNIouZ9ahksT-2EzqiWV1dFkdjrwa6Y63I1iEbsTcFKsC2qAs7IQUztyTeVu9mndtPQCtjHKCzL5bsuuTXrjjjsnN-8CtOoUuawVsr223F_xrt4IhXuwAeEhB7BAzzy9gMMSS6opYRHs01JFYXuVKCT6FhHmipQ1rUmI13lTxnoChL-IuCZ-iD6X_gwvaJ3gppwG88bqappN7WmlwcPYLA9XcWMvCyAYWoMWYGD1mcESjJA1kKXF7MmAEpoIk7XCk7mCQCHrhmP2uIlg3W5xAkhn3tbPK2iA9IhIKOxO9QYCdbH63ahhnE7aoM0LR9bH4hWSXlNG9rdeIi7iVqdiZEGAZPNvkQLyKCLvlcZ4bvyHzjtjZPBi4iuekzCuT2dn-J_KPrKqEw01DjUIuDCaNE5tE6BaBlnG-v3tJ4xYE5RAf79UQtqVCVyTinkfIDkSSxtji4rTwJXkQF_VkgjiBrq7W9nCWSrZIVU7sqTZP0a4uszXSsW6qwBT7pG9vUy7xsZjg-dwQNggE7SnMQs2H5LFIuQ8yqK1DHXi0oC27n9ZIkRJTnuYBkoBStaRSTWTU2MTL7eDWUtNEEHv2RjMCaRcFtXaDiMYcP-59W9THUhictx3dHk5Q5tSZsLo83Ph7YUbFGSyVzJTTaQjxsBQoG1XxObnY9HTQjf9vkeOdB7pic72IStfyAH98llaqcL16QtgqodcehLePb458J3UlyKku2S_d4X-rCxaLGXX_Yy2RLMajLc4uG0jlOJczvVcqSIFe2G40xQqf2SOm6jlt84OySqDqmkazfKqmlYoJNptcx5VdG5qZQsCbDGpxisjw1ldbVfgOqrIgPoDKjJpSkYzAYBSju_Ds1ZWjOeuloaKec_br93aJH0dDAsqrzAajgQQUNHxk9VXa8-0GdHGiyMI5Bo_xFpjV5FVLVDJON1g7QTwtsMpHV2V9qfXt_fRKsvbWkjNGhaFHa0q3TFcg2UXKd4oWsbflVcWCwC_ANJDw3pHaq0kh6YYTJbPBSCJUh0LSwGA9lGWE3jyZfammUlWiZ2DVdo_-FZM2QJMTXl4Y4LV45_4hZMsmevI25TPzhlM4OLG3Fkj8hjjFL_XaVWJYkAkoU9ol2941kvxpiDDCetkI5BeJ5EBSSX9uSEiZwpGK_9nC2_DduLjfsyDwFVZDp7K7Oon5qpVruySBQwhSQBizBDJUyag0iPhzYmAsj7tlYZymNRK_hpL-RW7dIzQHtTOy6ytaHOBEYbzT1nwEswifvSTVQ4Yq5ef56b5h6G8X8U4CfWPesVdOkCIiJ0gCI3ALUzfsTKgw0wo1DjoGnZkNpl490L8Z3hoB_qyc8X2aA1wQnFWwAoaWuzqleNtCrHQTLX3s8t4E_bCjk1kWofV_HFoS7IRDNsxwiLgzBORmFjTxhXyPhnC0fiLmrbqI94_5Bmtg2f3qgU-P7wLjOYRdPYcFewdCDFLOMSKNUCboZAbgsddVbX49ZECDJw4WdHDlsp0rblIxLjcOqzy61hkGnQAmvn1iBHgpNEnyh1-tw2QdVYBPac4u3eA7JWts8WvJjVu55lOf7Vq3_MRuG9KOOCVvl1uuBu6BbppnrLm5sXecp1hm2cogbhO1B98hS-BIff3wtQ3lk_9qYnzNzsN-Q0FOqR59oSPDn6VZ5rgL5FQZG7GqKmQNBURRoyWm9phXcXD28b1Qdg80L5ayBG6jhZyp4_scoTsY75L2nUPB4l0NaP8UuD4j5z4dS-boNrqB17bpVJJbM98nrWTpK1hUMtKjJjSSKmQVVFG7W3TUbQy6j5N54eV4uB6ktOeJxorSYfXTR_9iYC0egN5yMtGmfFo4khDnIgwGkoBvu6Nm1VUE_56dQpMcVeRM0EF4NsHeVJssSbgHXYdKSq1AwMZAzcgDT9gMmt3WbLEBMwBzDT1ECIvkh7XvJWpVH6lSU06g36zSp6h80wtMuNJLHcyPz2ufWkiPCslDBkBgYbyTZt74kXmRJs8i-A_baDovgX6QKXpVaeVrhH42-ma-pd6C-zj3JyGPlF0dtJ4lM8fqzjuaUjUGsRu7H1s_P-ijr5SvYqV6KUzV8XMK9_ypxi_yPqC975Lk44koYblXaJ--70WYsRcqCDiHZRDgs7SABjJWUVxULdn2opiY0weXK6zp-EaBKWiwtxNULCXcRWhes1asNxg8Pa7bXH2G6tm7BdmoVcRmqUWgN9vLtJN7oYnjz4uXInzH6UC_0UN-eC0yF2SwTakyZqSVCsUeJV_dKwRC2j8hLdVvjI9kd6afBi_-XR9AvX768o7RO85YBCq0TAId1bCIVp91e1Ut8fnvP7pv5eVu0Hol1GHOWf7QikJdyQxpMs74fTgBuEb2kTKJThygFETO_w4zlXslaPnKqvbXIidVSqDmYX_4StO9ZTreV3VfiX4sJwUiAWhVUersT70nWl8lBIGOhcul-3ebqIT180ql_ltaMQYmBZOBMUHBDhchz-NnT2XvY2sgjvDZVy8Hlf4FHpYofOhUOI8-_AAAmsVCw11QHEffwIv1wW_UhNkyjf_zh-_ZqTTFPIjfm9_ADZasizlpzv-KBhxqkiJPsQ_odEmGY2M0dJc-qVRiihlcGGtfoKlFd_2EccobFJSrLZ1gEJZ0Nf-SycQborKUK9HFIuRohFVNgLZHuoUYjKR_W0w-qqAuCR9HhEMiy9kr-6N3mz9fXxk7A-2aRQjdKhpgWL1K1QaeIaDpv4TSTfP-AfziIIjAqhJzNCy3K8Qdw5_yJ1BLrcChQZWHj36dAkI-jkc1rqppZ4RpwuZe-k_shbQGcZ6JRoTgfDF8_dMcHdoNMEHLD2uT62kozg5_Xm5ktEE-eadplujKkI5vpc0d1vnNGvFgczAPF-FIXXRSZKvYaLhyuhMTTJ0AhIT1Ipeq7t7oLk8uqFmEK128cefTeh-uBjU3a0qkvf4C3EJmqk8sB0c5lnTLnkrYZ_DiWmsuWms4fLFekr9dyhmAGKFxGDmh5v0FrGEDQ1LH5a2_crGVBiWUdYs7JCstZSjXMJH7EhAWr0rH7SgMQvczeCDlAm3gJS18O_53irlSw0f_pFaN97aMjH3hkrAuw7TlKivIJKei-KZsrOsJz8A&cid=CAASKORoXhRNQzye7Y7Ilvs_7ACSiot1v9xQeSyVBVUAmndTw8K7T8GdWpE&rfl=1%2Chttps%253A%252F%252Fleisurelylifestyle.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:22:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4128
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:22:59 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/ Frame F876 30 KB
12 KB 186ms
186ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

efa230a3973395419cb2746d720c89db14d28401636f48514642360656c172ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:27:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3857
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11782
x-xss-protection: 0
server: cafe
etag: 11425859616848618248
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:27:30 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 0C94 106 KB
37 KB 618ms
503ms Script
text/javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Origin: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 02:37:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10474
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 13 Sep 2022 02:37:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/elements/html/ Frame 0C94 8 KB
3 KB 198ms
184ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A755zF6neyXMeyZba_3cVg9G6O0c7b1nSMGTuy92wHM5vus67QGidkd5z-KDOzghQo52nloN7nc_Wu8g6EzXAmOgNVBg&cry=1&dbm_d=AKAmf-BMamcNi8sahtZ7kttmbd8i9wvCC6AgxSNZhKd4gH5kZHL6l6X2uQVEKGRnOnGRQIN-rkLu8ZG0TpOqfXzo1RVdg12AYsiPvF7-Z7hDeC-CkrKSI1qNLwnPZeMVvQYYlONO0_VbsGlAU_8dQ_snWfSqIi2YtaWpmw7bOmbkmOnKU6PZcvq-izpODQWhKTcTG5QojKZcZV6HcvTxl67EJNz3UopnQl6wNHJIvd9DqZXF1crf9yZ2uc5bsdXExDGkxEB7WyHiizLgyTe8x65fHuObJTA7lhWJsTbSxBZ-SICRXOfrVNV5XHYMD8X6r7C2T54QbzvmLiXA-AFFQWHdGzF6o-FqBhzw-Uu-he8R6DZRGl5DY0M4NujfH6hcwKfKF4EDY6QGx0N8MKpeG0zdML75K1ocdTGeZszi_6jkHe81cwN0wVvbxSZch7XzzbjBUv3UuIna8LaHLmhdPaIgCdf_jz8KM5Jel2HRpPvciZ98twDgKfcf0ViyTMby3oF2PsQKfCY5amU5G1C_jUb-Ce3sIBkyZgNeTMsZ9EK4aY0eovTP7nuVUNaiBy6CA4Igr0U6tCDJdVQ3GJ0gKfwD6nuHgGswk4uIhKgDvuVVhoOwjTCC_1fZUCUHaf15ulQ6vnHTQvd1ZtMBEMQg191nXEIBgpTMmqrVkE0Di58ITQzr_oHSZbn4LPLGEXcq3Nsfd5XmwG54yf6o6QDLuqEKpm1BNA6TIgVjNW8Q6de2CHelLPE1V62m_3Dbcm-AABn9VwvEuo_B87Ff_EXPnVdxnZBjjTWJJ_wLCRvLirguUE-Pug0tufcDVxojMyaxjwzHwmDQ_lPlUkeBlTKT13IObb0p99ZU_wPrjHTWWNMS4fwdJGxAQGwxgzpergfwm0guGy43jy0jlCm4sCwihJbMlCV7LFpwcpqapS6hXqy9FJuU5GIFYPTjGb05NEXR0RIaFmEttnI4AKz_AmUUk4z8AYwHpZsXxoQI7Tx0lbHr7B3DBEUeawfLrO_Amfzr97-bBGlZfBnnrB5Nxu_KjolSymBiiZgo83yylJWgK4wNI97epgy48Duope1OnnJb5f2A25akMcIBIO4JMbDcfGY3Txumtu_prjtQvclyXWxa_kiPGSrMSHYjdMDxAblZl9EbbQ6ZmGPw_ELa4YpPbsAU256WjyONxAjUZjDXicORnXb0S1q1E08w1z2tCCfHU3_4Zn_hf56RDx1goFqQVxlB-r8zoZuDe4XiwEkbIeYW281oeTJDC7ScZKcnBW7DF_JuNfgRUuMYMJ7ExS90EeBebAgIbXHWthl74R6TTTRKW1sib5DFzM2Oe8dMjxU6Az6vgNK5JeUel5qQ7pfCTCGqjNBIu_df18UfhVJrWYZAyuktjMGsVBIomCPFR6R63btJyGIPCJas0RU_r-qpldJUTnIHR_eS1J67Vqw4B1QntMLtRM3D4AoFT30gvGzhADhd_NcAeh6hwsLMGkgS1SNeT6W1FjiqJagsIUynE01Y3oLZ-_nEoojjqq-GjKFqQ4n0Z6qgDg3tko56hY6vwFxuKFYQ22WSqyDFxIM9y8DlKkI7lcbo-iJB8XErHdke6p11scC0yfeOMc6BQam_csWH4kpWsk-q-a6f6H5SUnJOD2Vi88v7eoN22-q8ivH5G7RJO-bA2oonR4wvaO5QICr5ReWXb1AXn6D7CmfjtJOuYQJK6Y22RPUttMDTkccIqhybpgP7ipBeESLDxkyBn_75yEehZk7DRWPkSCYpBB734QPwuNTZyiaihbYljUIp5zd0NK1TE1GRh3uZvFA8T3cz9O6XgxrrfuuKOgv3fD65S8e9guMntRTNtQEieVymyYF6faJPoNjQp8oTAjizmFdD4-FmwjBmNA8FiUHgPuptl2-KOPfZ8YqndQjhEi9MHuFnqOk5I3kJZ7mDPgMASHQ-ugROFUrV7Ogs7BhXl5nN1hw-SLdlZxNETwjGPUMSaDndLq7P7m6htgqaltHYqejDWpvj6tCeMBYfWa9gaqKg_qdMVjMJ15WqIkn95w8tGL0M09ZG7E1wMdPttT-bzg1E3SRAo3K3RdugSpWe995jmEV67scKbu3M2KCi6wn1jDTmyoUax055J9opNHp-KdgywYACa6P7PNZKTX84obdxNMVilbvRcN5TOYvpGQokNp3miHw6LNiOGHdS1jpOPj3QCMqe49eRKtbA_-oZm66XLalLP1mcicjbgCgSrU59oh0JO06kVvgCwKBeCbiN99PEaBK6cIJrco4UUTzn21FAlFcHqRkNyAKAh3jVtWpOR2G2RcSs7Pk8Ru34uLSKZCidQgirr1lYIrsnkY0jObOBXw1RjEw3-S1YoGn9pGdT9E-M6E105KeFj2WR6qiJGP6Rvzs_5jUhLmy6Jl2_eoswOYjlAIiihYEvDasDStAsg0kljoByJ3NalHLb8kcsI3o5cUgBnxqbL8cfYd14sD3hdKw9o_BAL28u8PpzoNNX5JLcJoTBuCDd9K8fZLvou0qCJENb1pftM1sdSPRy45uMA0Ab1COFawuAHkTKrUhXrKvjqBoFvkyJ2XWgyO5e3_jN2IcB9dkUW5XWGy9waNaSkMFjTcDiOPX5v8_-jYDCMSztn3Kc0VwZDS2e4l0xFq3fHS4HvgWeiemvrmv2VagkCeGT3GPUiNZqcqM3o7geR66fgET29eRFo_fxr9TI5j5NTxSlqVJQWcP04K6xyoLuhM9xbW5bI3S6W5Irmbnot4QOW0y0jsO1F6HK7rqBTfcCxbwrhYx7u0OPyyjOwVnARhCCBucFGzgIBwFSwxeSwCzLQq1S8FQb1yciWFZfcojF1GcjU0mCHfJQjc8_td-Mv-V8F2N2j3BYVCBRpkrjAUiqdSgJdn2Q9WCUKeRYPvLkJvy2KRh5JVNLqnTcoQW6qhKSdCSfja3x5umxQtKjODxbUZf06xVHl_tCobHf21ZsRNdDfCW7DNfg2HGHI4UToJljsHg4lAiPmaZF5vznff76-aJo0pqEIAaNsLV7nQlTjhXGVbqkfGaWAINfN_nDuyVSV29VcTmj8sKTyeAb-qvfjeQM-jOfOs4iBRmXTpdEsaeZiSrJdOyfQtEggluPkKo1ydg6zmsDTLARVF0BX1e27J3pvxOva8ysQ4Th6dna9FSDxDcMgJoklcZb449eOam_4OzB_6Sdmxtg4Kb-CaIcMHcGh4h-k0qiPGNSR0m-dSV7ovDFFP0FfHxIOgLCw0j5PzEhSLE9yQiTgFuY66sff0mNRM8yP6LDdISZF2DneLEkAUXTYhRlmQd0QYeF_rvto5mijg_EMTLqKa65UCnhwkPjUFGmMA0OlWhzMmUlNT8Ap1-Qk7wShfztQwBWZr67p_hOTr7sv7fQI6JMyHtdKrPl_c1Lb4IJMXygrVRXfEm1cn-KgaxZSumXasgV7LnULQVdlWJr6fOUMspcPYEQcLKrnUcpLSeLbzpS_joeUNVLYZKCwj2FiJkgc2LJbxUha_Mpi51Gpgmbtf6TCimeS-LZnp0W&cid=CAASJ-RoN1dZlOBODV3vCB8bHw11IRgq6dSGf9mk3FkTwH42CKvs027geg&rfl=1%2Chttps%253A%252F%252Fleisurelylifestyle.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:22:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4128
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:22:59 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/ Frame 0C94 30 KB
12 KB 222ms
180ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

efa230a3973395419cb2746d720c89db14d28401636f48514642360656c172ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:27:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3857
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11782
x-xss-protection: 0
server: cafe
etag: 11425859616848618248
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:27:30 GMT

GET
H2 200 html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame EE34 170 KB
59 KB 792ms
688ms Script
text/javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96da839661d63f7cab3dc3e43613fee97166a472555cc91df21777d6d83e58d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Origin: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 09:59:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70367
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60311
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 12 Sep 2022 09:59:00 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/elements/html/ Frame EE34 8 KB
3 KB 341ms
303ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AVJMbmZCi84qMosNHMjA7ztM22StGVDVHvwVQT3rwIWZyUa__DcctHRtOFqmm97TWfeF5k72LgtzG-55DK2H88dYpLKW5jWzpJFlrmck5fNrW2yYwnR21CoPEYbpHVfRMJzFVXgfGK2-GbT_UxYEu-gs0ybw&dbm_d=AKAmf-BJ26-d1QG-zv66sjt0VhdyaW3Xrh_sW1K0PDH6xWrdFJ_j-7PLYEX0pi2wXHvWP178I62BMhPdMKYyzlc82gTi4lSWabFVgZWZUbJpAjmWxlNSmfElNoXF_Xv9hgbnJQtimaV7niAg5U0xwlVHDXkpDs15yrW_YHSvfERTwNXDM6q_zeMOTfoXUvXetDJYF1SDY299HaJ6yGpAj2B5Nyz_Z6x-g8OBNWzPc6yg6IMbW6WkyOcvxT5r_dHJ4_0Nwz7XAm6bRY0LvS_DgPwwJAO8zv6sd7Fsl65qnguPAruBdVZ0zaglADiYZTwWANvxMFYKyhOROWZPMWlNE4SMEvK3xM0mb5_mlkAwVncDMyZMJZBHoGNhfarpNzPzb7r4v6tyMV99G5q4L6qlfiSB2wvV5Jh05I9EVZPAfI2xu49vMyVeYr-2Ps3YuuLd_XsA4ZM73nTtGd9ZVMry8Uw9IkOT1g1EOwOy1WkxdRDTvAz21J-43sXKPlFFAmyYf_fUKWE2XBPjRAdQzoE4gPmr_h2r9qWKAuObOZKaLU-3COcKFo8iXLoZoXawcf3g68vkUpercMOwVOWk-Z9Gs_VpC83t2-GZsWT92F_3VMCXSSqY674I7B2yVswDyOmjjSUvbp74Ho8QnBftSQg_wFjrdqaV3pMSmYbCpWzDWamljA_3FhHF13h45eLGoWgXxwW7H_X3Tn2cDuOyxVebhQjlULOFnv1rNmCrZ0QJbkFcv2Gy0vWu9lOeNh4TKtEX6zr_LMBhsYgJOxOOO9beGUpkty4V5iEb09C0lB6wdLT-ohQ_qdPekF4t0lVkWm2aJFU_VqO4Xt2I_mhKmBeIwc5xlUOay9oBOuhwrbTVaw-SP_VSMyjX1mDoPOa-DWelRoxJUlqeruiiv_mGGzt9J31m7bclxJ_Cy1-u5os6ejqWu_jBJfz9l2Oyaq8Id6i2N4X5EiqM6ILzo2j3rYJUocpWpxJnl6mHloSzYoztxPq3pP5WEOKa1YicFHWBkHl40mmYRBVPO37ClXoRgwYzWV8kKfDfu3y6FRyMKJelkSRsADqlMJgqSAdNW9_s5blolq6FgYvpqPxQRxWXGX2gYNxy2MY9f94XwV39uEhu8he-o5_Nc9sokhEp-QFw2HEZje0kiV6cYp4FEfYqFp4j7zYNk-clfyvWS45imKbk-4Ap78_O18CrAo27LUhrn5SigY-zY-0K7x3TPVhVdQ0wNUxnjHrHj-B2TkSTue4FThZNY6ojJGrFIUBmoHrB3Uq17iiewkPkyzCicrHdAjSBcfuDLtePMB7JWFMQzxlYTNTbKPukWysG2IgMcdHNK_1b0TRJf94L275sjruF1Aa54bOd2xO68YDq1qRAStqd9m8e1jWs_mk26P3uAk64FqgH5lewLH-MnCFhScgoM3ixwM_8XgzuTs69kRM3NLrNXgkW6tzWUvCbd03AJRsgGpI06pcuZM41C8sMu-VvIQrZ0ZmHBWvAX0-7t2kYTcH4S_MTToHshtlJGAPPnqwWthXY5bzu2Eu-TqpzORjW1YhaZ4TQ59wgZ1nV7TpMOWyUVYCBxn9KcFfwWr9NwRVeBeJFd64Y0U3O4hNFQyM07QIdOvjsDgbi1dkbd8g3Lxvo7F0tCiNiH54ybG7ipOJVSMG_BG-rtVRyzNaC9poHapnMSEIGNsisErPdtxfdQFDxvfl07O6tFFKRSH0nFxrV9VM5LiHK5o_ukphs23gEzWkULmD1hhk0W4Lmc4lpmLvW0s3q07HARNeqWRjMWEgIQ3k-MG7BwFYt_CHdfjR91RtdUb699UsAXcP7fG4iiWoGd9XNtxyIhNWPgxhUJq-oEZxcs0nErobv87ygR9wBBLBtyc-WbgEc6oGuvtc4HGmgUSOV5nX6ICI0qM9REgQ3GbZKAk-NQpZVAP92P5Deyc-GQtwk1cbFfXS6DWEbe1YDZbRtBVx58QRn7lSEIqdbp0cPQiuVhlUsesoKgzcnE2whYUS1UoWtHBr3S2uIzkqvI3sNiZ3vobCbN9gzexQKF5ZDNR_mb1X1sR5jyvWQC5PO-Y5WPk9jEai4Bm8_kkEwnkUHYTOwqvJ07nfoFZ6M73wJuY4BUx8VvmGd9Bpbf4W-3f19qLay7jCnTTik4WaatzGe_OH8u2XRBI0oqCzyFv5d6FRtWg4rDAqoEFLq4fpbJVaz2kwyGqx6P8O8xSrNDhTSgce-Al0xug6JoI4voQhhvkTmDnZzqb6FDs5Vvu_nDvOcrUbIJPzMriibf_a5defVChs-e0phM97rZ_3FXLqOM9-KiwgL9BR69xoA9NO0C8fdRHrlcfSg3UFvszEX2ulPkGnRaV48PcfuD0Qrf_jiEVJUtnC0-Pd7eufrhcJQPIaMSA1_CX2U7YL0sv9w7wPc7FcHh_ZQ6bmQoP6OC-Lu27TTLGte5UVa3vD5jePgWvg1yFuIRtohFtAlWmqoBHVJtjWNvnc0MC-X2WEcMsFoJk6DWGIQnvJiG00cqz25_eoNObW0Hl-vJgPxH4SMASxPBx46iAf4WVyQvT7mBnpbtdaRiw0rAThVy8FAlCy7l6xmLljrTI935zzQbwxKMmWS86qVTIF_FHZuJxPpSHYSdIiW0o6EOR8yN1mbNovr3Dhd6S4RGuLtlQRyI-B52CG8GqKajedoZn2xDpDEHwfyLEk6vi0HNGi8LSVQbdh-N0Y52EQpEZGf6Mx0Ndj3Mg1Qpl4LUxcGyYqpnqGoP6NfLpuhiVgvh87lV466sxdY03NlviWEowSeLV0lRZ2XzF_gfEKU_jHCv4VQMxooHz95AUpzF5zEo_Bu4wbvLSshmerBcfZOLRWBrr1EpG5lU4wEUsZLfR3ekUW_nf_jkHuNVv9orbrZ4705ikNVT-R12eavAP00AkLZJ_DugUHI94cEgFKT6dZBytnBO4YA8MtyvEopE7eivQkBgM8DOKskYkThCN5BioSqjrhQHY4VW2LzRq2vahqCTuimhUq-3hPEkcymS1g00xg6FhPl_5Zqf1r8xTTCNEwN0umzocMwuycwruTDzd5ugQ9noHkMWoTGXCdm9DnMOm2bytSVXxBjPLmATDyqFJaGvncXJLHwHPH-E9pW2V_BUMY-PkXkiaH5pXUtAcYi00hWyIRShGGXGQrQ0_Nb8awsZHbQkt9qgU4JMm0Z42S9I54NtJsABM2AOMNuVPeWOR4UraxsWAIF4ddN9C0Az8kMPHSXXol9PRUz34Nhfp-VPbcM1VTllWXSG99Tpfo3Yy-Z&cid=CAQSLQCsnQUxGAd6bZrOSGbQMlIqUbeosicI32UfwZkQbv2VwKHXzQIGWUVwY2SxSA&rfl=1%2Chttps%253A%252F%252Fleisurelylifestyle.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:22:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4128
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:22:59 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/ Frame EE34 30 KB
12 KB 263ms
232ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

efa230a3973395419cb2746d720c89db14d28401636f48514642360656c172ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:27:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3857
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11782
x-xss-protection: 0
server: cafe
etag: 11425859616848618248
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:27:30 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 4C28 22 KB
8 KB 168ms
168ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 161473
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 10 Sep 2022 08:40:34 GMT
expires: Sun, 10 Sep 2023 08:40:34 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1102537/64448505/ Frame E942 234 KB
70 KB 240ms
240ms Script
application/javascript 54.92.10.205
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1102537/64448505/skeleton.js
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.92.10.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-92-10-205.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: e66f14c0bf0b715a41c480c4d46c9766950780823018cbc15a185f52cd06e5ab

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame E942 106 KB
37 KB 434ms
391ms Script
text/javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Origin: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 02:37:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10474
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 13 Sep 2022 02:37:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/elements/html/ Frame E942 8 KB
3 KB 290ms
289ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BYFd7LgXHv6WLRzrJYi86cqaR-2grEj0oDenHdLu2VX_iRIrPb7d0q_LWfWV_pKfTbFDQe5wOcif8hlGUT1jQjFLmrsJ0ftlIigDGVnk8eZ7n37AwqbK6GSCJCiDkqnMkFr-Tag7hARdDhp_RA737lW0_HRg&dbm_d=AKAmf-D9XpbTZpIlcozMdCPxZp1HNYAR3yTZQLIKx0-Au9qQwYyR0LDpxEk54Pck7HTnI3T007YtFIOS0h4sdfODpH6C5QqGo1TBWwD32IuhkGYDFNxb3nqICWTCP4R43gGvXUin7I3M0Q9-Ak7KNr6OJs76gJk66qbacvvhMRAPsM6WzLpPW7nmTaz-xQLfPW0JILCn1li7a9FkRyxvqjPuaGXG58nt2hK_9myPy4qUCuUkRdBgUdZsJqv-UwCCKMW-nNZj-DhBqh6pQrZUEROs3G0hVsNcCUaClER2jtgjTxrzmiRtKmG3V7eFdu1txZ59lERy4yeIElXCUJ1yEYuvpO5eZBNXEcve4Ksx-MMB6HQ_pTauQy5U_c6iYzpf4_Sl6N-Q-ib5nTdP6qNSVf1SFo-FUiJFDCIpjf6fnkOIYHhBLnNSjcumer8ja9FmXi09z63voxregiXkspdHGGqCtrTCaNaT8YWLRY23PY86kKwMT0zOJtRzPFPtlSl8SH6swKZHAiN1okh4ogUKZhZguApSmJGdpnObNwJQCdD-PGojpwiyLGh9Qn2K96V5bGl1Ba1NODe1pPaZnHJkbW4IIoGfaQjHAMHiGPnRASM66NjW9YGFwMct-8oYPAbWu4ZQjxU0xNA5EzO1X2bPsj5zl__LJN3XwTeKHPQrIvgLhbcBYB6ngm1-Bvbn2wo_TacfZOo2eI9qmYWVzBOydpEQFNdUKRBzq4y5PgBlmiXAiXFIEFuCXiJBAjYRzJJwxqqfcmp_Ky-fMHqmWKv49VuPoO-75V3bmIWwsSHNO1_tnAostx1ozfe6olKh5Y549HQQC_hE6lq0uqxHOG9d0MCe-YOlwQRHo210ygKLh5Iggcu2JQHld-wIQPz0Pv9_PLKEui7CZBCWNdLNOnPIVd3D06vXcvWgDiO8pjj47wfG_6vlpgWXURwucU_ToObSIT0rGafSh3GXilpAe2BNbCWcloxTvDOe363VkhINTph3NOcgRKjW-o18zOXhtyWE5Lt30_iFauld7Q0ToLe-acALCNQkIpmSp-fpz54-lPRZbjlNl4j4Rha4f53yq-3C1BQ-pIKLXNmURY3D_2x9zfcr8xJrtPx3oo1YvcALqX8AiKM4N1tGLBg9gMwZbtdGPTBO11X1lR9QUhmH0SvKVJquamA2C9-95BiGtidZWiNIRRfPQnDDjNCURW62kbZ0ld7bhmt9b3iPIwZZVycXNtPEGLk3Z2fGgkDWC2GfCDzjNwbRwG6VFy-CuOpsvHOfNit4Wsb620lTe9O05oUuEP88MDnFB07s_ineatHf_9pgaiTPKor3sceCvEehNs6qvlW74k1s8Fs3iEysSwhgMaSMtio0lf-52SQ0ancu50MmvhWeWhcCn2MHZBXinwYDnFovRdD1ckXuWLHEARqmoXmbAum3Ff_8CedpQ5YiEmMOZvrAn2JKSVdr1j2pr3wH5-x2deKZbcgpr7EduaIqPOpQdTp5KaSVNrODK0-0Y5CAeCCsjSxFtDdTwa1w1wKsqA45vLKdFE3Te-eKZBU58MbEfYWiq2xaLnUId-XEvjN7925cMirgZsov4JamvQjJ6gwEiA6B8aB2B7rd6lk7XcB2G8y6OqGNdrKRqYF16bh6mt_sROZwyULobVeBvM1YqMC_c_FnfDT_zrqMAAdcJqTBMPPLx4gYOPGOXwhDx5sHnQ3ILy2rN7Q3qalMMsOfo7uf_GlZnk4N5wffLvJky0vb88Oo1nghCCgLMjrXsQNvClR3EpVBvbgIuFC-q8hzp0Wl21iSx2EBR89kM1u1gZYf2pt8BbgL2nZzarw8ym42_fVle9S8Jdn5pK7DzC486WbCSqfa6v-zestETm43Sy6aNh_814q3MMXHfeVsj1HXlnfdv6gdvgh14HK3uCEpSBvF1bjeYAoMEqaSutySMqJ74g5Ru-WJeuti9jUWiSe8W0zyqiHWcqnND8wd5hZPahkFnGf9I7oTX2JnNOzVi8GZoz3q5eraog-9Qc5u4IyIlvzpAbG9B_I6UGbJk-EWUKleQYBIpBsWjxPUQuJFyqRI1MOORuU5alaivSpihSg-7KBLPkiBM3Z-nMG-cJAf8IAHd8vrTs4y34VA0h9nAt8eZAl9NZ0VcroDHAQoprmfWBQzbP13VPf1EmMgaa8vbJolMkWLCJEnvAu-wX7XOfkyTeY8HG4HpIaDfR_BD0w4UrHY9mM9j7Ak4wR8-KLoaI9O9Wrso0Obuec7cC99w00gjNuMzYiWO3rJTsvlvO9DNixS2LTHpKpYZoMzBc4_iHgZiV4vvwvgv97KreR7d_6dTs8rqD9uO7jE3IwbQTPhROwXQOCOGBSq0q_Kcv1Ti9r_bkMF7lolUsKKHP_z_qTpXGswWeky8oZ3l0s8KEDW-yIRCJmMgkA8RFpjJwUcYJaXUHcQ7rCMSQS8KZPT8KBWX5yRfC04CC_stc2M_eiCtQJawoTN74wVKd7lLnlElIxnkFdInFEXzY6zvsZQYcxQJbQUQo5GUpyoAXSuBP0RPYAQMfpAVDqt9nz0580qp_7ennoiM8_7_kOkmRnVW6GR54MHZHJRhJ8weEBO3NJ4iUdXsCocBSELq6Ospb7udhNbGnpa3-_UYYvqacYx4SiP2v4p5yq4_mllqcnDgHKkSoyyU1WnguGjaZsuucCbNYT1ieC-1hj85rgs2XEbaFc3D1auNPSMrWcVx6AS7BSbdk7tvwSGW2JLzLACR7iSIMloQi-ytFW_DnT4XAMTkORO7ve5c5HAiy6tPq34fYfdIjw-LVCT2vVuSNcnfOtjUNwHVJ6P8D7DCp1gEx2PUPpx4tkxziiYQtD5apipIOxPWsi-plwUxUPH-d_VYNqV3X6Z3kX0L9dv7uLcOy6R3Xql5zcKL-wM_fPKhnIA1plW_wniuvjXPI3Rx935pFkqIv3pvvyAzehydQux_fjGljUjQRA-eFX6yurtAlPMu9JrO0vj7C78tOhqFTISQ9vkon10Vb93VK_xI62WXszIuNEwT3lH7Tdc3T3OOVnyYC8NJ1JXe_-GHhMI0ihXA4zZw_0t-nCn9JbhSV4J9sFdxhqcR0ZjsBaRBGfT_MQ47eVOSuTB6KjWV425t9eIT2qLtk8GU-jhtH8j49sJDeYCNrwC3BYfVVOUg8DLV1pQ0q0TQD_tBOOeCuPuEbMYF8AfToNaEm3pyXV621MnjB2dwMQHoGB8dX414uB_9ePedtSZUd6i_4xkPcR5PKBvLsJMg8r-n3KHZ5wzjTegA-KtF2sHm1haURi3vdEFJX3kklyODtikVKaiQq8&cid=CAASJeRo545Yv6DvuKMPZw_IWWKMvRbX6rBZvVnHbVlxCxDbBdo6Qik&rfl=1%2Chttps%253A%252F%252Fleisurelylifestyle.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:22:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4128
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:22:59 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/ Frame E942 30 KB
12 KB 239ms
239ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

efa230a3973395419cb2746d720c89db14d28401636f48514642360656c172ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:27:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3857
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11782
x-xss-protection: 0
server: cafe
etag: 11425859616848618248
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:27:30 GMT

GET
H2

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame 04A2
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/1133689/65389534/xbbe/creative/adj?p=APEucNWlDCKZHKnA3anPDAyCMBgcBBd2T_Wi1L3GdA8uDMwLkm8BQpA&d=CnkAoCZ_4HDYQTaoOJB0GLJN0X9w88PocxGxakiP5ZDHEaVf9GuxHhXoVPRNXxm...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWlDCKZHKnA3anPDAyCMBgcBBd2T_Wi1L3GdA8uDMwLkm8BQpA&d=CnkAoCZ_4HDYQTaoOJB0GLJN0X9w88PocxGxakiP5ZDHEaVf9GuxHhXoVPRNXxmwk5XKnkIirCg8T5IB74sKzMr53...

66 KB
23 KB

220ms
212ms

Script
text/javascript

74.125.68.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWlDCKZHKnA3anPDAyCMBgcBBd2T_Wi1L3GdA8uDMwLkm8BQpA&d=CnkAoCZ_4HDYQTaoOJB0GLJN0X9w88PocxGxakiP5ZDHEaVf9GuxHhXoVPRNXxmwk5XKnkIirCg8T5IB74sKzMr538FvBV1CbyPpKzD6gu3rvRQhQG-WkO-qgo8Mz--sbicJNeQ6dVpoN_emttiyGblKxbIci1F1cT-dEskTAKAmf-CEEm-ZjyaJfCIBVG2wwEv290fV9RIVJOpuaMNVdUGZeS2rBdrqsu1Ju-ynVH61XMHmnNVyr9yNh5-DoTcuaBbRUH7O77JYD5ET5S2v335gNUIGfgKt1tDY1Uc129ypqyEO4FIoICvXbpeZxf_si01Z03Ya3B2Sw5Mxg5hfR6HU9Yb9ljBQQXcFxlupQBgnVv6jSX-DzrIyL5-FvZqpAl3sWriNKjPEV-2nIBmhD9oQukh3E1H60Ofe0UDvJm1OldTe-LOSBK3cnwZzldMpAYx7zv1_0s_gMDD7j1Z4COIU0dWq5IqMPuEc-n1B0W2qk7wR0AWZPQCwYSbNsOpd8ECIUbJ5L31L9LkVug6tFBYXm4cuYS95ekUYAzmmuT6IVXFWlRmz3sb0ubnEcyYZDRcgEawwwn54KShXmQDTb-5aB7o4KngiPISRIXJlUoMnBK7A1DAV5N8TnNCQdnvE82JaMQtr708vfTlb75ioomy7ansAtFMPWIauCj1t4SfU_p1v6IyGqv0EgDvHD9aewxj2yCBBqWv1cP2YIc9H5ibZ-1-zK54vVvR9l069AzNZ-acSGxRu_bD9xD8pRlr5z6IgWZbhU76apWyt0IRFslYqH1Ld3QDsaDtVuU_qVCjuXvAl4LI61vqJwobDAz3ESGHxn_cb4ubSVJOqpCPanlxap0FKE1uz5vYcTF6ENPIIXWe1ezDlUf9S6ULCbMHNayTxUIsGpkoyqXoDE4Tj1Gakx7dL61XJ9hp8Jmu55TTO1ve_aJSfTmHl1QttE0nkA1wh4Z-q_N7Spyp9MtIren0EnfbckqXwcSDBGBMBsnli6-DJMDvQ3FegBfixjytoGBPw5dFF-NqxQZILEuF5Sl7EO_CuHyJ_HO2u3aAYKhtXNjrvxALRVc1vb_VW2c7GQtO3r7NKAVMVqfXghI9wHm7YqtBMw1iO8DuP9OeQk-0MXs3TC7qvI7T8Q8g5UxByqfWtToOK5pc25k_MQEJbfQh-eUPdwoWihmG9Xw7uOuaJ8ydcQemWadDs7jBQFOvsbluMPGjxQ65tY_p3Xk3urQsbcWF4AbWV7h1j_gZNLckydSfIh0t-ZohfBOrpk6KBkjTGdY51_yCHbgm1ivv32kZlKcuAaBLamZ3JqWCqmyPDTtHcAl3R7NmPxBKtOAXeB0yu7APGT9nJFkapAbAcAaCpddYLnpv4sgn1mFbmD3NVBrIumTLvVACz-4aP9j-oeNeOtCldytUBqD_rSLvU6OUR0aejKnNFplOcFzXJw7lCm6l6WzcFsMPqPWZ07R0GVTp0MAUro9clr4xKmCJns7T4e6nlWzF18UqFq1Ez8ICUf5oKo1Ds3sxMCeVPasm5ei3BY2It0xRmnXNPYXa3xdoSp4Q1SflA5g63tVWJRxD-qAfr5wb5NZh3I3SnLjB09dlMOFG-InF6lHZafaWHCpaM50ALxN_-m31aSsSqqb1N8NfZmoDiHF8atak4ywqZF_3Ke7CNNENU7WV1t7fkmTk5MP2VnaflDkEOddnco0EnvryoFvP_L8_sNRsJ-Ji_EALyyl6TbhoKtxN83H7lm5h2UKytsi0lYXE_BJh9koXNDoWnOI8x6A82Lq5SJxVECtpSZpHcngO3rkDUVdxZ9h0p9lQ2myzRjJHArqPkv8hxagJtOBLExOcSHG8fV1RxBhIpydsyTUN0pqjNgfznsf-FiUR64ZrrWPMm4iTt11668uWr3q_Lzzlv1iUJebOEBz-YeWuSo6vun9zgmmQ6nISJjr5UUludCMOGJfaEkfp2bA5aHc62TiGfzZ8Bneo7dKtW1Vmni6P3SLcubgHcEA9Uv1Cygov30NVmerKEQ8juG3ZyKLg4l8MOZdtEamv4W-M5jfztR02EUlqok66OTxcodauvw_d3Ioa05km2doGTUF3nYxE_gq8EqCu662M2f-OBSmbHL50aq7jhdRYMIlaolweWzmNpCx7-c6yDKRo37rhzLWKW-lJuCQc2kuTx2IwG3-FGkZgrdXocJ9-sI96waCtMu1LE6uHl3WtTeTqlrGXuraaAskE81-FKHbCa21eK3lDi4GZ2Vdgyy7r4ZbsrGUiYuD9lVd6BBKXCrYdSPUi_3-DgvxtFlHx21zf7pSuCI1yQBfYEUZqmTfifxAaDHEspE6mH-8zVjphNqI39-nEqC2wiH9RmCwtexlnpST_R0RgWQkt-eY-IKnyazOx4zMTJh-lLRU24cjsDsqXsdnzgdNKM7IUtrRKGk9qH1difnoH6_S0FCloju736f2cxNLVjMLYFCSnrd3vxN7utZvx2StWgzB1eCFgRV43HpQqVpLGuG9am40kVQJSktp9DX-q9ddAUpyUMUIWenTpZ3wYsGgqj97GAn5r7pdks8GwhtZ6fWUb2GlBqiElUwmybEn3pGrmqzL-KnVnk-g0arwZ9D010PyJF1gXH14zD07wNcek9k2HKLvXL7zB8SGyS5DhdFn28LTFZOmCYTL593h6x6e04YbHTS3XfGXrrbIUPSDSofwZnABUusa6sPrfB3OJV-vLWJuNUw2q1MJFyl_AjF97MrrXSosJ4otvl2q3Sof5XIle-GtoJTrul3ZT7jtgDx4be2XncTo0jM0OtKqmEK4C9iIW85jrKOTHPBeReCzBAXy4UETbgcIhMVP27dfSuABE2gAsd8o7uelY8ay7V8aMQxJmgDPEMQCeYtqaV24_80-Ik31jF9oaMcWvMAVlWk5mZmA_NWK28ef5Ed76tyW3M5Aun434JU0ub26EvdKN9MCJWm8AGmNj9AhYDVHiY2enmbdGy5RN8QMR9DFQIwf0No3rIk4okJSpe-I3k-HkHPpMmIJr0yuYxvHlmJpNrgg7acmQ662o1KRVfNkrwtGpsuNO0TjC_lO4cv3H-pGFXXB5v9IPRKbOYAAX0XkVR_oFbjEXBvXiW_plCzdQOSEGhZ8_zhKF5Wsn64cJn6o6OQur_p7T5aW4mHvopKlD31ieRBNn2d2d_RbuzjECCJSLVcJ_Q_HkVISMuptD98tESiWlgTpL_vsMLjngj9D0mcHzNIe0DYi44rwr6J_c0lsZNh8xUxAkxPjiFirr1xrBN7X1rx20Fx8cvEvzq6zlghaMFt8U1PyZrNKHKaepAwrcX2L5T5Z0PwVfWC2_4IGtPms0OGn6VxBgXZ4Dup0GZKpGS5-56qQIwkEpCIdD8DVTE3pV8IgQHWAKkXQ4fpjWi9DyNmQ3FTGllVv3Tmd2XRpsv0rMq3CUWXuvSyI2CTomQWSaxOYYK-51heh8S6pJLOGkyR0sSyxcN2NCjWKYu9SNss0HdipKELmmQ6YQm8QVRGiwIABIo5Gjy5Xk_jbsoOBeSMA0t0qAUmgCkrsxdSwlXhHff0KHns5NG3ZN4d2AB

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

74.125.68.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

774ac5214ef6066206e53ebe950286b00a453bdc82d546d54193968361a26d95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22986
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
x-server-name: app04.jp.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWlDCKZHKnA3anPDAyCMBgcBBd2T_Wi1L3GdA8uDMwLkm8BQpA&d=CnkAoCZ_4HDYQTaoOJB0GLJN0X9w88PocxGxakiP5ZDHEaVf9GuxHhXoVPRNXxmwk5XKnkIirCg8T5IB74sKzMr538FvBV1CbyPpKzD6gu3rvRQhQG-WkO-qgo8Mz--sbicJNeQ6dVpoN_emttiyGblKxbIci1F1cT-dEskTAKAmf-CEEm-ZjyaJfCIBVG2wwEv290fV9RIVJOpuaMNVdUGZeS2rBdrqsu1Ju-ynVH61XMHmnNVyr9yNh5-DoTcuaBbRUH7O77JYD5ET5S2v335gNUIGfgKt1tDY1Uc129ypqyEO4FIoICvXbpeZxf_si01Z03Ya3B2Sw5Mxg5hfR6HU9Yb9ljBQQXcFxlupQBgnVv6jSX-DzrIyL5-FvZqpAl3sWriNKjPEV-2nIBmhD9oQukh3E1H60Ofe0UDvJm1OldTe-LOSBK3cnwZzldMpAYx7zv1_0s_gMDD7j1Z4COIU0dWq5IqMPuEc-n1B0W2qk7wR0AWZPQCwYSbNsOpd8ECIUbJ5L31L9LkVug6tFBYXm4cuYS95ekUYAzmmuT6IVXFWlRmz3sb0ubnEcyYZDRcgEawwwn54KShXmQDTb-5aB7o4KngiPISRIXJlUoMnBK7A1DAV5N8TnNCQdnvE82JaMQtr708vfTlb75ioomy7ansAtFMPWIauCj1t4SfU_p1v6IyGqv0EgDvHD9aewxj2yCBBqWv1cP2YIc9H5ibZ-1-zK54vVvR9l069AzNZ-acSGxRu_bD9xD8pRlr5z6IgWZbhU76apWyt0IRFslYqH1Ld3QDsaDtVuU_qVCjuXvAl4LI61vqJwobDAz3ESGHxn_cb4ubSVJOqpCPanlxap0FKE1uz5vYcTF6ENPIIXWe1ezDlUf9S6ULCbMHNayTxUIsGpkoyqXoDE4Tj1Gakx7dL61XJ9hp8Jmu55TTO1ve_aJSfTmHl1QttE0nkA1wh4Z-q_N7Spyp9MtIren0EnfbckqXwcSDBGBMBsnli6-DJMDvQ3FegBfixjytoGBPw5dFF-NqxQZILEuF5Sl7EO_CuHyJ_HO2u3aAYKhtXNjrvxALRVc1vb_VW2c7GQtO3r7NKAVMVqfXghI9wHm7YqtBMw1iO8DuP9OeQk-0MXs3TC7qvI7T8Q8g5UxByqfWtToOK5pc25k_MQEJbfQh-eUPdwoWihmG9Xw7uOuaJ8ydcQemWadDs7jBQFOvsbluMPGjxQ65tY_p3Xk3urQsbcWF4AbWV7h1j_gZNLckydSfIh0t-ZohfBOrpk6KBkjTGdY51_yCHbgm1ivv32kZlKcuAaBLamZ3JqWCqmyPDTtHcAl3R7NmPxBKtOAXeB0yu7APGT9nJFkapAbAcAaCpddYLnpv4sgn1mFbmD3NVBrIumTLvVACz-4aP9j-oeNeOtCldytUBqD_rSLvU6OUR0aejKnNFplOcFzXJw7lCm6l6WzcFsMPqPWZ07R0GVTp0MAUro9clr4xKmCJns7T4e6nlWzF18UqFq1Ez8ICUf5oKo1Ds3sxMCeVPasm5ei3BY2It0xRmnXNPYXa3xdoSp4Q1SflA5g63tVWJRxD-qAfr5wb5NZh3I3SnLjB09dlMOFG-InF6lHZafaWHCpaM50ALxN_-m31aSsSqqb1N8NfZmoDiHF8atak4ywqZF_3Ke7CNNENU7WV1t7fkmTk5MP2VnaflDkEOddnco0EnvryoFvP_L8_sNRsJ-Ji_EALyyl6TbhoKtxN83H7lm5h2UKytsi0lYXE_BJh9koXNDoWnOI8x6A82Lq5SJxVECtpSZpHcngO3rkDUVdxZ9h0p9lQ2myzRjJHArqPkv8hxagJtOBLExOcSHG8fV1RxBhIpydsyTUN0pqjNgfznsf-FiUR64ZrrWPMm4iTt11668uWr3q_Lzzlv1iUJebOEBz-YeWuSo6vun9zgmmQ6nISJjr5UUludCMOGJfaEkfp2bA5aHc62TiGfzZ8Bneo7dKtW1Vmni6P3SLcubgHcEA9Uv1Cygov30NVmerKEQ8juG3ZyKLg4l8MOZdtEamv4W-M5jfztR02EUlqok66OTxcodauvw_d3Ioa05km2doGTUF3nYxE_gq8EqCu662M2f-OBSmbHL50aq7jhdRYMIlaolweWzmNpCx7-c6yDKRo37rhzLWKW-lJuCQc2kuTx2IwG3-FGkZgrdXocJ9-sI96waCtMu1LE6uHl3WtTeTqlrGXuraaAskE81-FKHbCa21eK3lDi4GZ2Vdgyy7r4ZbsrGUiYuD9lVd6BBKXCrYdSPUi_3-DgvxtFlHx21zf7pSuCI1yQBfYEUZqmTfifxAaDHEspE6mH-8zVjphNqI39-nEqC2wiH9RmCwtexlnpST_R0RgWQkt-eY-IKnyazOx4zMTJh-lLRU24cjsDsqXsdnzgdNKM7IUtrRKGk9qH1difnoH6_S0FCloju736f2cxNLVjMLYFCSnrd3vxN7utZvx2StWgzB1eCFgRV43HpQqVpLGuG9am40kVQJSktp9DX-q9ddAUpyUMUIWenTpZ3wYsGgqj97GAn5r7pdks8GwhtZ6fWUb2GlBqiElUwmybEn3pGrmqzL-KnVnk-g0arwZ9D010PyJF1gXH14zD07wNcek9k2HKLvXL7zB8SGyS5DhdFn28LTFZOmCYTL593h6x6e04YbHTS3XfGXrrbIUPSDSofwZnABUusa6sPrfB3OJV-vLWJuNUw2q1MJFyl_AjF97MrrXSosJ4otvl2q3Sof5XIle-GtoJTrul3ZT7jtgDx4be2XncTo0jM0OtKqmEK4C9iIW85jrKOTHPBeReCzBAXy4UETbgcIhMVP27dfSuABE2gAsd8o7uelY8ay7V8aMQxJmgDPEMQCeYtqaV24_80-Ik31jF9oaMcWvMAVlWk5mZmA_NWK28ef5Ed76tyW3M5Aun434JU0ub26EvdKN9MCJWm8AGmNj9AhYDVHiY2enmbdGy5RN8QMR9DFQIwf0No3rIk4okJSpe-I3k-HkHPpMmIJr0yuYxvHlmJpNrgg7acmQ662o1KRVfNkrwtGpsuNO0TjC_lO4cv3H-pGFXXB5v9IPRKbOYAAX0XkVR_oFbjEXBvXiW_plCzdQOSEGhZ8_zhKF5Wsn64cJn6o6OQur_p7T5aW4mHvopKlD31ieRBNn2d2d_RbuzjECCJSLVcJ_Q_HkVISMuptD98tESiWlgTpL_vsMLjngj9D0mcHzNIe0DYi44rwr6J_c0lsZNh8xUxAkxPjiFirr1xrBN7X1rx20Fx8cvEvzq6zlghaMFt8U1PyZrNKHKaepAwrcX2L5T5Z0PwVfWC2_4IGtPms0OGn6VxBgXZ4Dup0GZKpGS5-56qQIwkEpCIdD8DVTE3pV8IgQHWAKkXQ4fpjWi9DyNmQ3FTGllVv3Tmd2XRpsv0rMq3CUWXuvSyI2CTomQWSaxOYYK-51heh8S6pJLOGkyR0sSyxcN2NCjWKYu9SNss0HdipKELmmQ6YQm8QVRGiwIABIo5Gjy5Xk_jbsoOBeSMA0t0qAUmgCkrsxdSwlXhHff0KHns5NG3ZN4d2AB
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 4AF4 80 KB
21 KB 1346ms
506ms Script
application/javascript 52.84.45.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.45.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-45-31.mrs52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 16 Jul 2022 09:09:25 GMT
content-encoding: gzip
age: 4998144
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 e5c15247ec560744bc8eee50e069c230.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: MRS52-P1
content-type: application/javascript
x-amz-cf-id: dLyrDznenxzUR7d5n7ZZacv2GddKwEtvGhoTpqNQbVKYoxkzzzPShA==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 04A2 43 B
216 B 977ms
290ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1133689&asId=2554d9b5-3795-e4d7-d4de-80446e76c5b9&tv=%7Bc:nYx1Zn,pingTime:-3,time:91,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:24%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:91,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:24,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B85~0%5D,as:%5B85~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:thc9EK2+11%7C12%7C131%7C141%7C151%7C16*.1133689-65389534%7C161%7C162%7C171%7C18%7C191%7C1a1%7C1b%7C1c%7C1d1,idMap:16*,rmeas:1,rend:0,renddet:IMG.us%7D&br=c
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: dt07.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 04A2 43 B
215 B 1250ms
569ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1133689&asId=2554d9b5-3795-e4d7-d4de-80446e76c5b9&tv=%7Bc:nYx1Zp,pingTime:-6,time:93,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:93,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:24,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B87~0%5D,as:%5B87~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:thc9EK2+11%7C12%7C131%7C141%7C151%7C16*.1133689-65389534%7C161%7C162%7C171%7C18%7C191%7C1a1%7C1b%7C1c%7C1d1,idMap:16*,rmeas:1,rend:0,renddet:IMG.us%7D&tpiLookup=ao:leisurelylifestyle.com*&br=c
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: dt06.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame E281
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEKaQIgEXy2NULbU2FLRTXJo&google_cver=1
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEKaQIgEXy2NULbU2FLRTXJo&google_cver=1

43 B
61 B

278ms
177ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEKaQIgEXy2NULbU2FLRTXJo&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-f5AEQn5zmARjvtoXPATAB&v=APEucNU2xspH3uf8WT8cQSL-owXPjEsjPPA6UxWe7N4SEosPSyrjoXeAtiGbEI0m7k9__lYpHqrx8ExVQqeqDRozW6gG8A_2Xw
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEKaQIgEXy2NULbU2FLRTXJo&google_cver=1
date: Mon, 12 Sep 2022 05:31:48 GMT
via: 1.1 google
server: OXGW/0.0.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E281
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NDIzODhjZWYtYjIxNi0yMjNiLWMwM2MtZmZlYTI0YzFkY2Ux

170 B
188 B

186ms
185ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NDIzODhjZWYtYjIxNi0yMjNiLWMwM2MtZmZlYTI0YzFkY2Ux

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-f5AEQn5zmARjvtoXPATAB&v=APEucNU2xspH3uf8WT8cQSL-owXPjEsjPPA6UxWe7N4SEosPSyrjoXeAtiGbEI0m7k9__lYpHqrx8ExVQqeqDRozW6gG8A_2Xw

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 12 Sep 2022 05:31:48 GMT
content-encoding: gzip
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NDIzODhjZWYtYjIxNi0yMjNiLWMwM2MtZmZlYTI0YzFkY2Ux
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame E281
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESELlZzzLmAGdutiygr1Nx7-Y&google_cver=1

23 B
172 B

629ms
259ms

Image
image/gif

23.53.160.138
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESELlZzzLmAGdutiygr1Nx7-Y&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-f5AEQn5zmARjvtoXPATAB&v=APEucNU2xspH3uf8WT8cQSL-owXPjEsjPPA6UxWe7N4SEosPSyrjoXeAtiGbEI0m7k9__lYpHqrx8ExVQqeqDRozW6gG8A_2Xw
Protocol: H2
Server: 23.53.160.138 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-53-160-138.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.8 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
cache-control: max-age=0, no-cache, no-store
expires: Mon, 12 Sep 2022 05:31:48 GMT
server: akka-http/10.2.8
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESELlZzzLmAGdutiygr1Nx7-Y&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E281
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=OGNlNDZmYmUtNzZmNS00ZWVhLWIwNTUtMmYyM2ZkNzdhNjc4

170 B
188 B

200ms
185ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=OGNlNDZmYmUtNzZmNS00ZWVhLWIwNTUtMmYyM2ZkNzdhNjc4

Requested by

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
server: akka-http/10.2.8
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=OGNlNDZmYmUtNzZmNS00ZWVhLWIwNTUtMmYyM2ZkNzdhNjc4
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Mon, 12 Sep 2022 05:31:48 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame EA64
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1

43 B
847 B

638ms
567ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-f5AEQn5zmARi0toXPATAB&v=APEucNU8eB2Hn7xA72f5ER_-CpUx7xuLwi4zANSDBiEGs007bBPrI1oYNOQpETgfyTM9mj-rLbeXikGnA6NZ84p2SLGeSYL8cA
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray: 74964249cd9517cd-MEL
pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3Afd2b3L5CKZkdyCeBDX2ZwljRxmygoh1bbBwYn6JyJ6xJ8iHRD8MlWTxX%2Bp%2BrAegQ7gwnQRkS%2FeMcRtaQB0xgE5gNyHFtWRSJjE9TorR6JMhxrVVv0fyDiqia83KcFTW3F8c5%2Br%2Bp%2BIKw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame EA64
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yx7EQ.9koZaAzakQEtVTuQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2

43 B
848 B

717ms
710ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-f5AEQn5zmARi0toXPATAB&v=APEucNU8eB2Hn7xA72f5ER_-CpUx7xuLwi4zANSDBiEGs007bBPrI1oYNOQpETgfyTM9mj-rLbeXikGnA6NZ84p2SLGeSYL8cA
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray: 7496424e4d1417cd-MEL
pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rGeVzMC2jT0g6YkmTaFbHb1umQuPTL%2BVjQhv4bdXvUXx8Gk9%2F7xMfi%2BGiATUcgpW839NJ8qUZ0m2l%2BzyGXZtMclqid0TmYokurU%2FTCrH%2FQQ4yGym7xBMaxZrKskpljQ4b7bJB2bbF4qrQA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame EA64
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEJq3bwCQSYiDR-GS0u9z_ds&google_cver=1

43 B
1020 B

245ms
243ms

Image
image/gif

104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEJq3bwCQSYiDR-GS0u9z_ds&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-f5AEQn5zmARi0toXPATAB&v=APEucNU8eB2Hn7xA72f5ER_-CpUx7xuLwi4zANSDBiEGs007bBPrI1oYNOQpETgfyTM9mj-rLbeXikGnA6NZ84p2SLGeSYL8cA

Protocol

HTTP/1.1

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:48 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: a6e098c7-5a67-42ce-9196-66f447d7a132
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEJq3bwCQSYiDR-GS0u9z_ds&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EA64
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D

170 B
188 B

185ms
184ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D

Requested by

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:47 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: d8cdf817-3233-4656-9f59-d817bf1a192b
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame E615
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1

43 B
848 B

414ms
342ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-f5AEQn5zmARiNqoXPATAB&v=APEucNXtZZDlGnpa7tfBE0sm-t0gT5WMwDneSvi6xqL0DspiBrRcdERaCFHp1Bx_0n1KLDZH7MG-3uLPd8zWofeWfo1JVGASgA
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray: 74964249cd9917cd-MEL
pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kpxnUYhQX5DxMPnuzZJkuKnLeh9nlCCtBqGGqXNWpVKqqqtV%2FG%2F8ISmBoCe56i%2Ba%2FM3O0BjWlIfpdrUfOvmjqs9axshq4Ri509vNDM6Vi8S9937Pezc5QS%2BlJaZOpU6XXPkDDUVG%2FAPe7A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame E615
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yx7EQ.9koZaAzakQEtVTuQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2

43 B
843 B

344ms
344ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-f5AEQn5zmARiNqoXPATAB&v=APEucNXtZZDlGnpa7tfBE0sm-t0gT5WMwDneSvi6xqL0DspiBrRcdERaCFHp1Bx_0n1KLDZH7MG-3uLPd8zWofeWfo1JVGASgA
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray: 7496424dabf317cd-MEL
pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yX9VJZHieqYr32HdR2vgZjW%2B4M0ZWQqmuYlUYvVMHBgzAcfgY89Jz6ELDX0rhW%2BMP8Ynp390IPXgTJsEKPf1FKMclZMzWsyrAgAkyWVZOs6gn7mvB5QfY5ppkrfCaGJEhhpYgMb7lQbPXw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBcSIT8WnPiIIgW1aRHcBwU&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame E615
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEJq3bwCQSYiDR-GS0u9z_ds&google_cver=1

43 B
1020 B

230ms
228ms

Image
image/gif

104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEJq3bwCQSYiDR-GS0u9z_ds&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-f5AEQn5zmARiNqoXPATAB&v=APEucNXtZZDlGnpa7tfBE0sm-t0gT5WMwDneSvi6xqL0DspiBrRcdERaCFHp1Bx_0n1KLDZH7MG-3uLPd8zWofeWfo1JVGASgA

Protocol

HTTP/1.1

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:48 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 6efaed35-8ab4-483d-8602-1b0461ad8af3
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEJq3bwCQSYiDR-GS0u9z_ds&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E615
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D

170 B
188 B

187ms
186ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D

Requested by

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:48 GMT
X-Proxy-Origin: 103.209.254.118; 103.209.254.118; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
AN-X-Request-Uuid: a6714a4e-1708-4190-99dd-34013fcf483d
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQxMzA0NTY5ODQ2NTE0MTYwNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 8F88
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=3658&xuid=78445e74-ad34-43c4-9f4a-e88d368c9e8c&dongle=0cfd

37 B
354 B

196ms
187ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=78445e74-ad34-43c4-9f4a-e88d368c9e8c&dongle=0cfd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://eb2.3lift.com/xuid?mid=3658&xuid=78445e74-ad34-43c4-9f4a-e88d368c9e8c&dongle=0cfd
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 209

GET
H2

200

ebda
eb2.3lift.com/ Frame 8F88
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjgzNTYwOTQ3MDMxNzM4MTk5OTI1OA%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

188ms
188ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 248
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 8F88
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESELUUN4x3N0pHPZuYIiw5Ihw&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
354 B

192ms
190ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESELUUN4x3N0pHPZuYIiw5Ihw&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:47 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESELUUN4x3N0pHPZuYIiw5Ihw&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 332
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8F88
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjgzNTYwOTQ3MDMxNzM4MTk5OTI1OA%3D%3D

170 B
188 B

187ms
185ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjgzNTYwOTQ3MDMxNzM4MTk5OTI1OA%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26f%3Db%26uid%3D%24UID&ld=1

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjgzNTYwOTQ3MDMxNzM4MTk5OTI1OA%3D%3D
date: Mon, 12 Sep 2022 05:31:47 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

/
p.adsymptotic.com/d/px/ Frame 8F88
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=2835609470317381999258&dbredirect=true&gdpr=0&consent=
https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=2835609470317381999258&dbredirect=true&gdpr=0&consent=&cookiesTest=true
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=d3d469e6-4737-4fd4-90db-b1aa8d855535&_noobservation=1
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=d3d469e6-4737-4fd4-90db-b1aa8d855535&_noobservation=1&_expected_cookie=789d4c9...

43 B
141 B

198ms
198ms

Image
image/gif

104.18.98.194
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=d3d469e6-4737-4fd4-90db-b1aa8d855535&_noobservation=1&_expected_cookie=789d4c98c521cb403aedeb0ee950aede
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Server: 104.18.98.194 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

p3p: CP='NON DSP COR CONi OUR BUS CNT'
date: Mon, 12 Sep 2022 05:31:49 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 74964251edbd5a91-MEL
content-length: 43
content-type: image/gif

Redirect headers

location: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=d3d469e6-4737-4fd4-90db-b1aa8d855535&_noobservation=1&_expected_cookie=789d4c98c521cb403aedeb0ee950aede
date: Mon, 12 Sep 2022 05:31:49 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7496424fa8b25a91-MEL
content-length: 0

GET
H2

200

xuid
eb2.3lift.com/ Frame 8F88
Redirect Chain

https://x.bidswitch.net/sync?ssp=triplelift&user_id=2835609470317381999258&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=triplelift&user_id=2835609470317381999258&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=581216dc-757a-4ba2-b89a-452fcfb34d99&ssp=triplelift&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10522660534743323572&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.vi...
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=0440c417-bdb7-4c3a-b6a7-1de9ed8ccecf&ssp=triplelift&gdpr_consent=&gdpr=0
https://aa.agkn.com/adscores/g.pixel?sid=9212302828&puid=10522660534743323572&ssp=triplelift&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2?tagid=V2_785409&src.visitorId=232173304272003584616&ssp=triplelift&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=419&user_id=10522660534743323572&ssp=triplelift&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2409&xuid=581216dc-757a-4ba2-b89a-452fcfb34d99&dongle=d3d3&gdpr=0&gdpr_consent=&gdpr_pd=

37 B
354 B

192ms
191ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2409&xuid=581216dc-757a-4ba2-b89a-452fcfb34d99&dongle=d3d3&gdpr=0&gdpr_consent=&gdpr_pd=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:51 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location: //eb2.3lift.com/xuid?mid=2409&xuid=581216dc-757a-4ba2-b89a-452fcfb34d99&dongle=d3d3&gdpr=0&gdpr_consent=&gdpr_pd=
Date: Mon, 12 Sep 2022 05:31:51 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

xuid
eb2.3lift.com/ Frame 8F88
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/2835609470317381999258?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-0kjobKNE2oSzqZ59yUSINta0475RFFbmAhypTywH5w--~A&dongle=0883

37 B
354 B

193ms
191ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-0kjobKNE2oSzqZ59yUSINta0475RFFbmAhypTywH5w--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Mon, 12 Sep 2022 05:31:48 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-0kjobKNE2oSzqZ59yUSINta0475RFFbmAhypTywH5w--~A&dongle=0883
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=31536000
content-length: 0
x-content-type-options: nosniff

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/ Frame 8F88
Redirect Chain

https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=0&gdpr_consent=&uid=2835609470317381999258
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=0&gdpr_consent=&uid=2835609470317381999258&dcc=t

0
0

310ms
309ms

Image
text/html

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=0&gdpr_consent=&uid=2835609470317381999258&dcc=t
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26f%3Db%26uid%3D%24UID&ld=1
Protocol: HTTP/1.1
Server: 52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:48 GMT
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server
x-amz-rid: 5S5P390JGZ8Y9302NS07
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=0&gdpr_consent=&uid=2835609470317381999258&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 c.gif
c.bing.com/ Frame 8F88 42 B
667 B 457ms
238ms Image
image/gif 204.79.197.200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=2835609470317381999258&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 204.79.197.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS: a-0001.a-msedge.net
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
etag: "6fa9befc56b2d81:0"
last-modified: Wed, 17 Aug 2022 16:32:48 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D43C3C32248941AB9415C9FF221CCCD4 Ref B: MEL01EDGE1320 Ref C: 2022-09-12T05:31:48Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

GET
H2

200

xuid
eb2.3lift.com/ Frame 8F88
Redirect Chain

https://b1sync.zemanta.com/usersync/triplelift?gdpr=0&gdpr_consent=
https://stags.bluekai.com/site/23178?id=LIJnLhWZY29Aeu8cZR98&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLE...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLEMJQTQJTFPBRWQYLOM5ST25DSNFYGYZLMNFTHIJTHMRYHEPJQEZWWSZB5GI2DMMBGPB2WSZB5JREUU3SMNBLVU...
https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=LIJnLhWZY29Aeu8cZR98

37 B
354 B

189ms
189ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=LIJnLhWZY29Aeu8cZR98
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:50 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:50 GMT
P3p: CP="We do not support P3P header."
Location: https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=LIJnLhWZY29Aeu8cZR98
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 115
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 setuid
prebid-server.rubiconproject.com/ Frame 8F88 0
669 B 266ms
250ms Image
text/html 52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-server.rubiconproject.com/setuid?bidder=triplelift&gdpr=&gdpr_consent=&us_privacy=1---&f=b&uid=2835609470317381999258
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/html
content-length: 0
expires: 0

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame F876 41 KB
15 KB 170ms
169ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 12:36:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 147295
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 10 Sep 2023 12:36:52 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 04A2 43 B
215 B 1194ms
568ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1133689&asId=2554d9b5-3795-e4d7-d4de-80446e76c5b9&tv=%7Bc:nYx20l,pingTime:-2,time:151,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:1673,beZ:1674,mfA:1676,cmA:1677,inA:1677,inZ:1681,prA:1681,prZ:1692,si:1698,poA:1699,poZ:1721,cmZ:1721,mfZ:1721,loA:1766,loZ:1770,ltA:1823,ltZ:1824%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:true,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:24%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:151,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:24,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B145~0%5D,as:%5B145~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:thc9EK2+11%7C12%7C131%7C141%7C151%7C16*.1133689-65389534%7C161%7C162%7C171%7C18%7C191%7C1a1%7C1b%7C1c%7C1d1,idMap:16*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:0,renddet:IMG.us,sinceFw:124,readyFired:false%7D&br=c
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 0DD0 41 KB
15 KB 176ms
175ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 12:36:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 147295
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 10 Sep 2023 12:36:52 GMT

GET
DATA 200
OK truncated
/ Frame 0DD0 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c331433b904a90453e1a748fe9c4340c13250f5ad7e60255117dc82e46595da3

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame F876 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e0f9bee927311e12692b0d209e127819a9716250a0be97bfc014e4adcd08637e

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 0C94 41 KB
15 KB 184ms
178ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 12:36:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 147295
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 10 Sep 2023 12:36:52 GMT

GET
DATA 200
OK truncated
/ Frame 0C94 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 31ceb3fc51774bc448d03620bc57317126cdf0c7cdf97d1bbd181b8b3c2bf1e4

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame 0DD0
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1102537/64448508/4.js?adContainerId=brand_safety_QsQeY5jlO97cz7sPiIe7yAE&cbFunctionName=goog_wrapCb_QsQeY5jlO97cz7sPiIe7yAE&true_pb=&adsafe_pb=https%3A%2F%2Fst...
https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_QsQeY5jlO97cz7sPiIe7yAE&cbFunctionName=goog_wrapCb_QsQeY5jlO97cz7sPiIe7yAE&true_pb=

1 KB
1 KB

883ms
538ms

Script
application/javascript

52.84.45.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_QsQeY5jlO97cz7sPiIe7yAE&cbFunctionName=goog_wrapCb_QsQeY5jlO97cz7sPiIe7yAE&true_pb=
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 52.84.45.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-45-31.mrs52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 16:07:55 GMT
content-encoding: gzip
age: 480233
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Tue, 06 Sep 2022 16:07:48 GMT
server: AmazonS3
etag: W/"33dffa7df253125904b2f354b5bb5e8d"
vary: Accept-Encoding
x-amz-version-id: EIole.IHkiDJxKVfO1S7cyRYWKsHRRtd
via: 1.1 e5c15247ec560744bc8eee50e069c230.cloudfront.net (CloudFront)
cache-control: max-age=604800
x-amz-cf-pop: MRS52-P1
content-type: application/javascript
x-amz-cf-id: LIMe7cNEYAH0PfKSBPWJlEv9ZSbDmXEcx6MSfGsU6tvCx7VKu0AhAQ==

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: app03.jp.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_QsQeY5jlO97cz7sPiIe7yAE&cbFunctionName=goog_wrapCb_QsQeY5jlO97cz7sPiIe7yAE&true_pb=
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 9A5E 80 KB
21 KB 1472ms
862ms Script
application/javascript 52.84.45.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.45.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-45-31.mrs52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 16 Jul 2022 09:09:25 GMT
content-encoding: gzip
age: 4998144
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 e5c15247ec560744bc8eee50e069c230.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: MRS52-P1
content-type: application/javascript
x-amz-cf-id: -bl_7_4zEhfcED2kzne_a9_umaFtsajD5lMJnEPAWjDzAaH4nN5lJw==

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame EE34 41 KB
15 KB 169ms
168ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 12:36:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 147296
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 10 Sep 2023 12:36:52 GMT

GET
DATA 200
OK truncated
/ Frame EE34 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d36aea1be972289db7a3e47d5b11b28df6ad0928a29efbaa2fb241a8fedd9511

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0DD0 43 B
215 B 761ms
292ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=448f140b-7a05-9ebc-3cc9-516fb1a4642d&tv=%7Bc:nYx22T,pingTime:-3,time:73,type:v,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:20%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:73,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B67~0%5D,as:%5B67~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:thc9ENQ+11%7C12%7C13*.1102537-64448508%7C131%7C141%7C151%7C161%7C162%7C163%7C171%7C18%7C191%7C1a1%7C1b%7C1c%7C1d1,idMap:13*,rmeas:1,rend:0,renddet:svg.us%7D&br=c
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: dt13.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0DD0 43 B
215 B 1040ms
575ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=448f140b-7a05-9ebc-3cc9-516fb1a4642d&tv=%7Bc:nYx22V,pingTime:-6,time:75,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:75,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B68~0%5D,as:%5B68~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:thc9ENQ+11%7C12%7C13*.1102537-64448508%7C131%7C141%7C151%7C161%7C162%7C163%7C171%7C18%7C191%7C1a1%7C1b%7C1c%7C1d1,idMap:13*,rmeas:1,rend:0,renddet:svg.us%7D&tpiLookup=ao:leisurelylifestyle.com*&br=c
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1102537/64448504/ Frame 302A 234 KB
70 KB 241ms
240ms Script
application/javascript 54.92.10.205
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1102537/64448504/skeleton.js
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.92.10.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-92-10-205.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 867343b12bec067fca49bc7654079fc50515b400bc6fde6cd028352ababce7d4

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 302A 106 KB
37 KB 481ms
180ms Script
text/javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Origin: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 02:37:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10475
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 13 Sep 2022 02:37:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/elements/html/ Frame 302A 8 KB
3 KB 189ms
189ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DorFZ9cajGTJnFpulaT9PpqHSXcidraOljD43h2i7GNN9MA07qw9VBVjPSs5E82FboRJmDqO9RnHzO7TMPRNtFjKSYVLkQ19369tzL7fDNGgPwrahzZSrAttQ1bX2yd_UAPfvzlCWu9bFDeetBLqADOH9Agw&dbm_d=AKAmf-CV7pcKfmUYJxYsPRCMLzwgzkrr5xxDqV5IlYvK5CrMTr71D5W18zyh_EwlqSjjFs69KwHx7DAXXiezyYmbJJlo-28TpsWso7Rii4agujV8BrC4Gkgqt9_4LHv3xqhiclf5abmVJzHbWQAH6YzIkNxFd9Cv8vu7b4pyXX97xILdaYAMv-J7pp2fIPqC7bND_xFbUnB5tkEIgWTNJ0HFtj6CU6NnTNdrVPNYi6g0lC7iqIlBuhIqhnROqmoEVDe4h7wCpJC7mNUzS1iqlb2gevvt2e-vWuMgp87s-wBuAl4lmiCeB3pFR_j5aha1PnfjaXKVqmb6xyAdKOdeQaojAC7pKrlHP8TXRARPZsy_-Gdqb4tl6o_3Qw7WprSC6-uQJROp1WeppbLvuTkpXk5z7heOP7BDCgCIskhPsCLbl1p62jXVBYZFWhlGSZxd6mhGIJXd37NreCjPnLhy6ZXGesjzyqJ302YwB6w6J9xMg_5h2QVp7B8_d50GpnFU8pYtg1KIg8mR3DHie0UuSr5bwoXheWcN8hkOykPIHxCshglFS31WcfJuA-pfffYWlMp3w0dRcV_-r5Q4OkNdhfFiEB-koRM8Mj6qSUB6F70sRBSIsVdiaRT0x2-RfIHVNYUg9rR9EQDGBevT0ZEaEU_K1xOjwtfWfX2M-n_vUT3Lm_z-N6JSwZ6fTyyThkH-7mye4h1yUvHMIrsIxotQnUMK9aP086bba8d66B5KoFZMMWswUW79dC2S3cbd3aYGDJ6XEdXLURuG9-VzxZQj7HndlVHNiXqT-emM7bpp7g8CudQYIadB1KlTsqyzhYmJ_taH5Dr94kFXX1QMWhJrLSRqEuw8il8JQkcLot0UKo2vtdstkJoscUi7ovj0futscjmgTZNXCHS_yN20rDx8OCbFG7kqPL01t6MyyVjJQCMvmOw_VhBeTM7G9lcOZokigtxLmRs0tJ6KFcjKoQ1JtNzydHeyjFCpW5mFSO9kGZh0u6HMqswVX1t46SJ-IFTG1wznsFqLiIKDWjgHRMN07onvSVew11ciWFKHYbnRNPyKSt8-Zwr5Fhs7jmS4yqqD23WfgpO00dUMgSBhC85NqY0IhtvP2wnpRqIPqVR6bLXvDBbtLXXR4pYsJQUJH2ZhsTnXP-gpxxODuGwY_Kn7uz59UwHLJV7pJbd874xzyhbTBJOJayeVpyq_u9SFNstS8ifQmmcXUniXjjp17HGyU8wPP3nks4aRYmHxv9-csF4-1XDApAKTX5mu4Uf5vRKx8XCjhMxP9utGM677Fvz8vSibsU_WDgIcrxl_RbQtLXb6RM5A2N-SP5xYnO4mHyWRH7mbM1jawvdU8IQEvn8cuwqCrOxSX07MEzpcJLFJlSYlCkGFQljh0EEtIazUAllGRU89LE_gPOO00t_wqIVYqTzNUgLRGkOsjiH4d47bFBJXWP2I-V0_CnzyrDSxQQvVI1UGgYdq2d2zu9ZzH0kB7hUGGKKh6_1n3mNJ24ls4bMKMF5fdRO_sv-dxJUghjlwFH-mE8gLNGunkw0u_zXDQN_Hw25XiRSgupOX1VmSyJlvgG1fY_GEL0DGD6OTh3JxnMB1AN8Maktqb6wa4hUXf0yg1D4vztRMZF77FKd3lWGSMYRPXzNubMk7itn_H_8CLbiLkGP4T-m8Bl7VRmP1R5t7ynLl9xuHHydFtpDne1r9SgYXKAm8TBbsBHb0ShmtXoGvJthm-IXW2yCItsWiaHG3d00FJj5a8c58_v9kQMVMjjq10gWn5-izNVg-2DvduKonyQXkQTy1HRtWKm41Hf6PIhmtHE6mfpA7gdQBhVm5YScAYXf-RfdRT-URYtnkdGwhDULx6DkBTti-qtU2RhFB1zlqbKwoJtBA0DHU1kTajkA50GX0GsXTw4T6GSzq9-PqR8_ilvS9xFwAnOOgQdjBNasOQmKdird1Qli6N703ELCGeSToeeuZvLNUh5FU3JhYW0wrnQvvImnrYd-rQanK2nWXNDTzFkVRJvbfO7fNljWL9oVCTaHLyEmKqEK_f8CzCg7HyBp_-ai8AB01xUGwL6pdaB8Qh8Ycp22_ZHkCS94vomaDr6FTg5dUGsWAupq-JS6knVytNKny69mdFiVc97dXBPKDWwUfqVZyZSMr2VNMeVxcjuUonZvVmn0DofzzeWuCAec0m7xEkfKMFX5ToJG8CmqaLzEmDfmzhwz9qM3t8E3AZyEWeRsPtbx5NYAtF09-6DkklTAho1_J2wyLwbBLitatsLTeM0sEgvYrqr6ziiIZ7hAzq0JVfP4MQx4DiG8W-wK_cdlVXpWkiAJNMGh0CyQtvsmTflJIl2t1Qcg1aNeihpFJ2sG4PPf3VMOI1enDu_wGuIMtxhrkRsE6b64jWFrt78dttBW8aKUAMV3Q9nSlz0OhrENqk5aLcwD1EZrqecxsnjlDhismH6tU0Mvd7WLuCOq1C4IDfqRXt5QzWS7WS5MMGA7LSKox8AB9uBdhg23nJ6zzjNk3elE5Kdrs4xYTZ663SpkEuor45dMtfUM5f88dtF9Y9KetVJLqWSk_JxniMseUlpbN5lRGYrtR4RLn2u1saJEfkwDmt51JzJgien9jj4cgkK0S0JTDETL_OPI2Dq9TwfRcN3Sk_W8DydHptuqTLKpq5kMDzhXYE6ywzdaM6BZ2RElmmU41ScBVFpcIUEmfbKOdAeYg_roMcHMhV9q2q1kVvb0M3NCxjZbec93qJpBeABtgGYbyteF_qejXhk5nrF2t-S8tP8ZwFeWH1MUU5fUbmYkmUg5Me0ljdyBc-ym6DFfZYr5s-DHpmIkBeylwiUb7TjWM4jgnLNxbRzbevyuEi-gFubSSnpFAey7CYESQHW3mTuefGlzplc6cAvplgnvd2L4ntVEiR2fEEfkiKeQRlhD4qnNq5-kMnMxjlF3xh2YIwJSQFCHxmlyoZDUHkMryXJuSAeUAs8qNzirhGvtYom-gsmSKw7lRvjUJh8qpnpJl4AzwsUPNvtZ3EOR-qtqJLHBn_F3-JESEhQ3Z6iylKmR-vdQPlDoiME3xb--X0xb0eWygM5xOGcJIwfGaFSbjADp4tSqoT53pk3NelfykD9PikGokJLomyPb-fPu6TBaqrv_1GoLfP5BC_FhUvPcbNKYnl9xAbgAdKFkBFaDIxAWsewLXP3t68xLmthi6qF04CN71NwqbQXPMPlEIyELUGn418Gi_1XugnuU2Nj4QnjjYhJIt5gtChBCUNljwRIse560h5fTWfcZ55KwCWx0BrjZETpyxB-c8We2mKkD426HGLHVE_wjf__A&cid=CAASJeRozUIFCUUjx61FNetGpImfms-04lRm99bIr07dLH1cScqDgmU&rfl=1%2Chttps%253A%252F%252Fleisurelylifestyle.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:22:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4129
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:22:59 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/ Frame 302A 30 KB
12 KB 195ms
195ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

efa230a3973395419cb2746d720c89db14d28401636f48514642360656c172ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:27:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3858
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11782
x-xss-protection: 0
server: cafe
etag: 11425859616848618248
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:27:30 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1102537/64448508/ Frame 73F0 234 KB
70 KB 242ms
242ms Script
application/javascript 54.92.10.205
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1102537/64448508/skeleton.js
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.92.10.205 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-92-10-205.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6dcba6225ac5cbe9c5cc15ec2c2cd96812e1145104b181d4ef2a78baac2b104c

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 73F0 106 KB
37 KB 508ms
208ms Script
text/javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Origin: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 02:37:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10475
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 13 Sep 2022 02:37:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/elements/html/ Frame 73F0 8 KB
3 KB 191ms
190ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A_2TUvuVrILnhZLH27zXKIAEWZXOE1_3DwXJqz-ZTyWyWLjOPAvVqaCKY0nhP-GPRXv9rXmF4pb77x2tEz7XpVCw6VLvXXsXAiYBJgx6srONawkFiyZHXWPinV6HhEbAixUDU7XeXnwDKbMrQqIEp5_Y8wVw&dbm_d=AKAmf-AiXbmkwpZDN9pSaVw9SeTNQjJO4pVbY0EUR3uD4dmnIYyYvjws1U6znerKFB49qjrNMHQzMKQiVpaOdW_FePQWydH2UDF0KiW_luL8lX7nltVhzsYXh3TCwu_eBsIahzAAzUKoONBGs4CLmDD1x9orLUP9lbiAcNUQfC0VHt1E5TGAVS21RZOJ1Im3Nxw3Mbc4dFSD1qnmvdJZ0ZWufHU12Ojj3S_XSlNL1E8QNmUB5krTNIAFFbl1r3YUQo5sxWmSmyrAU0Smg3qK1vKprXnJOIj-nNqv4QuKUdM3KiUjt9NOann3Epj_ORPoTIsBsIXBQ0fRPqXVxXIgjdvxSyix44FLUe--RcjGydvROCTI5HcW-MPaML6KBs0eVAuWBxGC6p6ZHV5-u8if8m4P-cfuTrhfPIZ5ZFtYLf9ooI-RzlxFl8ScEbPf9GtC5jm3oZ3wmc1u8wyBEolwD7g6qq_nEEH4Exh0RJ_MF9HZFmolnrPnATxzxh9dwSiegNgKYKt74tS24U3ht5ERpc34Ah8UtXc4NIwn9wa2gTWll2yX9TaoxfyC9z5oiOTbokYtdqv-i83a00ZoV1n4-ohvfs1dUwMJczZaZl8fkIRzMEw5jHZgB3d0_11yyHiZa-mcec_6VVakjGj9RZ9Yb_ll6tyHt7PpIRlSlZE928QkFIhIFeY3M6gE3b4GEgTC7SqsBDTlOuQa9akyeWECg9cwx2WGCX78miq8zz2q4lqddTYlpRwCNvaT4fbgbNoWqz4yYxBP_t6wmnd73v4EXwfj-SqxdVUGw3pkT37iSBTWv4k3K9m7EgT8xXxCI4M2UG_YkJQ314qoXhzd7ACcRucUZAptZnWylUfeFbhK3HeQXnEfdI8T64pTJ9NOmjrLmtFhtmgsGyP7D_LI_mblKGfEj6twOw27S7hxXNlye6huDavuJkQu5OxZWylqm-7CRzyn11o7qbhCOlWQWEcQUX7BGVMFpWdgW4QK4WEXB0Gj1lvYjKtpOuDhzGbhAVjNJi6SkaCWrrvj7609BudZLrMugjgcYSuJL4k6sJhuqd8UM4GbBDDhMA1ChN6WjI02gCHg6WJ9TvsQ2V66kDpJ3bE3VE-xv8HlthRTclbR8tUFkx5m15c4eavEOzW6lgG6xlN6Hrgck2uR4Ke5yBPeCs8hNF3rgcbYWY1nyFq7QZYWovPveFEMR099ght48LiiFTPj06ysyk-BzBOZV5c-FH_aoOO90nNrp2jziWyurmCzEiYJnoibd2eTYhOckWon7YgM5I5OCJkGXh-kscW3fyBkGfS6tD9jB-Fi1PA1l6h2GVPKGaHYZFxayy8tny1XQ_0Q3gVF8jJrASnMuDFGSryhqiSMlUDcMsVHopHDeYiRGAiBHBh3WvAH7-udOCz106RDKyIYH2Mq0dQ0Vn9jFDslzRFZChvJIbL4K5ck4iQixbXqM-RvhwCvxMaEOaXrqDiOTJiMvPrARIeP2WVtJU5toXexhPEpGr9N6yUATcUiKrl0K86g4Vr5HkpjdQuAhaiYcwjhI332lmJUHS1Hv0dG5NCQ3eCfUxmJOXFiCTJfYfqCS4l4jrsjwYnsyfe5HUhju5Xe7KAZo_gKhOd3IAKr5TgqXSkHO8s1hGAz4zASg-6pVMNxmTybLZEsNyn_oCBNLt3X-P9HdpTSiAD8wP19NAYUs6DY9qKSnsmuvdJYEwaHNvoWHbpLeddTmhThbCxCDrickG2dCgD7AftlvRUAnabuCqR99yctUrKO6eVvXrvGf4_ZmmMe12ho1E2r2sMR5pWJgg0LXmgZQ0K5Thtx0jxygyshTEwn0ePBIZ9E8UhmC-0tn776w7VnP-bE6RBL54srRF_608CEasN0NjoQNHpZK_d1PibuZmCUbG2Q08ms22YsXwvAtXffiipzLbWFCFSlLf-KLV3yELmpLc8oOD2S785jd_kHxYIyG4tquzNmYdYGyiK1de4oEjNjfevPx8cEjMtJnCiM-7yTlNGkG7PqkhxK3hJtQk_F5d8ZJjmDmwyJIgJEX9ZAK13GZjJxkP9QywGvy7dRUlR_T_XOMURsNsUyLbBQ-1tWxnVfxY_HC2hr4va_0haycrT-AfAARoRn43Gjc3QgVTJPVtFxLLtZ_te2E8JVPROmTWaBw6uRxL_CL7rRH4Bif2WJAvcwLluW5iRuH_dzUnpH1X7PTw0k7UsknxNeki65vB2nXY6O7jJQatoqItLQwadrC8FaEI56j4VhtKv7q1zHg20rNL7_U2AC3EjxUG_ZtFA4aYFmkPlODWm6Q7YYsA49xEiMQy4k5G8OEe-AsqEXCQ2PLHePYKWstyMS-PeXU-aZkZYIXKgJzmAXTz-xANtcGMNv9BRXFeEknT58abONLYAdZvQkc-D-khjukNbxyQ9vb45OKLy4Dt_OeuccgszO-Yy1qZbpoz9TK_06t5WID-7yJ4RhTde-wYgf-HmxNRuULfXiOaWTy0-XGVPc3MSrlXNhroR-n_4L--Yq5MutQZeZ_62HgT2tyHsD_OURN5llU9f4YTbPiDJgMmoYxrexUCEEPTpy-qbgTFY2TVFuV3DMmaPD9fBSu-5HKB_gUTzpBNj0OvfR29H80mqOx4rd_6mNPR8YQSJ2zz6XJSSpv7Tp7sJxK65P9lvHXBpdWOJxLKM575F7LPHzfYT1Q7vcgFJN-K07QDw9KUKeBVAE-Zs8zukHvRZ4LHumvp7ZS9DA90UsM2GPJV0pCJft-aXjUXsBQMULh1CfDvt0WvbSUPndyOfL6BM_cX6h4XAFnSVjN6hzixywAUfw6PMC5jo7ey6-Kx_nYTuSPTol3RML9XzUtCuojXRD6JQt82UXx4CniCvJ67Wj-mtJRaZYWjm0WpiPVGz2ucXwiF6GCVhfZgTqwYJaQT63iipDKse3Oi3db_IAB8BJchc2XtePk3iVyYljkTjQwa1xitRS0PwfLXQODa8wbfCKap0pe77Ccr8c1sst_ZaoK07ubZ0O243Tge8YJCWEwVLzoVpzOmyZSfcu7rDLJga1zDx0JmndBjCRnWzTIY-wBi0lQMkTg5hHaosxhl6GxU5hhAw8EM3glG9hYtnMaSC1z9UgSeclcci9EmGU28YKeEvRY3CPbqOpSK1PiWOJ4rNrSFIKZnAvpVf5Y7gKXE3qtNokmpCdlOmRr9BdGbaCtHi1zdSKf8eLwXvT7k_J2hsmJ2ghCeQg3PXnclW1HTfF10sZU6mj0RkKeNGi-Wp7z5XTnjgpXo-5ZW9p91KGNSnJhEjTcRVfwesqzjfMTtmOig&cid=CAASJORoOYm1qMmMKCIZBKLzxrcCIbU4Iaoi3j9zxBy7slNd_-gMwg&rfl=1%2Chttps%253A%252F%252Fleisurelylifestyle.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:22:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4129
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:22:59 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/ Frame 73F0 30 KB
12 KB 188ms
187ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

efa230a3973395419cb2746d720c89db14d28401636f48514642360656c172ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:27:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3858
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11782
x-xss-protection: 0
server: cafe
etag: 11425859616848618248
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:27:30 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0DD0 43 B
215 B 1007ms
571ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=448f140b-7a05-9ebc-3cc9-516fb1a4642d&tv=%7Bc:nYx23q,pingTime:-2,time:106,type:a,im:%7Bsf:0,pom:1,prf:%7BmdA:1522,mdZ:2109,beA:2115,beZ:2116,mfA:2118,cmA:2119,inA:2119,inZ:2123,prA:2123,prZ:2130,si:2135,poA:2136,poZ:2157,cmZ:2157,mfZ:2157,loA:2189,loZ:2192,ltA:2220,ltZ:2220%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:100.100,dom:div%7D%7D,env:%7Bgca:false,cca:true,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:20%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:106,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B99~0%5D,as:%5B99~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:thc9EK2+11%7C12%7C13*.1102537-64448508%7C131%7C141%7C151%7C16.1133689-65389534%7C161%7C162%7C163%7C171%7C18%7C191%7C1a1%7C1b%7C1c%7C1d1,idMap:13*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:svg.us,sinceFw:84,readyFired:true%7D&br=c
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: dt12.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame E942 41 KB
15 KB 173ms
172ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 12:36:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 147296
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 10 Sep 2023 12:36:52 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 310A 1 KB
749 B 196ms
180ms Document
text/html 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

age: 86381
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 11 Sep 2022 05:32:07 GMT
etag: 48472445140208031
expires: Mon, 12 Sep 2022 05:32:07 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame E942 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 54e8c608b3cdca7b95089e67d735f407141b252ea14e7f5bc815e7aec59bd28d

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 33EF 22 KB
8 KB 175ms
168ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 161474
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 10 Sep 2022 08:40:34 GMT
expires: Sun, 10 Sep 2023 08:40:34 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame DF99 22 KB
8 KB 182ms
180ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 161474
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 10 Sep 2022 08:40:34 GMT
expires: Sun, 10 Sep 2023 08:40:34 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js Show response
pagead2.googlesyndication.com/bg/ Frame 4C28 36 KB
16 KB 181ms
180ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2510ed81c525ffb3948c9e103bc6d56f036e45346a0d4c6e481602c223c74ba5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 11:24:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65229
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15893
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 11 Sep 2023 11:24:39 GMT

GET
H3 200 300x250.html Show response
s0.2mdn.net/sadbundle/2863677302136658033/300x250/ Frame D802 7 KB
3 KB 527ms
187ms Document
text/html 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6d6d2519e07da9b6e78b87bc5114dd58e609d3bd26388183e8a3e57f7de982a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 21152
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2652
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sun, 11 Sep 2022 23:39:16 GMT
expires: Mon, 11 Sep 2023 23:39:16 GMT
last-modified: Wed, 13 Jul 2022 10:50:02 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0DD0 0
622 B 545ms
194ms Ping
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuE6GKGDVVJl8Me9UPZwXKmHjv-LpQLwhG7T23FWl1MKyXq5jY0_-ZsFmli-eql7CUoAYoWGwJpSHbrv-fyNAAeH4GJzG_Z3ZdwRRGJFonijZvl2iYpskhhE7DAhKax8VcF_V4V1L0hfJCvOd9PcytJveEtKP5OJOcjXyNVbWs_aw7VmDr7LJUBoYaRzgH2K7dyrf7Ljec_RXj4VIXDmaCzD9xpeYsnuSdzoNr1F3A0lBGEcj0Qlf5ejV6Hv1V8Zb_cE2Sk6hpZu2CpReqIn5cn1xc99Xio8qoKjLYnVoMxEaskXfpmXuPH629mAe-bW60ao8EPhQqVgRi-2BEl_LKWJ3CD8qwJCr-jbA4bNU8ZfvEbxZdho9k3vED_WyWfY9BBbz5JiR7OJ3kFsizJM_0hcddPguuZlyzWaI1ndc71jw_n8ipGT23ZXqyNIR0WFqF-kx6KQki3l3WlMT02ZuRP9jmZNL1Tyr66QM7733tqsj0cjUdhAfFSFEcGocqiSR2TDQ1HdKLcW4dvrvs24ECuisa4i-pbtRli4Y_NHHHnrRlSsYpaie6s_ZpRk0LZTKa2nNDtvGv5-nwlQLcABqQFdkYuWVzvj9wGg-s0BF7lObaQZeyhOUD-eirp3nAt-Lr2-e6RDCzdET4-k0tIuY_8zprV8McxNricgoPqpmN6rI_KxcKue5elVFnNCOLcrYz1F9BUAYEv-GscDMu8VIWb9IIY2E5ESK8d9vKD30H93c5p3glICVyu_3gcI0CTwC3HtQMafgbEZtBXnCG3Q0ZaJ3xw6PgZCixlT_aAjMhfClP1qrRU9dpJT74rJf9ZhLzR9mgLsyXEuC_EbryANdRC5_6J21OeZjsQZH77_-g3nSOOAs3jPE0LpOqHa_sgsm27bUhRvF1sBfVPKxp-_c_ysGemJV3Ra-Sh9fznXj9ZrQa6ynjdIiO_w2oM_IrjCQQsf0y3nOekopZSBF0-KO_ZMFGPtV0j7ImZqSu9fpFu_8qc3f0x8V37E9Pz4fil6ivCZJaJymG50XaOkW2eHJQdqcn4-vR12ryJgiRFwuyMKx42wynCLlmlRcc9MYAwifb8helKyxO3-hVyY0q8R8m-Zh3vndR6lTOqkGbiAzP5Mt4v9a5rDhY_Wo-sRKrn5JrmGVKvXYCOMPwIHXcMevgVJgQdDs2CC5P7xm75o3tb7czXzT38PwPRaRK9TyTgrOf5om9ZuvZn7zf8gjG8OVxV4hHuxC_yv5KyhlADSoCOjeKgZG-YZpaSBSWaSjaLAXynk0xz5U9ChJL5TvSilQ&sai=AMfl-YTtdxYqLwugI-0gynxRVc73Rb0HA3O7JJVAu4I42j1D94S_uU0ymLzi-0mG6pJSXb2paUJFLEQFj3H72_2jsJR5BIuiHCU1I8pNHQLp9O73EB8mY69b1FrmzuBF0M9Id_fdItwa-VHHI89NQEE8k89aBOJ1jRw5pJ8EAaLa3hylee7op0FcUdcstHIj2mHzS7Q7YX0xd9a4PTSqWWz70_dNSDitwQrt8A&sig=Cg0ArKJSzHZYQC2zf6tPEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=785&cbvp=1&cstd=782&cisv=r20220907.71286&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Mon, 12 Sep 2022 05:31:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 518ms
172ms Preflight
application/json 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fleisurelylifestyle.com%2F&domain=leisurelylifestyle.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://leisurelylifestyle.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Mon, 12 Sep 2022 05:31:47 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 555364
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 json Show response
gum.criteo.com/sid/ 371 B
681 B 514ms
170ms XHR
application/json 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fleisurelylifestyle.com%2F&domain=leisurelylifestyle.com&cw=1&lsw=1

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

a0e233ad0245872f97d595d02b04510fc98d7a43be04ec2e2396e70a86eaf837

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1187068
strict-transport-security: max-age=31536000; preload;
expires: 0

POST
H/1.1 200 367.json Show response
id5-sync.com/g/v2/ 451 B
1 KB 369ms
368ms XHR
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/367.json

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

508beab717f0e02f6dfdf99d1a9d1580cfbbe7efb3c49d0c58e9cfcde0eaf5c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:47 GMT
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
p3p: CP="CAO PSA OUR"
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/json;charset=UTF-8
transfer-encoding: chunked

GET
H2 200 rid Show response
match.adsrvr.org/track/ 108 B
742 B 98ms
98ms XHR
application/json 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=iowij76&fmt=json
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: b15ad9fa7cb22d7330c969655721288a520a3164f643c85ed104454c0acccc3b

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:48 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://leisurelylifestyle.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 108
expires: Wed, 12 Oct 2022 05:31:48 GMT

GET
H2 451 envelope Show response
api.rlcdn.com/api/identity/ 0
258 B 600ms
270ms XHR
text/plain 34.120.155.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.rlcdn.com/api/identity/envelope?pid=111
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/builds/core/f56a6a1/vendor/prebid/es2018/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.155.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.155.120.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://leisurelylifestyle.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 12 Sep 2022 05:31:48 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://leisurelylifestyle.com
access-control-allow-credentials: true
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
content-length: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame BE9F 22 KB
8 KB 168ms
168ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 161474
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 10 Sep 2022 08:40:34 GMT
expires: Sun, 10 Sep 2023 08:40:34 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame E942
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1102537/64448505/4.js?adContainerId=brand_safety_Q8QeY66sHuPPz7sPuJ6FiAw&cbFunctionName=goog_wrapCb_Q8QeY66sHuPPz7sPuJ6FiAw&true_pb=&adsafe_pb=https%3A%2F%2Fst...
https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_Q8QeY66sHuPPz7sPuJ6FiAw&cbFunctionName=goog_wrapCb_Q8QeY66sHuPPz7sPuJ6FiAw&true_pb=

1 KB
1 KB

569ms
553ms

Script
application/javascript

52.84.45.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_Q8QeY66sHuPPz7sPuJ6FiAw&cbFunctionName=goog_wrapCb_Q8QeY66sHuPPz7sPuJ6FiAw&true_pb=
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 52.84.45.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-45-31.mrs52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 16:07:55 GMT
content-encoding: gzip
age: 480233
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Tue, 06 Sep 2022 16:07:48 GMT
server: AmazonS3
etag: W/"33dffa7df253125904b2f354b5bb5e8d"
vary: Accept-Encoding
x-amz-version-id: EIole.IHkiDJxKVfO1S7cyRYWKsHRRtd
via: 1.1 e5c15247ec560744bc8eee50e069c230.cloudfront.net (CloudFront)
cache-control: max-age=604800
x-amz-cf-pop: MRS52-P1
content-type: application/javascript
x-amz-cf-id: 0NC1CQ89EJBh9Urhd6J07m5l8ND9Oh-AzgoJg4U0PkDDfjp5-S4Nig==

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: app03.jp.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_Q8QeY66sHuPPz7sPuJ6FiAw&cbFunctionName=goog_wrapCb_Q8QeY66sHuPPz7sPuJ6FiAw&true_pb=
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 6E6D 80 KB
21 KB 1391ms
1028ms Script
application/javascript 52.84.45.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.45.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-45-31.mrs52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 16 Jul 2022 09:09:25 GMT
content-encoding: gzip
age: 4998144
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 e5c15247ec560744bc8eee50e069c230.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: MRS52-P1
content-type: application/javascript
x-amz-cf-id: OQ2kIqh_tonfdT39CGOQ55Deh6pWk0kW3LHQGUBTIQJWl8ooZSzTPA==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame E942 43 B
215 B 812ms
573ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=a3fdc6bd-681d-a70f-229e-dc8362df05fd&tv=%7Bc:nYx26z,pingTime:-3,time:71,type:v,im:%7BpBlk:59%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:33%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:72,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:33,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B64~0%5D,as:%5B63~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:thc9ERy+11%7C12%7C131%7C132%7C133%7C134%7C141%7C151%7C152%7C161%7C162%7C163%7C171%7C172%7C18%7C19*.1102537-64448505%7C191%7C192%7C1a1%7C1b%7C1c%7C1d1,idMap:19*,rmeas:1,rend:0,renddet:svg.us%7D&br=c
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: dt06.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame E942 43 B
215 B 531ms
294ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=a3fdc6bd-681d-a70f-229e-dc8362df05fd&tv=%7Bc:nYx26B,pingTime:-6,time:73,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:73,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:33,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B65~0%5D,as:%5B64~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:thc9ERy+11%7C12%7C131%7C132%7C133%7C134%7C141%7C151%7C152%7C161%7C162%7C163%7C171%7C172%7C18%7C19*.1102537-64448505%7C191%7C192%7C1a1%7C1b%7C1c%7C1d1,idMap:19*,rmeas:1,rend:0,renddet:svg.us%7D&tpiLookup=ao:leisurelylifestyle.com*&br=c
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: dt03.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame E942 43 B
215 B 810ms
580ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=a3fdc6bd-681d-a70f-229e-dc8362df05fd&tv=%7Bc:nYx26J,pingTime:-2,time:81,type:a,im:%7Bsf:0,pom:1,prf:%7BmdA:946,mdZ:1419,beA:1425,beZ:1426,mfA:1428,cmA:1430,inA:1430,inZ:1435,prA:1436,prZ:1452,si:1458,poA:1459,bl:1483,poZ:1484,cmZ:1484,mfZ:1484,loA:1497,loZ:1500,ltA:1505,ltZ:1505%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:100.100,dom:div%7D%7D,env:%7Bgca:false,cca:true,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:33%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:82,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:33,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B74~0%5D,as:%5B73~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:thc9EK2+11%7C12%7C13.1102537-64448508%7C131%7C132%7C133%7C134%7C141%7C151%7C152%7C16.1133689-65389534%7C161%7C162%7C163%7C171%7C172%7C18%7C19*.1102537-64448505%7C191%7C192%7C1a1%7C1b%7C1c%7C1d1,idMap:19*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:0,renddet:svg.us,sinceFw:46,readyFired:true%7D&br=c
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: dt03.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 6973 22 KB
8 KB 193ms
192ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 161474
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 10 Sep 2022 08:40:34 GMT
expires: Sun, 10 Sep 2023 08:40:34 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 302A 41 KB
15 KB 170ms
170ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 12:36:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 147296
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 10 Sep 2023 12:36:52 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2356 1 KB
749 B 210ms
188ms Document
text/html 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

age: 86381
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 11 Sep 2022 05:32:07 GMT
etag: 48472445140208031
expires: Mon, 12 Sep 2022 05:32:07 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 302A 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d73e77093f387652afc85f2e08578a12e42f3754f32f40b23ba2188369223aa9

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 73F0 41 KB
15 KB 172ms
171ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 12:36:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 147296
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 10 Sep 2023 12:36:52 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5CD2 1 KB
749 B 209ms
192ms Document
text/html 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

age: 86381
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 11 Sep 2022 05:32:07 GMT
etag: 48472445140208031
expires: Mon, 12 Sep 2022 05:32:07 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 73F0 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6c0f94d0340ca50cfdc04e6ff6b693e1dd6651fdb54555260710908961a53ce3

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8B83 22 KB
8 KB 194ms
191ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 161474
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 10 Sep 2022 08:40:34 GMT
expires: Sun, 10 Sep 2023 08:40:34 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame 302A
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1102537/64448504/4.js?adContainerId=brand_safety_Q8QeY7WHIeey3LUPre2kwAo&cbFunctionName=goog_wrapCb_Q8QeY7WHIeey3LUPre2kwAo&true_pb=&adsafe_pb=https%3A%2F%2Fst...
https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_Q8QeY7WHIeey3LUPre2kwAo&cbFunctionName=goog_wrapCb_Q8QeY7WHIeey3LUPre2kwAo&true_pb=

1 KB
1 KB

1227ms
1185ms

Script
application/javascript

52.84.45.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_Q8QeY7WHIeey3LUPre2kwAo&cbFunctionName=goog_wrapCb_Q8QeY7WHIeey3LUPre2kwAo&true_pb=
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 52.84.45.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-45-31.mrs52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 16:07:55 GMT
content-encoding: gzip
age: 480233
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Tue, 06 Sep 2022 16:07:48 GMT
server: AmazonS3
etag: W/"33dffa7df253125904b2f354b5bb5e8d"
vary: Accept-Encoding
x-amz-version-id: EIole.IHkiDJxKVfO1S7cyRYWKsHRRtd
via: 1.1 e5c15247ec560744bc8eee50e069c230.cloudfront.net (CloudFront)
cache-control: max-age=604800
x-amz-cf-pop: MRS52-P1
content-type: application/javascript
x-amz-cf-id: ykUUomVkwgew3Vwqh0ERm1PZYUsMEk__cJkz5v1tQBADjjs6RK6rSA==

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: app03.jp.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_Q8QeY7WHIeey3LUPre2kwAo&cbFunctionName=goog_wrapCb_Q8QeY7WHIeey3LUPre2kwAo&true_pb=
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 8777 80 KB
21 KB 1483ms
1261ms Script
application/javascript 52.84.45.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.45.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-45-31.mrs52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 16 Jul 2022 09:09:25 GMT
content-encoding: gzip
age: 4998144
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 e5c15247ec560744bc8eee50e069c230.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: MRS52-P1
content-type: application/javascript
x-amz-cf-id: 26v0MlAB_bb3M03vDk-QJFgYjyqW4988sf4fpy4Zi93Ud2Ps8Y_ziw==

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame 73F0
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1102537/64448508/4.js?adContainerId=brand_safety_Q8QeY8DuId7cz7sPiIe7yAE&cbFunctionName=goog_wrapCb_Q8QeY8DuId7cz7sPiIe7yAE&true_pb=&adsafe_pb=https%3A%2F%2Fst...
https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_Q8QeY8DuId7cz7sPiIe7yAE&cbFunctionName=goog_wrapCb_Q8QeY8DuId7cz7sPiIe7yAE&true_pb=

1 KB
1 KB

1185ms
1182ms

Script
application/javascript

52.84.45.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_Q8QeY8DuId7cz7sPiIe7yAE&cbFunctionName=goog_wrapCb_Q8QeY8DuId7cz7sPiIe7yAE&true_pb=
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 52.84.45.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-45-31.mrs52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 16:07:55 GMT
content-encoding: gzip
age: 480234
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Tue, 06 Sep 2022 16:07:48 GMT
server: AmazonS3
etag: W/"33dffa7df253125904b2f354b5bb5e8d"
vary: Accept-Encoding
x-amz-version-id: EIole.IHkiDJxKVfO1S7cyRYWKsHRRtd
via: 1.1 e5c15247ec560744bc8eee50e069c230.cloudfront.net (CloudFront)
cache-control: max-age=604800
x-amz-cf-pop: MRS52-P1
content-type: application/javascript
x-amz-cf-id: cytdhiBQIShSwtoPaYtzWBUc4uiBy_EPbCpWbZlWrLYQmMs6NBSnYQ==

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: app02.jp.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_Q8QeY8DuId7cz7sPiIe7yAE&cbFunctionName=goog_wrapCb_Q8QeY8DuId7cz7sPiIe7yAE&true_pb=
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 67C6 80 KB
21 KB 1126ms
960ms Script
application/javascript 52.84.45.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.45.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-45-31.mrs52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 16 Jul 2022 09:09:25 GMT
content-encoding: gzip
age: 4998144
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 e5c15247ec560744bc8eee50e069c230.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: MRS52-P1
content-type: application/javascript
x-amz-cf-id: jl30jjQhpQC5Hd6QfUfh_uULv35axKYkQSSrGz0qmrrdd2Ex_43qng==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 302A 43 B
215 B 338ms
291ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=ca6d7a58-60c0-4dc7-4382-be8eee886ee1&tv=%7Bc:nYx29G,pingTime:-3,time:114,type:v,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:25%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:115,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:25,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B108~0%5D,as:%5B108~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:thc9ETY+11%7C12%7C131%7C132%7C133%7C134%7C141%7C142%7C151%7C152%7C161%7C162%7C163%7C171%7C172%7C18%7C191%7C192%7C193%7C194%7C1a*.1102537-64448504%7C1a1%7C1a2%7C1b%7C1c%7C1d1%7C1d2,idMap:1a*,rmeas:1,rend:0,renddet:svg.us%7D&br=c
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: dt09.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 302A 43 B
215 B 618ms
576ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=ca6d7a58-60c0-4dc7-4382-be8eee886ee1&tv=%7Bc:nYx29J,pingTime:-6,time:117,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:117,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:25,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B110~0%5D,as:%5B110~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:thc9ETY+11%7C12%7C131%7C132%7C133%7C134%7C141%7C142%7C151%7C152%7C161%7C162%7C163%7C171%7C172%7C18%7C191%7C192%7C193%7C194%7C1a*.1102537-64448504%7C1a1%7C1a2%7C1b%7C1c%7C1d1%7C1d2,idMap:1a*,rmeas:1,rend:0,renddet:svg.us%7D&tpiLookup=ao:leisurelylifestyle.com*&br=c
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: dt07.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 73F0 43 B
215 B 607ms
572ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=e7bb50e7-2c26-f33c-60dd-a6e4e3070ad3&tv=%7Bc:nYx29S,pingTime:-3,time:75,type:v,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:21%7D%5D,es:1,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:75,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B70~0%5D,as:%5B70~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:thc9ETY+11%7C12%7C131%7C132%7C133%7C134%7C141%7C142%7C151%7C152%7C161%7C162%7C163%7C171%7C172%7C18%7C191%7C192%7C193%7C194%7C1a.1102537-64448504%7C1a1%7C1a2%7C1a3%7C1b%7C1c%7C1d*.1102537-64448508%7C1d1%7C1d2,idMap:1d*,rmeas:1,rend:0,renddet:svg.us%7D&br=c
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: dt10.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 73F0 43 B
215 B 601ms
570ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=e7bb50e7-2c26-f33c-60dd-a6e4e3070ad3&tv=%7Bc:nYx29U,pingTime:-6,time:77,type:i,es:1,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:77,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B71~0%5D,as:%5B71~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:thc9ETY+11%7C12%7C131%7C132%7C133%7C134%7C141%7C142%7C151%7C152%7C161%7C162%7C163%7C171%7C172%7C18%7C191%7C192%7C193%7C194%7C1a.1102537-64448504%7C1a1%7C1a2%7C1a3%7C1b%7C1c%7C1d*.1102537-64448508%7C1d1%7C1d2,idMap:1d*,rmeas:1,rend:0,renddet:svg.us%7D&tpiLookup=ao:leisurelylifestyle.com*&br=c
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: dt02.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 302A 43 B
215 B 554ms
553ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=ca6d7a58-60c0-4dc7-4382-be8eee886ee1&tv=%7Bc:nYx2aT,pingTime:-2,time:189,type:a,im:%7Bsf:0,pom:1,prf:%7BmdA:1196,mdZ:1443,beA:1496,beZ:1498,mfA:1500,cmA:1501,inA:1501,inZ:1505,prA:1505,prZ:1516,si:1522,poA:1523,poZ:1546,cmZ:1546,mfZ:1546,loA:1612,loZ:1616,ltA:1685,ltZ:1685%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:100.100,dom:div%7D%7D,env:%7Bgca:false,cca:true,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:25%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:189,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:25,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B182~0%5D,as:%5B182~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:thc9EK2+11%7C12%7C13.1102537-64448508%7C131%7C132%7C133%7C134%7C141%7C142%7C151%7C152%7C16.1133689-65389534%7C161%7C162%7C163%7C171%7C172%7C18%7C19.1102537-64448505%7C191%7C192%7C193%7C194%7C1a*.1102537-64448504%7C1a1%7C1a2%7C1b%7C1c%7C1d.1102537-64448508%7C1d1%7C1d2,idMap:1a*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:0,renddet:svg.us,sinceFw:162,readyFired:true%7D&br=c
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: dt12.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 04A2 170 KB
59 KB 181ms
181ms Script
text/javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96da839661d63f7cab3dc3e43613fee97166a472555cc91df21777d6d83e58d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Origin: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 09:59:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70368
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60311
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 12 Sep 2022 09:59:00 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/elements/html/ Frame 04A2 8 KB
3 KB 182ms
182ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/elements/html/omrhp.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1133689/65389534/xbbe/creative/adj?p=APEucNWlDCKZHKnA3anPDAyCMBgcBBd2T_Wi1L3GdA8uDMwLkm8BQpA&d=CnkAoCZ_4HDYQTaoOJB0GLJN0X9w88PocxGxakiP5ZDHEaVf9GuxHhXoVPRNXxmwk5XKnkIirCg8T5IB74sKzMr538FvBV1CbyPpKzD6gu3rvRQhQG-WkO-qgo8Mz--sbicJNeQ6dVpoN_emttiyGblKxbIci1F1cT-dEskTAKAmf-CEEm-ZjyaJfCIBVG2wwEv290fV9RIVJOpuaMNVdUGZeS2rBdrqsu1Ju-ynVH61XMHmnNVyr9yNh5-DoTcuaBbRUH7O77JYD5ET5S2v335gNUIGfgKt1tDY1Uc129ypqyEO4FIoICvXbpeZxf_si01Z03Ya3B2Sw5Mxg5hfR6HU9Yb9ljBQQXcFxlupQBgnVv6jSX-DzrIyL5-FvZqpAl3sWriNKjPEV-2nIBmhD9oQukh3E1H60Ofe0UDvJm1OldTe-LOSBK3cnwZzldMpAYx7zv1_0s_gMDD7j1Z4COIU0dWq5IqMPuEc-n1B0W2qk7wR0AWZPQCwYSbNsOpd8ECIUbJ5L31L9LkVug6tFBYXm4cuYS95ekUYAzmmuT6IVXFWlRmz3sb0ubnEcyYZDRcgEawwwn54KShXmQDTb-5aB7o4KngiPISRIXJlUoMnBK7A1DAV5N8TnNCQdnvE82JaMQtr708vfTlb75ioomy7ansAtFMPWIauCj1t4SfU_p1v6IyGqv0EgDvHD9aewxj2yCBBqWv1cP2YIc9H5ibZ-1-zK54vVvR9l069AzNZ-acSGxRu_bD9xD8pRlr5z6IgWZbhU76apWyt0IRFslYqH1Ld3QDsaDtVuU_qVCjuXvAl4LI61vqJwobDAz3ESGHxn_cb4ubSVJOqpCPanlxap0FKE1uz5vYcTF6ENPIIXWe1ezDlUf9S6ULCbMHNayTxUIsGpkoyqXoDE4Tj1Gakx7dL61XJ9hp8Jmu55TTO1ve_aJSfTmHl1QttE0nkA1wh4Z-q_N7Spyp9MtIren0EnfbckqXwcSDBGBMBsnli6-DJMDvQ3FegBfixjytoGBPw5dFF-NqxQZILEuF5Sl7EO_CuHyJ_HO2u3aAYKhtXNjrvxALRVc1vb_VW2c7GQtO3r7NKAVMVqfXghI9wHm7YqtBMw1iO8DuP9OeQk-0MXs3TC7qvI7T8Q8g5UxByqfWtToOK5pc25k_MQEJbfQh-eUPdwoWihmG9Xw7uOuaJ8ydcQemWadDs7jBQFOvsbluMPGjxQ65tY_p3Xk3urQsbcWF4AbWV7h1j_gZNLckydSfIh0t-ZohfBOrpk6KBkjTGdY51_yCHbgm1ivv32kZlKcuAaBLamZ3JqWCqmyPDTtHcAl3R7NmPxBKtOAXeB0yu7APGT9nJFkapAbAcAaCpddYLnpv4sgn1mFbmD3NVBrIumTLvVACz-4aP9j-oeNeOtCldytUBqD_rSLvU6OUR0aejKnNFplOcFzXJw7lCm6l6WzcFsMPqPWZ07R0GVTp0MAUro9clr4xKmCJns7T4e6nlWzF18UqFq1Ez8ICUf5oKo1Ds3sxMCeVPasm5ei3BY2It0xRmnXNPYXa3xdoSp4Q1SflA5g63tVWJRxD-qAfr5wb5NZh3I3SnLjB09dlMOFG-InF6lHZafaWHCpaM50ALxN_-m31aSsSqqb1N8NfZmoDiHF8atak4ywqZF_3Ke7CNNENU7WV1t7fkmTk5MP2VnaflDkEOddnco0EnvryoFvP_L8_sNRsJ-Ji_EALyyl6TbhoKtxN83H7lm5h2UKytsi0lYXE_BJh9koXNDoWnOI8x6A82Lq5SJxVECtpSZpHcngO3rkDUVdxZ9h0p9lQ2myzRjJHArqPkv8hxagJtOBLExOcSHG8fV1RxBhIpydsyTUN0pqjNgfznsf-FiUR64ZrrWPMm4iTt11668uWr3q_Lzzlv1iUJebOEBz-YeWuSo6vun9zgmmQ6nISJjr5UUludCMOGJfaEkfp2bA5aHc62TiGfzZ8Bneo7dKtW1Vmni6P3SLcubgHcEA9Uv1Cygov30NVmerKEQ8juG3ZyKLg4l8MOZdtEamv4W-M5jfztR02EUlqok66OTxcodauvw_d3Ioa05km2doGTUF3nYxE_gq8EqCu662M2f-OBSmbHL50aq7jhdRYMIlaolweWzmNpCx7-c6yDKRo37rhzLWKW-lJuCQc2kuTx2IwG3-FGkZgrdXocJ9-sI96waCtMu1LE6uHl3WtTeTqlrGXuraaAskE81-FKHbCa21eK3lDi4GZ2Vdgyy7r4ZbsrGUiYuD9lVd6BBKXCrYdSPUi_3-DgvxtFlHx21zf7pSuCI1yQBfYEUZqmTfifxAaDHEspE6mH-8zVjphNqI39-nEqC2wiH9RmCwtexlnpST_R0RgWQkt-eY-IKnyazOx4zMTJh-lLRU24cjsDsqXsdnzgdNKM7IUtrRKGk9qH1difnoH6_S0FCloju736f2cxNLVjMLYFCSnrd3vxN7utZvx2StWgzB1eCFgRV43HpQqVpLGuG9am40kVQJSktp9DX-q9ddAUpyUMUIWenTpZ3wYsGgqj97GAn5r7pdks8GwhtZ6fWUb2GlBqiElUwmybEn3pGrmqzL-KnVnk-g0arwZ9D010PyJF1gXH14zD07wNcek9k2HKLvXL7zB8SGyS5DhdFn28LTFZOmCYTL593h6x6e04YbHTS3XfGXrrbIUPSDSofwZnABUusa6sPrfB3OJV-vLWJuNUw2q1MJFyl_AjF97MrrXSosJ4otvl2q3Sof5XIle-GtoJTrul3ZT7jtgDx4be2XncTo0jM0OtKqmEK4C9iIW85jrKOTHPBeReCzBAXy4UETbgcIhMVP27dfSuABE2gAsd8o7uelY8ay7V8aMQxJmgDPEMQCeYtqaV24_80-Ik31jF9oaMcWvMAVlWk5mZmA_NWK28ef5Ed76tyW3M5Aun434JU0ub26EvdKN9MCJWm8AGmNj9AhYDVHiY2enmbdGy5RN8QMR9DFQIwf0No3rIk4okJSpe-I3k-HkHPpMmIJr0yuYxvHlmJpNrgg7acmQ662o1KRVfNkrwtGpsuNO0TjC_lO4cv3H-pGFXXB5v9IPRKbOYAAX0XkVR_oFbjEXBvXiW_plCzdQOSEGhZ8_zhKF5Wsn64cJn6o6OQur_p7T5aW4mHvopKlD31ieRBNn2d2d_RbuzjECCJSLVcJ_Q_HkVISMuptD98tESiWlgTpL_vsMLjngj9D0mcHzNIe0DYi44rwr6J_c0lsZNh8xUxAkxPjiFirr1xrBN7X1rx20Fx8cvEvzq6zlghaMFt8U1PyZrNKHKaepAwrcX2L5T5Z0PwVfWC2_4IGtPms0OGn6VxBgXZ4Dup0GZKpGS5-56qQIwkEpCIdD8DVTE3pV8IgQHWAKkXQ4fpjWi9DyNmQ3FTGllVv3Tmd2XRpsv0rMq3CUWXuvSyI2CTomQWSaxOYYK-51heh8S6pJLOGkyR0sSyxcN2NCjWKYu9SNss0HdipKELmmQ6YQm8QVRGiwIABIo5Gjy5Xk_jbsoOBeSMA0t0qAUmgCkrsxdSwlXhHff0KHns5NG3ZN4d2AB&ias_dspID=3&ias_campId=1008779776&ias_pubId=pub-8501674430909082&ias_chanId=1&ias_placementId=18006246121&bidurl=https://leisurelylifestyle.com/hot-springs-in-california/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0hykEmJ0cHy5nDsDLvCNNOE&adsafe_url=https%3A%2F%2Fleisurelylifestyle.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:2554d9b5-3795-e4d7-d4de-80446e76c5b9,c:nYx1Yj,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-7c458fbd-zlqds,rg:jp,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:thc9EK2+11%7C12%7C131%7C141%7C151%7C16*.1133689-65389534%7C161%7C162%7C171%7C18%7C191%7C1a1%7C1b%7C1c%7C1d1,idMap:16*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:25,oid:31b44139-325c-11ed-bc0c-968024f76aa5,v:19.8.347,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:22:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4129
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:22:59 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/ Frame 04A2 30 KB
12 KB 181ms
181ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220907/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

efa230a3973395419cb2746d720c89db14d28401636f48514642360656c172ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 04:27:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3858
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11782
x-xss-protection: 0
server: cafe
etag: 11425859616848618248
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 04:27:30 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 73F0 43 B
215 B 533ms
533ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=e7bb50e7-2c26-f33c-60dd-a6e4e3070ad3&tv=%7Bc:nYx2bc,pingTime:-2,time:157,type:a,im:%7Bsf:0,pom:1,prf:%7BmdA:807,mdZ:1054,beA:1148,beZ:1149,mfA:1151,cmA:1152,inA:1152,inZ:1156,prA:1156,prZ:1165,si:1170,poA:1171,poZ:1203,cmZ:1203,mfZ:1203,loA:1225,loZ:1228,ltA:1305,ltZ:1305%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:100.100,dom:div%7D%7D,env:%7Bgca:false,cca:true,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:21%7D%5D,es:1,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:157,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B151~0%5D,as:%5B151~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:thc9EK2+11%7C12%7C13.1102537-64448508%7C131%7C132%7C133%7C134%7C141%7C142%7C151%7C152%7C16.1133689-65389534%7C161%7C162%7C163%7C171%7C172%7C18%7C19.1102537-64448505%7C191%7C192%7C193%7C194%7C1a.1102537-64448504%7C1a1%7C1a2%7C1a3%7C1b%7C1c%7C1d*.1102537-64448508%7C1d1%7C1d2,idMap:1d*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:svg.us,sinceFw:133,readyFired:true%7D&br=c
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: dt13.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 300x250.html Show response
s0.2mdn.net/sadbundle/13099338561793074780/300x250/ Frame 10DB 7 KB
3 KB 179ms
178ms Document
text/html 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/300x250.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6d6d2519e07da9b6e78b87bc5114dd58e609d3bd26388183e8a3e57f7de982a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 56469
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2652
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sun, 11 Sep 2022 13:50:39 GMT
expires: Mon, 11 Sep 2023 13:50:39 GMT
last-modified: Wed, 13 Jul 2022 10:47:53 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame E942 0
64 B 195ms
194ms Ping
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv0ZsxgM0QfCviPogl0JjYmf6cc0gh-YrulJ8u3opoB-B5-EMKsobkTKzkilRnEzFt4isIxaAy-ZZ_lkgrPBd1gfcwPXjpHrZwVDFIdoVZHf0GK32smero6J7zfUSnvVfQvilNAzV8IKYNP7RgBJR2nZv76sWl1Giw84myR6VhxNr7oIcNUc23GAD20A3vjxbkkOrtMSv_FrCLx8LlfnctMcnj6WBa51Yns6gD6QE7-fSUy0eexNYVE8iIqwQVlif130qmg-BBVE3RWu-ftzMRynp7CzRHVA7dIqiprVX6XtgGMA1mYVQUocv-O8YuMlkMD8EZeSTuQIMjz3MkmgJA1JnKfbDDbEHdzBSqaHPKOh-W2iqPz7vkm7dO7ft9in_D6NyvBnz0WLD4oDwrkrf4rr3bCtgvnqOJtbtK2yd6cUoJ1ctoozbAMoEK4QxlVwFAjZxkLjHFzb0Zomg-Jpi62OCmBCB3IiQIh4RbLZL1VuW0IzYbjLADABqDDirXzY7u5msqEHj6HvEOL2glABrg4QITwuuOqzQr97NJ4_a5KtxB-Uc3ZALo9YMcJK_MdGFvmzUquTy6yd5uVsEz0Wqthl5VUBlgavgkihEAPGg-I8QwiZaHoL1rw_QM4PPg6swAbzu3dZO33BjJq5ZiVDkiHRHReypMiQZ8kCT1XeLGayKfrQbcl1CoaWTlaTWXY4pAir2bjcksSPgqoH4ddGsW_2A6liOLUtvAIAbjwmy3TvZMWw1Ixh6G5TLdAQx88T6BZn00fUS0pHY60_MP5icgx-G8NsLKgiZk-LDMw-xUfEtEBO6Mk_0gZb72o4AE7vtwvFaFquJyt0QgvDzsZWBVHgYG2wyzzv3Ci8r3MKMWhmxm26JkFchLR6vr01u5qJXp1N7aODV4eSIuv_qIeNKeDHnpW8c02BzyVmddLI8gUi9rpzFLj6GYxB6x2GZGXot6wRRB1xa3uHlB08ytj7XpOw3qOIMMMOq2Z7cnDf37YMxeUaJwHpbGTNdmFGCs5SWNMBb_GD78yWd2XN6Tw3aN3hkqTZBGl29qFu8A3SXrk1l94LTRpBSDpsSsyzjmEHNs_n1Too89JYbyre4M8yetUJTiJuxgflNpSp3-bMqG1Kpt8tpFptAfwBMUFsvAkzF7bMzOhadE9LVaqraihxjdGPKe0hbDdpWAvCK-G7Dn5WjjmaP9A_l7Wg3Z94W5-9wJm2mtZCix7qpIdop2aRPau3KKnRRyausiCNx6N6JER8aTHGD31WUJVOdqbRCs9G_3eLQ09AOptsdWrn1KtCUVlsh95DIFpJwcZZr6sh9tTxrSuUL0&sai=AMfl-YRJi7zGpZ5Jgv__1g0PBFnLsKAOBkQL_dC3U4VmgfX4JLNvtUh2B1RKIwQs5Wv5YRrPqp65awtK5dHbnFUMy7pyEn3jtQF7k5MHGCnQq416Rjuhk8vw12ymBHVvcJMf5D05fCNb5S6Cwdn0mpIH0m1y_cSpqODr3S4FQJH8rZVU9HglzSYpNSa0Mn7vMljLwbwxnJVCPLgVly1uM-wFe9Cr&sig=Cg0ArKJSzCShQ_kOfctGEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=837&cbvp=1&cstd=835&cisv=r20220907.79321&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Mon, 12 Sep 2022 05:31:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/2987880808898358456/ Frame 3695 21 KB
4 KB 182ms
181ms Document
text/html 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2987880808898358456/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

090275b6a6dc14ee10cb04261408e08b2819a6636bc24a62ef72a17fbe1b5763

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 23161
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 4367
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sun, 11 Sep 2022 23:05:47 GMT
expires: Mon, 11 Sep 2023 23:05:47 GMT
last-modified: Mon, 29 Aug 2022 04:07:44 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0C94 0
64 B 195ms
195ms Ping
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvCH-Uq_7fbfHDh-FUoVEGVZMj6e_-OImctlbB1yM6UTIH-GZ1Mqeier1QhxRLwbfJwC4gDY9BaEilWUE8P8tGI2kYkB40BCbUvNvkeFT-c5PgkS0JJiEBMndXnrHaYmTWBh3LnhyWyvhCvhsjXA-LKOZNFaO_ER9m172s2nV8uQSvPsdXZcrUTc47R5W4TRbHWqT4IoSMzfsAlGOr1WD-8_0xiEdyHmiv4eZ4f_0UoaV4V590M8jwkRlYqtSi6tAox4H4JSThsHM51aRUc0HtCV9r3PKTpLstL7EXVcEyQBbq7Z3X5v1MSdEVMhZseVh-YeclynkGk54uXMHuTvX7AiRaZpLCsycaQmJpy1N9rZhf7upi7yKN-wzjDvQdockJTcYybCE6eK7at9xMZ0Z1zlom7JKTd2kqfDGOQjJKjD7JiIHxTlIUyLgi1RZiQvegV9J5PDIGHxpurfDm9mgVnolRS2G5HyktBVpH9qKrckyYJkn6x_d_zoZ6RjeQaW_t1gJeBTSxEx_QqpLqfvXoDuxyWsYWNKO3hUOL3NMoYL_rJSQHWJAUWe_UiWWmSByspX-MO3pTkA5rjW49-3AhvVf9KNSFuBandBdVwOwKGLw2uY9UF7Jym1Ao07upFxTfZ5nb0VxO0oHDfdI634faMIW_W-xCznUwzakrS4xyRyIGGrgEgYepM2dsY3s5NqqQX90m_GuU-7H4iFLvexB_ximqpoU_ow8NDit9DX8Uc07JIbn_4S-XnTwLVRh7WalN-fXz0rhsRB0gFZ9ErVOiZIjAT4ztyut8cAh8dAPLPGzfYq9fAB2lPF_GOaSF2OCKB_EPBbmCiZ4lGIVQUmWfH2BruBr_mGmBpRIf-6ooeCgPL_Oeq5PDsSKm4Ma_K6jgF5ldyfw74M40lG_2PGCLHyHD8ZCkdOa4_8-DayIf1J7ywRNmUbg9ISD7ija4OQJ1uvkHiTTRyhB92rqZczBpqA8XqbEn5Ezwd7zDAp9L5MSv4aPAfWdCciU_Bele6tv5NO_Xk6AJI0BVl0v0fkvvorJSzZHAh8r6sQGspsigvYWfWk5kEfsmjg_l-VwVka89hltp8HE9wAta6orO6JvXeUkHHRWCA79OFIHXUlTlXCt3GpnmCaQitU2_5wDoer_yL-PX7GAUKHQ2SV85mcUbJxtoLB3SMkLWH6RzmzPwJms2vSgVLIG0QI3NGXqAJFnuV6uS_vwEhNTHf7m51HOEb_kcakJ8zRl9cdWKf5NrUTxtqAvD-qQDREM-81JHD-t4hVdEEmVS5VriG&sai=AMfl-YT3DHj1W-eDmajrFR8H3nHNX7Ez5zpnVMT4jk7N3M5nLtOrQUveWyO7jHVUAcFDKP5xjGuStoor3s4Dcu87wWRcAv0AvWMCNctQhH8-PSS9WN0DRrqabM6b6QsJ5p1Cy-9urSoIa17Jao1gZqSARHtaytnrnUpGy_zgqc15vfSNOYwuVYkl-mCzKYyAFh4lgDz6xxxsnKEx8JfCh6HuOlDeR_soOf8&sig=Cg0ArKJSzPYSPqBsh7x6EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=918&cbvp=1&cstd=916&cisv=r20220907.06497&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Mon, 12 Sep 2022 05:31:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/7704509421823420664/ Frame 99E8 18 KB
4 KB 179ms
177ms Document
text/html 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7704509421823420664/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c21db20992d41f2d214eb2809414dea5bbe287b8a3b7610a656ff1fcb9a73cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 532100
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 4229
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Sep 2022 01:43:28 GMT
expires: Wed, 06 Sep 2023 01:43:28 GMT
last-modified: Mon, 29 Aug 2022 04:07:54 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame F876 0
55 B 195ms
195ms Ping
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstnmbsgBmg0nef6lBt8eSkYnjmylsWHYNP7zIbNMdBTRyHY4A9AKXs9GLYCISER_CW39lxFqwxhmvrQXouegBy0TuR-0EubO6IE-YMmPUcAsgjIRVT9LS8dhrzwPvm555TzhnUsS6pBmxc7cP04PhsVmqwhy69VWsHo3I6dl9tEj7huZd4g0F0gxI1ILCczUGv0o0h1yOUncELgjyFObVgp_AJtX-a1xTG4ODFup3tksbNr5PghenVxz1hkHiutGVsY0BKA2jDdPhoeZ85b7xCcujwvQ6g3z9BMVeXBrmyzX2OKPLf6S6Y9_JYRuz9VdY0pMOGOVfZY4sx_3kgt7UF2DWaQtDssy6CXC6iDO8UPVdUc9YzEWzKtrWVNf_rqWWTMhTKzFNssyHrrd1A6sCgpuT7GbGDT_ku-2G_d3jYzNStw3iLLl3uKCrI_mYkGjU6CjxiYTshE0pZ6ECL3KYBuefW-pT9Nl2lg7H8TFgh9miOHjlrt_I_nbSsVndO1Nn0x_XajHCqYhlgs6yyYonDQQpoSA_Ydd3LOEaPU_aGLcUZlFz1uhILBUp-_ODlBaTsFPgY1expDK0hmDSFznm4Ci6r-L7g3Dw_MY0Que6NYnQKkyZmm0r8eQa80RTcFc-fubu7gx8ShWx9CWXneMjeCyKxje74jqaMf7khNT5Uqyb0zZVPqy9vng5UYlD1UAGqTK65qz5lgyDp90cG-WDHybTNas1adLZjUkXRKnxDWfSCg9Pci1-oFHQmo4d-dTy-YIY8Nd_xInYGvUg-1laKZ_-7iWD4kEKUdiuK1S35n3Zc8oQx2D2Dxl7QLG1xLdldJqfIpNDaIaxPgnHOmtFXNnZtrWcaNCgZe6BIqltRmFlVQIlfUCb8szkhWw-gYLDv_xw7XD_Tw0qgv0LFA9Zs_xwTsYMtceQNbW7N3osrx32KndDoyuMt08jVCH_-_rPFLNvFHMa391wxpfRODC-BfDYHnWif5JW676GASG1tV2KurT1yv-_miiwpsuYBRVgQR8AK9YaHCPpaZsHyAQd9jWnbTFYE_HVAU5jYQfCr7RIaH4KGok-mjSkkjY6kQJkG1dXHn_0VRq6k9qk35Emk18IuFuhkHJt3zysYdiwfgU43P5RAee88CFzDT76Y5iJWWFPWpOd02b4YyC9iHOzKQ-JLc5F1CpP6ZO-dGtH64Fe02KB1hh0-UrxHl8IVwCGvuh4jP8l9ZJDxZZRX_CvFkwo9ypLhZsU0D--8QvuyngV-hSraLceLT97SlfyIbI69HY0oYavz0TA&sai=AMfl-YS-qiSRWkQp_gUguQKuTAjLICxzxyGgbAwOoZy9zZSvkZJvxk0LAaUVTSTZC1ESRMbNmcpcaJ38dXp6vte2tJx98gCP3PW4Q5jw6qqveB8JEHIlHdLuixcabhyLKjnlrXQwXXeOuIPl2v3g1DS5PdcA-IxlZp4NtyKj8NHKdddURQdkg55pqk39oA8zv5wn4XDPFuHugBEUyR2PqbSIMTk23bQ-i41FNg&sig=Cg0ArKJSzHCsPTdsXNrsEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1090&cbvp=1&cstd=1088&cisv=r20220907.94469&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Mon, 12 Sep 2022 05:31:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/4069805372741400992/ Frame 3C6E 224 KB
34 KB 205ms
179ms Document
text/html 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/4069805372741400992/index.html?e=69&leftOffset=0&topOffset=0&c=6zVXdyWvXR&t=1&renderingType=2&ev=01_247

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ec4f6eb25b37cda079c0871b39d5b00e34e2885de0377fb0b7e56bf6b2458c4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 05:31:48 GMT
expires: Tue, 12 Sep 2023 05:31:48 GMT
last-modified: Mon, 22 Aug 2022 20:48:35 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame EE34 0
64 B 216ms
181ms Ping
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssy_BUv47o9VBACg8OfXTayBhAm5hALbK7u-46ESvnTh0uWpHc654YR-a6ZYtbgs0e0i09uLT-qMevxK1iiDRvpXJkeWUp7sjcXP8MEETd89C8TaMAv49XG_q0k84IvGDTSrVY3C-S6h6042oZFzaLtVelagdqhbQ_CYvMh_rcdLYQbcTt7NUS0XR8Pp4FLFoB0webHgRW6V2GgRH0Ugz5UZbeu1-URw5ZagcF734OdE42HcKf8tBWf7y7oBX1ws2p9Iq_Pi_8i7bjuZDOJdzcJ3ZX_qOVou9P6yNSySbSW-78YrkYk6UNU7CkPTK9yl83OYSEBH2b-iqoOZdkqpA9og9BwA5fRV4xaZMrm3oek6nSRs-ezjm3XWCqyr5-oULdfzMesfmzk857r2ugKnq9zZHs68zukw1uu9HehS0VyIEFskhFP4yCU57XILev-wtb4K597wkPgUC1yng0lTsJ-jEizYJd3YhZVjV7Tx7H7PYxJ_QtikRpkosIOhHWJetZjFZX_C2bZRSSubxe0zvmE8QckueLXEfDKFZIKqxIzVWFzXfkhO6vBZeeS6QdgLS6OTneqQOQn27u6xngm1vjSn5JDZg56sHoqjWnDv00Aw41wqVpFYFd5ZKWBGVwGz-1z22e9RYpknPAwYnPr9Fekr-efxEoMD5dXMyDrWz36soJLAjjkBOaIFFR918cfazbx0dsKBY8jHJBCwtHUIJWWGRkrYF0hqQAkVZHpwvhiCopc7zODkFhGeo0qq21pouSDyp9e64z3Zhl2GBIAIvJTlfLK0nSUraK0hvOREEIilWb3E3x69Z4XwmrljD5fb7PDjsX99GAL_R3EteyRnoQ1RhHRVPFbVy5vR0bKeEhfM3Feq7-yuKZ175xOenW4vwEWRRfRHqGyuVuQL2KB00Fq5Z_vIBZe-GIxJwQ0bezpscaMullLfIJgOoLemQSb81A88XwDM9YLIeCk7LgjuLOh38qCWTVmUmnI2U6ltZFmESXSzKciiDGQGp8Ls9H8PTKlpDH7BiG0GsHfyFBlflEmjQeDrZ_LzTRKnKcwx1t3-bNokGbN3xmCPKRedZ1OCHKAnCGRzydt6Si0CrS5tRpfDUDUXzOZbmphpZEjOIEuLKLNw0dSai-NmJ05h1zXp2B5MJh3uimQ-r8C8UTRbmObLSjIm8v9jjsIAWWR0fmHnRO3oi0bDZYTDZ6nIfXFAZknDhj_JDnQ4PPLvuMw3pad5z2oc5GXFdIvRO-SFkziGvSCccbyWWCRwRVwldOzqwQfA6oO2w&sai=AMfl-YS_b6sJ6enX7t__aS9sFzDu3Jz_UVlhwaIrZZApKKOY9ybLTsMYg7n6O39Gacl6uWKgd7t0yBAYO6eRDaGNWPIGk7DuJSzOF4nYJLl-Rbo_RpZo9LhErfbNEmZB8RhbZrZ-zH7LWUNVS3nK538UvGqgW-x9mWkQK-_dFP7c8pPgsKrR6fPmCub5_2xpOlOfg751hUTbNNZw-Jcea0tE8izBfyfVWukno4vY9w&sig=Cg0ArKJSzGc5npt1NWsjEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1003&cbvp=1&cstd=995&cisv=r20220907.35193&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Mon, 12 Sep 2022 05:31:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 300x250.html Show response
s0.2mdn.net/sadbundle/9438485774792436297/300x250/ Frame 807F 6 KB
2 KB 263ms
240ms Document
text/html 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/300x250.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb512405fed4bd693e271ff619bf39dde467503d5f65d985361e8203d86c568d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 21581
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2327
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sun, 11 Sep 2022 23:32:07 GMT
expires: Mon, 11 Sep 2023 23:32:07 GMT
last-modified: Wed, 13 Jul 2022 10:50:55 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 302A 0
64 B 216ms
188ms Ping
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvWlJdE9q1HzrppBAIVaXKF7DRJW79lmEgf2wIUBwoIbq_1GL_geOtbyG8EFEFSOf0b8VYJGzaCy7JmP8ecr1vkd7A4G97nnngtztdxOdKZIL-2dwh5zVlBZ2myLpmtgmghQ972rSq552-ysLYmM5kMgQq-6QiJTAnuyPGP68B72fKUQvfY57dj1yRL5BkzmKdCGi1qB7ZWDITXiCNLkN2jr8a-hNsO0qBCFgwtwuufltD3W2rPhXxKmky6sAnC2CKvww5vpttHmJ7IuBdbw7mFEGhd94h0tq0_9GTvtIQHN6yqj2XqFJQNqyUc7LLlzhimtPlpwCfhlGTOIVdKMf5AbPDDZGr-Ec5JKoTcC4-OsXP-Yj3HZKgmsSY2S2bPSQPdSpfQY_CYiLkx982EyYgVwb8G5AZEt5admE5prA7878mrd5vmBd-pKRupyi_HXCuuWDV2XBXCG_QV2vzZoRvRJyp_e9Gl41lBbVLzEQOhE4XCHBWd5iZ0pT6acRQuNEf5b2IX1MFKCdNMgxUvzv0TSBOcHY5EUeucB3pNktCedgRymX4nT--gRprJigrYExQqMEs-V0VGa1jU2_45F5prwYZOSc1PXEeup7Y9LDMW2VLf4gTAJgXVifTc5jk4UhfjOOB2KWFMqXqwDhnSc5dSqUyKojHLgG96Plsqgx4QHOU9fye0Yv4nIEoBS7EPrOdKVOE06FNVRmYf6Ss3FyWDk2WWr-Ef21z215jEJOOtbzWnkM1esyP3ePCRuMltpr3Gt1VnuGKPMj0dcJDIXAKsfBzUb_62u6uHG9MP0qADRoe9N_P-cxsEgZ9DiCZb6sAGeCHq232DjngExwzsUsLwF4cLt-2bwi3-DVx5vHz_-1c9HRMTLNlCeXXuHJDKhgMx25AyfD_8XO1tw88L178fTwf8BwwE6OWWCj-YyldK2HvhA6oZ23X5zJ8FL_xd_SAA_RXo4kcYQDsK1pAs2qScSQGsTwXsiXhJSsan-0EH4zhUHpzv2ox9LtvA0LBl13uyqG6ap1dzubu9ogJUkULIdCnc2a-pqoJajkavGp3yKo6cEGif48cIp-Yyw--g-WnMgH0lFU8lvaEtI3LbwtululLKLxQQqeImSvsR60S9MNzRwPWBO1zB767mX3gkYwhXlZApEKT5YuaOmrktXvCApGTWWi0z_wrViWEiyVI4C5oNq6-nsrYKxLchCsECtm-7Wvk3P_QSgqdyJZpTNx-QZgsqMG7Y42AwzdpZcJMdf4lYFhh1RkCij_B10rqfnUI0oeD_0ansrNOH-CRi10ZOixBHaQzRUmkipxtgTi85hKY12Jo&sai=AMfl-YShy4OhPEVxFHvasLJ7c7E-D_QOmjsBVwtKeb8QTWBUeRlHMFw7mb9UI1VmbJamRufhatQhOrH_8XthhRO9qw8ES5IiAJ2DCOVn2kK-FjGVb79rX6joAWemG9z5HYjXKKDA-IxFBBuaFsT2u2c9dipz5eo6BV9KVVKOfrF0UDHILhGhm33exEosyBiOp1HamXivq8AylewY_FChSgCOmLBp&sig=Cg0ArKJSzJf4blGgrxZkEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=634&cbvp=1&cstd=633&cisv=r20220907.01291&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Mon, 12 Sep 2022 05:31:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1

200
OK

cm
a.rfihub.com/ Frame 310A
Redirect Chain

https://p.rfihub.com/cm?in=1&pub=445&google_gid=CAESELRvH-QW47mFQ1Fk1uaTaLg&google_cver=1&google_push=AehlK4APTPl-J87xCmYvQi7FLiI95r3CAC5jJxqHv2GmeGl1qcklBn3KnXvgWTQGuPWGEHfxvB7Cj-Wai-myGJZbN5C2X53...
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AehlK4APTPl-J87xCmYvQi7FLiI95r3CAC5jJxqHv2GmeGl1qcklBn3KnXvgWTQGuPWGEHfxvB7Cj-Wai-myGJZbN5C2X53zIBdAOUkOTSZvoE70TlvdtNoKrG...
https://a.rfihub.com/cm?pub=445&google_error=5

42 B
792 B

1096ms
273ms

Image
image/gif

198.8.71.129
ROCKETFUEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.rfihub.com/cm?pub=445&google_error=5
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: HTTP/1.1
Server: 198.8.71.129 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 12 Sep 2022 05:31:52 GMT
Cache-Control: no-cache
Server: Jetty(9.3.29.v20201019)
Content-Type: image/gif
Content-Length: 42
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:51 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://a.rfihub.com/cm?pub=445&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 247
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 310A
Redirect Chain

https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_gid=CAESECInDNINEwFt9FTIsETwiBk&google_cver=...
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=NjA4Y2FiYTItYWJkZC00MjdjLTgwZDQtZmQzNzA5NzM1YzM0&google_gid=CAESECInDNINEwFt9FTIsETwiBk&google_cver=1&google_push=AehlK4AA...

170 B
188 B

184ms
184ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=NjA4Y2FiYTItYWJkZC00MjdjLTgwZDQtZmQzNzA5NzM1YzM0&google_gid=CAESECInDNINEwFt9FTIsETwiBk&google_cver=1&google_push=AehlK4AAXgX2z03rAI2JykIpxSaM3xWuBG1GkeevDCj_sBzDV1TI2ns1Iw_K6hPa5wSqrNDih0M4nMgTQ_JyKNwnqn3OFR_w22lX40GOM5f02pRm4k3xEyJOl_5x1RmETDxu8hWzMJjhGhTCo4gjKbrHXw

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=NjA4Y2FiYTItYWJkZC00MjdjLTgwZDQtZmQzNzA5NzM1YzM0&google_gid=CAESECInDNINEwFt9FTIsETwiBk&google_cver=1&google_push=AehlK4AAXgX2z03rAI2JykIpxSaM3xWuBG1GkeevDCj_sBzDV1TI2ns1Iw_K6hPa5wSqrNDih0M4nMgTQ_JyKNwnqn3OFR_w22lX40GOM5f02pRm4k3xEyJOl_5x1RmETDxu8hWzMJjhGhTCo4gjKbrHXw
date: Mon, 12 Sep 2022 05:31:49 GMT
content-length: 0
strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 403
Forbidden gg_pixel
sync.adaptv.advertising.com/ Frame 310A 14 B
14 B 765ms
171ms Image
text/plain 18.136.113.188
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adaptv.advertising.com/gg_pixel?google_gid=CAESEDUwuPgctxD8AYHrnClPZBU&google_cver=1&google_push=AehlK4B8DPeyIDG_ONbNmHTUOg4mVGNpHKqBwvCxUn5pLuk_osxmc_onaOuUxC_KbgLEj_xhHnM8OkrQuYW2c6_JxNyFk-l_EVQA0F-6DCHvXahDEAhuBRujFdbVQArlW0lSx163F2pywLTuXvo7Zs-JXVw
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.136.113.188 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-136-113-188.ap-southeast-1.compute.amazonaws.com
Software: ribs2.0 /
Resource Hash: 0db80e4ae35fcf307507f9ced66fe9ccb3147c1ea12a60ea034092e6aa3ebf40

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Server: ribs2.0
Connection: keep-alive
Content-Length: 14
Content-Type: text/plain

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 310A
Redirect Chain

https://x.bidswitch.net/sync?ssp=google_jp&google_gid=CAESEL3ah7ObpWA2__1Gr6CapIQ&google_cver=1&google_push=AehlK4B4erNCNVD4psy8fIZYmG3EHh7MSRpwp1lZCAHWOTYVXYZHtcGsGTU71BDrt04Mcv0XbE-wjE22Jdv_K4_VE...
https://cm.g.doubleclick.net/pixel?google_nid=iponweb_japan&google_push=AehlK4B4erNCNVD4psy8fIZYmG3EHh7MSRpwp1lZCAHWOTYVXYZHtcGsGTU71BDrt04Mcv0XbE-wjE22Jdv_K4_VE5QQE7plQJFIuKqIJpfvLZ4a-mzugjA5teIMr...

170 B
188 B

189ms
187ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=iponweb_japan&google_push=AehlK4B4erNCNVD4psy8fIZYmG3EHh7MSRpwp1lZCAHWOTYVXYZHtcGsGTU71BDrt04Mcv0XbE-wjE22Jdv_K4_VE5QQE7plQJFIuKqIJpfvLZ4a-mzugjA5teIMrsWtv173kFS2ONXqI4a33Me6iTJT7Ec&google_hm=

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=iponweb_japan&google_push=AehlK4B4erNCNVD4psy8fIZYmG3EHh7MSRpwp1lZCAHWOTYVXYZHtcGsGTU71BDrt04Mcv0XbE-wjE22Jdv_K4_VE5QQE7plQJFIuKqIJpfvLZ4a-mzugjA5teIMrsWtv173kFS2ONXqI4a33Me6iTJT7Ec&google_hm=
Date: Mon, 12 Sep 2022 05:31:48 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
200 asr
aid.send.microad.jp/g/ Frame 310A 43 B
641 B 729ms
236ms Image
image/gif 202.233.84.1
MICROAD MicroAd

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aid.send.microad.jp/g/asr?google_gid=CAESEPwiHLmuYMo2vKd68dFLXpw&google_cver=1&google_push=AehlK4D1dMHEvOcqLkQVK0Q1M8odS7Vv7m2Mn1ytAff5tu-IrJqW67EdNZR7WK9BQK-7pq6cEXmCeoAfLMeOY77jTs_QRNpIrxBy63CvSwA7shYPVk402gPG8eDVHwKP-_ZQiKntv2u47kiqpGZRxtqHUA

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

202.233.84.1 , Japan, ASN131957 (MICROAD MicroAd, Inc., JP),

Reverse DNS

Software

Apache /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 12 Sep 2022 05:31:49 GMT
Server: Apache
Strict-Transport-Security: max-age=3600
P3P: policyref="http://www.microad.jp/w3c/p3p.xml",CP="NOI DSP COR NID DEVo PSAo OUR STP STA PRE"
Access-Control-Allow-Origin: *
Connection: close
Content-Type: image/gif
Access-Control-Allow-Headers: origin, x-requested-with, If-Modified-Since, content-type, Pragma, Cache-Control
Content-Length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 310A
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEEUHi_M02Yee7G6--k4CSjI&google_cver=1&google_push=AehlK4CcDssAugTAwpRNG5DSMlaDEPtF8eceb03c4XybXUJeDcJkEfMzMcpGil5YPQrGRRAZ3_BJJ3kX...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEEUHi_M02Yee7G6--k4CSjI&google_cver=1&google_push=AehlK4CcDssAugTAwpRNG5DSMlaDEPtF8eceb03c4XybXUJeDcJkEfMzMcpGil5YPQrGRRAZ3_B...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjM0OTE2ODUyMDI5Njg0MjM4Mw&google_push=AehlK4CcDssAugTAwpRNG5DSMlaDEPtF8eceb03c4XybXUJeDcJkEfMzMcpGil5YPQrGRRAZ3_BJJ3...

170 B
188 B

190ms
190ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjM0OTE2ODUyMDI5Njg0MjM4Mw&google_push=AehlK4CcDssAugTAwpRNG5DSMlaDEPtF8eceb03c4XybXUJeDcJkEfMzMcpGil5YPQrGRRAZ3_BJJ3kX6FMIounVPbka83t4g3MiA62b5XPpeCQvZxasfFsETTLrbGyUWKkAnCJdwzZQvDRdlJX0ArfgBh0

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjM0OTE2ODUyMDI5Njg0MjM4Mw&google_push=AehlK4CcDssAugTAwpRNG5DSMlaDEPtF8eceb03c4XybXUJeDcJkEfMzMcpGil5YPQrGRRAZ3_BJJ3kX6FMIounVPbka83t4g3MiA62b5XPpeCQvZxasfFsETTLrbGyUWKkAnCJdwzZQvDRdlJX0ArfgBh0
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3 200 dot.gif
s0.2mdn.net/ Frame 310A 43 B
70 B 880ms
865ms Image
image/gif 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESELafiUpM_KJQPIaZoklFQmM&google_cver=1&google_push=AehlK4D6RHRCQ1FW0jupN7aFODmoc3gP3cGAymVIgf8YkELDa0p6nTQYBgxktAIRGXJwlBxPfhkdDS-PRBVIzfLK30NbtPoz5SbvoXi-hVL3ahBtgLzghMDrm7APXUmg_lIeoXgfLeSo-T9Onvb65hVKXgvT

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 13 Sep 2022 05:31:49 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 310A 0
12 B 210ms
195ms Image
text/html 142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13L5c7F7x7IkeGCYWn28aNNFJTfTOziThfTs03zxjIUsWE3WE2AWdR2mLiG8Bqidvpm0jGZ9sA

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:48 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 300x250.html Show response
s0.2mdn.net/sadbundle/2863677302136658033/300x250/ Frame 41C8 7 KB
3 KB 256ms
244ms Document
text/html 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6d6d2519e07da9b6e78b87bc5114dd58e609d3bd26388183e8a3e57f7de982a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 21152
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2652
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sun, 11 Sep 2022 23:39:16 GMT
expires: Mon, 11 Sep 2023 23:39:16 GMT
last-modified: Wed, 13 Jul 2022 10:50:02 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 73F0 0
64 B 211ms
198ms Ping
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssLjuuNZ5kCPLu1AsGntu_j7-KyidR1NEoEzm5kpARf6FBjBunDWPxDTwZPgmTj8NM2UrWLP9vAz2bLXNzBvxmlwn7nPAMhyW8CfhfAWvqm9utlPLuXjEhmTcXRa2cX3dL9Ukr8NRvLXZUO-maNONwKTHVAa6pUu5JApBFtdu9wwGUJsezZnowCCFuYgTILzTWfR6GR0FL1Xran8Ym_UxRcgdCV14wBWgi3c6kMLRHbN1brhTlnkiRjUxs9QJ0oSgyiV65rzfJ5ClMT-BkXD8Zi9MXKY_ABI93nUA3ijmvoGU3QdoMQOkFno16ny0i_-BXgmjHb7_seEIb-nXe1dSFpINFJiGTtDSlNX0rIedm695MFJmx1nM-zR8JYPSvhnvzyPKZRhlMzVz3haArHsXrpI_Sh0GGrfV7Qgr7l-a2okXpCw8p9lk8e8uSGcC9UX-Z6IwKisoXatnkftAAnckllfLx_nvgJAkT_X33e4fbqDPeNhEMEkevNO7_ZHaIEitNvE6Coo0-xilrDMWD451xZhQFJmswWY_KTEzjS519lmeT7CrlR436u8uCOW4ZFVQ7dtR5Ujfs_B03sv5l-Uyhc9fe46lqUzI4xws4MP_fSt27QTxzACaCkKgMWgw8mcFI9fMzLBrgDm8SsWjvfaFW21btuq0g_gk5SIVZ6goTUJJG0E8u2YEYauV7WiAp2C7waTjrly7aZfhP-yHHcmg6J3QZBDKSv_8SyObno9jINklGU3WzZf5qVgNcKDWZY-zRBlYz8o3gb1T7gMxBfJluQ3VwJ7fJcDSP1NS_LO2ubCgShGAg20b9crgslfgUTsv5GiJlMJT92s_gh-Zw7Bl8ZN52dF65dYj1QlsKKKPAOhO4KwLJ8u8dgZsYVdYnJW-TXBNUeZy-3P6LdSQg0M1iAATSf8IwCAP9qiuubuSa8ejH7O6sk1ZMLT8sT1AlC9MDudAC5QJFbinyPJ3M2qyS__N-ffdJ6Amd2TKZbd-pLlG3d7UTEGhLXhuLk6QMdTW879fmQ4yWQQZng5FTcMSVkJfJk3DPVT848yywMmJqfney0npOXM660FcvGqNaU3Rr7vwRpWA8RHUw_KXwpGB2vepOvmdsjhpd2f0p2OifmQC3wPQArBmtaYaNkxd5umf4wjrG65p-e9HRxjerqh6NbxhIlu2CpBLW_jzc44XrB0NScmK91CPrHzIO6kB7b9y37ua2uTzZy_sy0BmbtuwgwSSQKryU1UmGq5QA_AujXKqwKiz376yQPCnsPy9rh2wyuphsUsrbRYTPNCLsT1qZOkwstwuMJVqCuGwdE&sai=AMfl-YQ14f3hbw6Hg3oZe_TvWXgLe9FwSv8CoAufHia5pNb5OPAEBbAuKHhdxe4NGFzK4ffU2Hncmi56Yy3ZnCzMZnJTJF4B__N69Yhb_dIIMWJ56iSd2ERxig4olCszas37Ndj5FwEyuyEaQI5HV-TJIVl98fe5wCn7S_XkAGxxcyM_WDyi3P3T5E6YfVATkoRZ9gb5SWEE4-3rwtldhas5fg&sig=Cg0ArKJSzMXUw1wKotLbEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=642&cbvp=1&cstd=641&cisv=r20220907.56808&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Mon, 12 Sep 2022 05:31:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8985 22 KB
8 KB 170ms
168ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 161474
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 10 Sep 2022 08:40:34 GMT
expires: Sun, 10 Sep 2023 08:40:34 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 05E5 22 KB
8 KB 180ms
179ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 161474
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 10 Sep 2022 08:40:34 GMT
expires: Sun, 10 Sep 2023 08:40:34 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js Show response
pagead2.googlesyndication.com/bg/ Frame 33EF 36 KB
16 KB 184ms
184ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2510ed81c525ffb3948c9e103bc6d56f036e45346a0d4c6e481602c223c74ba5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 11:24:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65229
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15893
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 11 Sep 2023 11:24:39 GMT

GET
H3 200 JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js Show response
pagead2.googlesyndication.com/bg/ Frame DF99 36 KB
16 KB 187ms
186ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2510ed81c525ffb3948c9e103bc6d56f036e45346a0d4c6e481602c223c74ba5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 11:24:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65229
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15893
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 11 Sep 2023 11:24:39 GMT

GET
H3 200 JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js Show response
pagead2.googlesyndication.com/bg/ Frame BE9F 36 KB
16 KB 212ms
211ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2510ed81c525ffb3948c9e103bc6d56f036e45346a0d4c6e481602c223c74ba5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 11:24:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65229
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15893
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 11 Sep 2023 11:24:39 GMT

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame D802 236 KB
63 KB 332ms
332ms Script
text/javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 12 Sep 2022 05:31:48 GMT

GET
H3 200 300x250.js Show response
s0.2mdn.net/sadbundle/2863677302136658033/300x250/ Frame D802 15 KB
3 KB 252ms
251ms Script
application/x-javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b5db0d95ffa94ac8e89f08909cea2a63c35efe802d5d55fb490e8277ed38ee72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:39:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21152
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2684
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:39:16 GMT

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 10DB 236 KB
63 KB 361ms
351ms Script
text/javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 12 Sep 2022 05:31:48 GMT

GET
H3 200 300x250.js Show response
s0.2mdn.net/sadbundle/13099338561793074780/300x250/ Frame 10DB 15 KB
3 KB 237ms
226ms Script
application/x-javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/300x250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b5db0d95ffa94ac8e89f08909cea2a63c35efe802d5d55fb490e8277ed38ee72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 00:21:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18618
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2684
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:47:53 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Sep 2023 00:21:30 GMT

GET
H3 200 039df2728f99fbc850c400246b722d07.js Show response
s0.2mdn.net/sadbundle/2987880808898358456/ Frame 3695 73 KB
21 KB 240ms
225ms Script
application/x-javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2987880808898358456/039df2728f99fbc850c400246b722d07.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b6bdff44845c8c714a7eafe96599d38d7d48147225a9d556113e445011ec74ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 07:00:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 167465
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21766
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:44 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Sep 2023 07:00:43 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2356
Redirect Chain

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESENws7xIX22SMh_iafgLC9kI&google_cver=1&google_push=AehlK4DoMiWoUN7FlW3fftrEAKiLqKGlFl4106SXLUkTULG-ggS3ABK...
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=3db973db869c1b2f&is_secure=true&networkId=14000&version=1&google_gid=CAESENws7xIX22SMh_iafgLC9kI&google_cver=1&google_push=AehlK4DoMiWo...
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAJqFty_zdgLQM2psOlAAAAAAA&expiration=1663047109&google_cver=1&is_secure=true&google_gid=CAESENws7xIX22SMh_iafgLC9...

170 B
188 B

184ms
184ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAJqFty_zdgLQM2psOlAAAAAAA&expiration=1663047109&google_cver=1&is_secure=true&google_gid=CAESENws7xIX22SMh_iafgLC9kI&google_push=AehlK4DoMiWoUN7FlW3fftrEAKiLqKGlFl4106SXLUkTULG-ggS3ABKOPDR8oqJJkbjdVk0SuUuLFoWWNxfGOeRM4LpVd_8-pZlqvKn_qdmEk__jZ8ctKAh_kSRwxnBkOzPyQWdq32KSzWcL

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAJqFty_zdgLQM2psOlAAAAAAA&expiration=1663047109&google_cver=1&is_secure=true&google_gid=CAESENws7xIX22SMh_iafgLC9kI&google_push=AehlK4DoMiWoUN7FlW3fftrEAKiLqKGlFl4106SXLUkTULG-ggS3ABKOPDR8oqJJkbjdVk0SuUuLFoWWNxfGOeRM4LpVd_8-pZlqvKn_qdmEk__jZ8ctKAh_kSRwxnBkOzPyQWdq32KSzWcL
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 2356
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEEaNavYJusHsDY2i0Y7KlF4&google_cver=1&google_push=AehlK4BcrB4vZiFB19t5YIpdrv-mV3R1qQY6ssKwExmOaS8jVx1OBXaS2WArXcMcUL2vDDLMeORlsEdZByAWG-LbxFMsrSGCAWdOG...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEEaNavYJusHsDY2i0Y7KlF4&google_cver=1&google_push=AehlK4BcrB4vZiFB19t5YIpdrv-mV3R1qQY6ssKwExmOaS8jVx1OBXaS2WArXcMcUL2vDDLMeORlsEdZByAWG-LbxFMsrSGCAWd...

43 B
419 B

284ms
282ms

Image
image/gif

172.64.152.245
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEEaNavYJusHsDY2i0Y7KlF4&google_cver=1&google_push=AehlK4BcrB4vZiFB19t5YIpdrv-mV3R1qQY6ssKwExmOaS8jVx1OBXaS2WArXcMcUL2vDDLMeORlsEdZByAWG-LbxFMsrSGCAWdOG7QHApow8FQ7V1tBCtexJZJjrj26MfqAWQMIcv90Pw2w&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAehlK4BcrB4vZiFB19t5YIpdrv-mV3R1qQY6ssKwExmOaS8jVx1OBXaS2WArXcMcUL2vDDLMeORlsEdZByAWG-LbxFMsrSGCAWdOG7QHApow8FQ7V1tBCtexJZJjrj26MfqAWQMIcv90Pw2w%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 172.64.152.245 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
cf-ray: 74964251aa0e3773-MEL
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
content-type: image/gif; charset=utf-8
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 1847
cf-ray: 7496424f4db13773-MEL
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEEaNavYJusHsDY2i0Y7KlF4&google_cver=1&google_push=AehlK4BcrB4vZiFB19t5YIpdrv-mV3R1qQY6ssKwExmOaS8jVx1OBXaS2WArXcMcUL2vDDLMeORlsEdZByAWG-LbxFMsrSGCAWdOG7QHApow8FQ7V1tBCtexJZJjrj26MfqAWQMIcv90Pw2w&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAehlK4BcrB4vZiFB19t5YIpdrv-mV3R1qQY6ssKwExmOaS8jVx1OBXaS2WArXcMcUL2vDDLMeORlsEdZByAWG-LbxFMsrSGCAWdOG7QHApow8FQ7V1tBCtexJZJjrj26MfqAWQMIcv90Pw2w%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control: no-cache, private
content-type: text/html
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2356
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEGDtkkquHyY2QOMVFDSFvDg&google_cver=1&google_push=AehlK4Dvo-BFKA4S0AvzK36JWdBFusmPsoi2U3id8rYz6-MUE3mRl8J3wkPmBMMvEwx-8V7r5xp1liX6hIyrVJVxxU...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=Nzg0NDVlNzQtYWQzNC00M2M0LTlmNGEtZTg4ZDM2OGM5ZThj&google_push&gdpr=0&gdpr_consent=&ttd_tdid=78445e74-ad34-43c4-9f4a-e88d368c9e8c

170 B
188 B

190ms
187ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=Nzg0NDVlNzQtYWQzNC00M2M0LTlmNGEtZTg4ZDM2OGM5ZThj&google_push&gdpr=0&gdpr_consent=&ttd_tdid=78445e74-ad34-43c4-9f4a-e88d368c9e8c

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=Nzg0NDVlNzQtYWQzNC00M2M0LTlmNGEtZTg4ZDM2OGM5ZThj&google_push&gdpr=0&gdpr_consent=&ttd_tdid=78445e74-ad34-43c4-9f4a-e88d368c9e8c
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 423

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2356
Redirect Chain

https://cr-p1.ladsp.com/cookiesender/1?google_push=AehlK4A83d4qEuCOYd1g5On5PIqix8eiHrYxy0hBC99yKXOyZHjInZHSLPLY1VDnSMuwQzEB5MPPf1BJ0obbefIYKy8UfSQKv77Kt9meBIPIOjyUVKpmkigD-Uf1h_FOJBV5TxK1CqkszB32&g...
https://cr-p1.ladsp.com/cookiesender/1?cr=true&google_push=AehlK4A83d4qEuCOYd1g5On5PIqix8eiHrYxy0hBC99yKXOyZHjInZHSLPLY1VDnSMuwQzEB5MPPf1BJ0obbefIYKy8UfSQKv77Kt9meBIPIOjyUVKpmkigD-Uf1h_FOJBV5TxK1Cq...
https://cm.g.doubleclick.net/pixel?google_nid=sonet&google_push=AehlK4A83d4qEuCOYd1g5On5PIqix8eiHrYxy0hBC99yKXOyZHjInZHSLPLY1VDnSMuwQzEB5MPPf1BJ0obbefIYKy8UfSQKv77Kt9meBIPIOjyUVKpmkigD-Uf1h_FOJBV5T...

170 B
188 B

184ms
184ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sonet&google_push=AehlK4A83d4qEuCOYd1g5On5PIqix8eiHrYxy0hBC99yKXOyZHjInZHSLPLY1VDnSMuwQzEB5MPPf1BJ0obbefIYKy8UfSQKv77Kt9meBIPIOjyUVKpmkigD-Uf1h_FOJBV5TxK1CqkszB32&google_hm=AQNWvy11_WmNks8ADsWuGCsRCMA

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
via: 1.1 ffa0d2acb6ab662531e95cf2a187fa40.cloudfront.net (CloudFront)
server: Logicad
x-amz-cf-pop: SIN52-C3
x-cache: Miss from cloudfront
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
location: https://cm.g.doubleclick.net/pixel?google_nid=sonet&google_push=AehlK4A83d4qEuCOYd1g5On5PIqix8eiHrYxy0hBC99yKXOyZHjInZHSLPLY1VDnSMuwQzEB5MPPf1BJ0obbefIYKy8UfSQKv77Kt9meBIPIOjyUVKpmkigD-Uf1h_FOJBV5TxK1CqkszB32&google_hm=AQNWvy11_WmNks8ADsWuGCsRCMA
cache-control: no-cache
content-length: 0
x-amz-cf-id: _Rucf9YY-XVF2PdR2fjbskYSoxlpCFQhnaj9jcJzvGe1rG_JuVccFw==
expires: -1

GET
H/1.1

200
OK

sync
gdn.socdm.com/rtb/ Frame 2356
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=google&sspid=google&google_gid=CAESEFBR5TE3mku2T85E70b3BQw&google_cver=1&google_push=AehlK4CVyrATgsLIpaSvLEKeZLP2AhNzlt_e0F_88C-w-5PSRo9qNN23LtOMmsIvlkzlc...
https://cm.g.doubleclick.net/pixel?google_nid=scout&google_cm&google_hm=WXg3RVJjQ284WDRBQU91VFd3a0FBQUFB
https://gdn.socdm.com/rtb/sync?proto=google&sspid=google&google_gid=CAESEFQ4IA1KuDpvr07l2zZBEjk&google_cver=1

43 B
960 B

662ms
222ms

Image
image/gif

202.241.208.2
IDCF IDC Frontier...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gdn.socdm.com/rtb/sync?proto=google&sspid=google&google_gid=CAESEFQ4IA1KuDpvr07l2zZBEjk&google_cver=1
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Server: 202.241.208.2 , Japan, ASN4694 (IDCF IDC Frontier Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 12 Sep 2022 05:31:50 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync?proto=google&sspid=google&google_gid=CAESEFQ4IA1KuDpvr07l2zZBEjk&google_cver=1","cluster_id":12,"gdpr":false,"ipv4":"103.209.254.118","key":"Yx7ERcCo8X4AAOuTWwkAAAAA","privacy_sensitive":false,"uid":"Yx7ERcCo8X4AAOuTWwkAAAAA","upstream_id":"a-ad40019"}
X-SO-Key: Yx7ERcCo8X4AAOuTWwkAAAAA
X-SO-Upstream-ID: a-ad40019
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-HostName: a-ad40019.dc2p.scaleout.jp
X-SO-UID: Yx7ERcCo8X4AAOuTWwkAAAAA
Connection: keep-alive
Content-Length: 43
X-SO-IP: 103.209.254.118
X-SO-Cluster-ID: 12
Server: nginx
Content-Type: image/gif
Cache-Control: private
X-SO-Ads-Time: 5
X-SO-LB-Hostname: a-ng40007.dc2p.scaleout.jp

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://gdn.socdm.com/rtb/sync?proto=google&sspid=google&google_gid=CAESEFQ4IA1KuDpvr07l2zZBEjk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 318
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2356
Redirect Chain

https://sync.dsp.reemo-ad.jp/google_adx?google_gid=CAESELGKhsLdoKHVQAK-obx9MV4&google_cver=1&google_push=AehlK4DcH-z1qla8Igj175ZMM1qE-bghU5Kgo1e9ahDMQdCtV_yZLLAgt1y7A2rF6iPz_xSEY8ESsXmOQPOVCJVSdx84...
https://cm.g.doubleclick.net/pixel?google_nid=gmo_ad_marketing&google_push=AehlK4DcH-z1qla8Igj175ZMM1qE-bghU5Kgo1e9ahDMQdCtV_yZLLAgt1y7A2rF6iPz_xSEY8ESsXmOQPOVCJVSdx84qzLzaFdVw3-vGXu7gt-aVthLW9sgF2...

170 B
188 B

184ms
184ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gmo_ad_marketing&google_push=AehlK4DcH-z1qla8Igj175ZMM1qE-bghU5Kgo1e9ahDMQdCtV_yZLLAgt1y7A2rF6iPz_xSEY8ESsXmOQPOVCJVSdx84qzLzaFdVw3-vGXu7gt-aVthLW9sgF2B17UKI73qRCLpxi3HahLz5

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=gmo_ad_marketing&google_push=AehlK4DcH-z1qla8Igj175ZMM1qE-bghU5Kgo1e9ahDMQdCtV_yZLLAgt1y7A2rF6iPz_xSEY8ESsXmOQPOVCJVSdx84qzLzaFdVw3-vGXu7gt-aVthLW9sgF2B17UKI73qRCLpxi3HahLz5
date: Mon, 12 Sep 2022 05:31:49 GMT
server: nginx

GET

gobRedirectFromId5
sync.inmobi.com/ Frame 2356
Redirect Chain

https://sync.inmobi.com/gob?google_gid=CAESECfQefEdfVrEeOD2AproWog&google_cver=1&google_push=AehlK4DfaDsXoYKg47zkmfE71U8h6ULIKBBfl5SqI5Am33lxbwcysT-A1vO_-UCRZpZP4wnfI3z1UxRQ-mv1YP5SBKDmVghWZ2x0skGt...
https://id5-sync.com/i/495/0.gif?callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAehlK4DfaDsXoYKg47zkmfE71U8h6ULIKBBfl5SqI5Am33lxbwcysT-A1vO_-UCRZpZP...
https://sync.inmobi.com/gobRedirectFromId5?id=ID5-ZHMOdzSr7d9MjM92wKncZ_9CbpqOcmjKPQxrPZlVEg&google_push=AehlK4DfaDsXoYKg47zkmfE71U8h6ULIKBBfl5SqI5Am33lxbwcysT-A1vO_-UCRZpZP4wnfI3z1UxRQ-mv1YP5SBKDm...

0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2356 0
12 B 195ms
182ms Image
text/html 142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JVDxUNrM_QiFF9Jrnhmqt_Agmqartqxp8-pNnC0ijv43mPDUUGUzMgLRqTXeEDOhbCfHMkkw

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:48 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
DATA 200
OK truncated
/ Frame 04A2 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 293ba2204bbf7f2902aad6def47c0051155d8adddc72c10a74e3fa0adde9b830

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js Show response
pagead2.googlesyndication.com/bg/ Frame 6973 36 KB
16 KB 188ms
181ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2510ed81c525ffb3948c9e103bc6d56f036e45346a0d4c6e481602c223c74ba5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 11:24:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65229
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15893
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 11 Sep 2023 11:24:39 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 5CD2 35 B
464 B 523ms
170ms Image
image/gif 103.229.10.171
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEHO06n6QiJ1m1dpxhDrmeu0&google_cver=1&google_push=AehlK4B1FXFpv3RJNDA51jg1q0L6BeMENuxAvDtMpZRXbAIke-AWle7espaqdaNAcBfEaVSj6vW6jxynGqi2j6z88kTNiVaC64dUKtH9Toup8BBhqMizhqKtZ9KUUtVRFy_6-W2bN6jbcck5vvzbfPgWEw

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.229.10.171 , Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5CD2
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEACVYUeaqodIVY26Oxd-STg&google_cver=1&google_push=AehlK4Dbd65w_rBLtKAzGT3zghdBIpiqMWpTAw_a631rDHR1j4xzRg7KpdRe0mVd1x4vpSM-TtSQm7HOvg4DvENBoM...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=Nzg0NDVlNzQtYWQzNC00M2M0LTlmNGEtZTg4ZDM2OGM5ZThj&google_push&gdpr=0&gdpr_consent=&ttd_tdid=78445e74-ad34-43c4-9f4a-e88d368c9e8c

170 B
188 B

184ms
183ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=Nzg0NDVlNzQtYWQzNC00M2M0LTlmNGEtZTg4ZDM2OGM5ZThj&google_push&gdpr=0&gdpr_consent=&ttd_tdid=78445e74-ad34-43c4-9f4a-e88d368c9e8c

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=Nzg0NDVlNzQtYWQzNC00M2M0LTlmNGEtZTg4ZDM2OGM5ZThj&google_push&gdpr=0&gdpr_consent=&ttd_tdid=78445e74-ad34-43c4-9f4a-e88d368c9e8c
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 423

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5CD2
Redirect Chain

https://cs.r-ad.ne.jp/2/cs?google_gid=CAESEGpO952CGZymQr_J6Q4sVFc&google_cver=1&google_push=AehlK4BEgQfovvfNXuqLuM303422iGnH0L4fWKy3QyQDaB_UONGyTn3rKV5ZJsmzVJJHYNl2oBcTxNVfNXIW1Kebcr2UUj_qw6XgFEwIw...
https://cm.g.doubleclick.net/pixel?google_nid=rcrt&google_push=AehlK4BEgQfovvfNXuqLuM303422iGnH0L4fWKy3QyQDaB_UONGyTn3rKV5ZJsmzVJJHYNl2oBcTxNVfNXIW1Kebcr2UUj_qw6XgFEwIwALvIHqEnOZJcD2Qhzk7ukbeAFRKmw...

170 B
188 B

184ms
184ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rcrt&google_push=AehlK4BEgQfovvfNXuqLuM303422iGnH0L4fWKy3QyQDaB_UONGyTn3rKV5ZJsmzVJJHYNl2oBcTxNVfNXIW1Kebcr2UUj_qw6XgFEwIwALvIHqEnOZJcD2Qhzk7ukbeAFRKmw8uHF89T477_spK0LX_0Ro&google_hm=NTBSNVZuMDFGQkRBWTAwOEdKSkI

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-store, no-cache
Date: Mon, 12 Sep 2022 05:31:49 GMT
Server: nginx
P3P: CP="NON DSP COR CURa ADMa DEVa CUSo TAIa PSDo OUR BUS UNI COM NAV STA"
location: //cm.g.doubleclick.net/pixel?google_nid=rcrt&google_push=AehlK4BEgQfovvfNXuqLuM303422iGnH0L4fWKy3QyQDaB_UONGyTn3rKV5ZJsmzVJJHYNl2oBcTxNVfNXIW1Kebcr2UUj_qw6XgFEwIwALvIHqEnOZJcD2Qhzk7ukbeAFRKmw8uHF89T477_spK0LX_0Ro&google_hm=NTBSNVZuMDFGQkRBWTAwOEdKSkI
cache-control: private, no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 0
X-SID: 159f32b0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5CD2
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEOJ_6Y6ttWtV8hn6-M0gI1U&google_cver=1&google_push=AehlK4C8zQsJPQUxq1K1v0QFOc_NOhyWV5oDgqsGn0n-jhIM6jepsKM-d6cDGRD-YrD96sWXj5XfC54kTWmCC373...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=98ced7d4&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=AehlK4C8zQsJPQUxq1K1v0QFOc_NOhyWV5oDgqsGn0n-jhIM...

170 B
188 B

189ms
187ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=98ced7d4&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=AehlK4C8zQsJPQUxq1K1v0QFOc_NOhyWV5oDgqsGn0n-jhIM6jepsKM-d6cDGRD-YrD96sWXj5XfC54kTWmCC373_ZlkdoWBuKsHcYVsduxt4D3D_G9vvnJUkRRLV0rfXiPDRPO30tAax7oByf68i263JSk

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 12 Sep 2022 05:31:49 GMT
via: 1.1 e947961d46d4aa161784258339d7564e.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: SIN52-C3
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=98ced7d4&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=AehlK4C8zQsJPQUxq1K1v0QFOc_NOhyWV5oDgqsGn0n-jhIM6jepsKM-d6cDGRD-YrD96sWXj5XfC54kTWmCC373_ZlkdoWBuKsHcYVsduxt4D3D_G9vvnJUkRRLV0rfXiPDRPO30tAax7oByf68i263JSk
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: dPMqepMRQi8oZ6JGyEg7sQKNMkyL9xnxT8VmvupSHs-vTYa6ZbXvpw==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5CD2
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEACw4CaHjoK0_cUyuNLiUG8&google_cver=1&google_push=AehlK4Dboyoq07fXuRboaXYbtJXJuzKY4qRU-SHncQdvPegKLw9Kay6nb5K2XBDEptefPeZ2q3BCEJm-SvnAKmYNRfDb-DUf4l...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjgzNTYwOTQ3MDMxNzM4MTk5OTI1OA%3D%3D&google_push=AehlK4Dboyoq07fXuRboaXYbtJXJuzKY4qRU-SHncQdvPegKLw9Kay6n...

170 B
188 B

188ms
186ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjgzNTYwOTQ3MDMxNzM4MTk5OTI1OA%3D%3D&google_push=AehlK4Dboyoq07fXuRboaXYbtJXJuzKY4qRU-SHncQdvPegKLw9Kay6nb5K2XBDEptefPeZ2q3BCEJm-SvnAKmYNRfDb-DUf4lJuPB6MymI_BgLzhgHNJ5coCMiCaEkaGVm6QfbZj_OPTLC0prf829xbx4k

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjgzNTYwOTQ3MDMxNzM4MTk5OTI1OA%3D%3D&google_push=AehlK4Dboyoq07fXuRboaXYbtJXJuzKY4qRU-SHncQdvPegKLw9Kay6nb5K2XBDEptefPeZ2q3BCEJm-SvnAKmYNRfDb-DUf4lJuPB6MymI_BgLzhgHNJ5coCMiCaEkaGVm6QfbZj_OPTLC0prf829xbx4k
date: Mon, 12 Sep 2022 05:31:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5CD2
Redirect Chain

https://rtb2-useast.torchad.com/sync?exchange=309&google_gid=CAESEEjXRDmUqnHdfs-4C5WrYhM&google_cver=1&google_push=AehlK4AmUr8fpfdn6y6rcwMFQEJXT2bXGR9y5qR-urElDbLigqtC0mvhnX-iHkyBgYrtxY8iRyjNrhjn6h...
https://dsp.adkernel.com/adkuid?r=https%3A%2F%2Frtb2-useast.torchad.com%2Fsync%3Fexchange%3D309%26google_gid%3DCAESEEjXRDmUqnHdfs-4C5WrYhM%26google_cver%3D1%26google_push%3DAehlK4AmUr8fpfdn6y6rcwMF...
https://rtb2-useast.torchad.com/sync?adkuid=A3676920180367002435&exchange=309&google_gid=CAESEEjXRDmUqnHdfs-4C5WrYhM&google_cver=1&google_push=AehlK4AmUr8fpfdn6y6rcwMFQEJXT2bXGR9y5qR-urElDbLigqtC0m...
https://cm.g.doubleclick.net/pixel?google_nid=unmatched_solutions_ltd&google_hm=QTM2NzY5MjAxODAzNjcwMDI0MzU&google_push=AehlK4AmUr8fpfdn6y6rcwMFQEJXT2bXGR9y5qR-urElDbLigqtC0mvhnX-iHkyBgYrtxY8iRyjNr...

170 B
188 B

184ms
184ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=unmatched_solutions_ltd&google_hm=QTM2NzY5MjAxODAzNjcwMDI0MzU&google_push=AehlK4AmUr8fpfdn6y6rcwMFQEJXT2bXGR9y5qR-urElDbLigqtC0mvhnX-iHkyBgYrtxY8iRyjNrhjn6hP_9ZKOtbLex2yHutCPq79ajszvvlyysP0mb2a20x3OrbD3noAIRFLRXqydpQztZnVAaXZHI30

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=unmatched_solutions_ltd&google_hm=QTM2NzY5MjAxODAzNjcwMDI0MzU&google_push=AehlK4AmUr8fpfdn6y6rcwMFQEJXT2bXGR9y5qR-urElDbLigqtC0mvhnX-iHkyBgYrtxY8iRyjNrhjn6hP_9ZKOtbLex2yHutCPq79ajszvvlyysP0mb2a20x3OrbD3noAIRFLRXqydpQztZnVAaXZHI30
Date: Mon, 12 Sep 2022 05:31:50 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5CD2
Redirect Chain

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEKbQ-yx3dNgXsVMcZ9a--Fc&google_cver=1&google_push=AehlK4AD3FJJDQ1iYL-a614SpJOMW8O50gJn2TG_5UhfngGk0QxvFS7Zb2V35tnxQ5dl8Rx7mHdQvLqegztJaRNVa...
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MjU5ODY4YTYtYzU1Yi00ZTFkLTk5MTAtNWRhNWI5YjFhZTI5&google_push=AehlK4AD3FJJDQ1iYL-a614SpJOMW8O50gJn2TG_5UhfngGk0QxvFS7Zb2V35tnx...

170 B
188 B

187ms
186ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MjU5ODY4YTYtYzU1Yi00ZTFkLTk5MTAtNWRhNWI5YjFhZTI5&google_push=AehlK4AD3FJJDQ1iYL-a614SpJOMW8O50gJn2TG_5UhfngGk0QxvFS7Zb2V35tnxQ5dl8Rx7mHdQvLqegztJaRNVade1l15_ZMmFBlhsPsRkXKCuGU67OXf2KHD0GYHi8fheDsLioHHysroF-CYO5Ntl0EY

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MjU5ODY4YTYtYzU1Yi00ZTFkLTk5MTAtNWRhNWI5YjFhZTI5&google_push=AehlK4AD3FJJDQ1iYL-a614SpJOMW8O50gJn2TG_5UhfngGk0QxvFS7Zb2V35tnxQ5dl8Rx7mHdQvLqegztJaRNVade1l15_ZMmFBlhsPsRkXKCuGU67OXf2KHD0GYHi8fheDsLioHHysroF-CYO5Ntl0EY
date: Mon, 12 Sep 2022 05:31:49 GMT
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 5CD2 0
12 B 186ms
182ms Image
text/html 142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13ID8Lmc0lSUrUEKq8VABYblGAzf3b4QRteJFGsYQZcXW4pJSW6AnpKZug8oFkB_tkujrBFbKA

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:48 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js Show response
pagead2.googlesyndication.com/bg/ Frame 8B83 36 KB
16 KB 208ms
204ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2510ed81c525ffb3948c9e103bc6d56f036e45346a0d4c6e481602c223c74ba5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 11:24:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65229
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15893
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 11 Sep 2023 11:24:39 GMT

GET
H3 200 22d90a57217d2755ef494efedb70ee6a.js Show response
s0.2mdn.net/sadbundle/7704509421823420664/ Frame 99E8 73 KB
21 KB 331ms
330ms Script
application/x-javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7704509421823420664/22d90a57217d2755ef494efedb70ee6a.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7704509421823420664/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

057249f6832776f741b31e857eb64ae85f5cec4c661b289b6dc2de17aa759c79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7704509421823420664/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 14:43:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 571696
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21770
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Sep 2023 14:43:32 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame E942 43 B
215 B 292ms
292ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=a3fdc6bd-681d-a70f-229e-dc8362df05fd&tv=%7Bc:nYx2gd,time:669,type:e,im:%7BpWait:17%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:669,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:33,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B661~0%5D,as:%5B660~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:thc9EK2+11%7C12%7C13.1102537-64448508%7C131%7C132%7C133%7C134%7C141%7C151%7C152%7C16.1133689-65389534%7C161%7C162%7C163%7C171%7C172%7C18%7C19*.1102537-64448505%7C191%7C192%7C1a.1102537-64448504%7C1a1%7C1b%7C1c%7C1d.1102537-64448508%7C1d1,idMap:19*,rmeas:1,rend:0,renddet:DIV%7D&br=c
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-server-name: dt08.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4C28 0
20 B 201ms
184ms Image
image/gif 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BFaMCQ8QeY7_9B4norQGymZ2wDwAAAAA4AeAEAg&bg=!3d6l3prNAAZTikH4c4o7ACkAdvg8WmAxKYgcMG1oRYAr2dbXMfxs298RAQgULYTKz5u-0w0ZPavwGQIAAAGJUgAAAAJoAQeZAwkhTuicO0uDYjSVX4ChhTT5liBclr9Oj9niQViAgPkZ54la5tU6VmmivXsgZiHuUW8uhkYqO5AMT2O6g8l74UpTJ_2gtjWSLauYaIj9mSieQmbHH3CqKGqhJf6qoKPKp2xTNDifseF2kgZFEsne3YGkzuzZJrePjqAniCIcTq0POAGqhrQaZ-JqYiafArkUFdLV8QpkTll5_aPnMjoGQ0JDa7eZ8q19HjC4X6MZq24lj32L2IoSRDXOFTmoHOGvQ-lCSZWDNqhVeYksxWPb0fyVFwftd9swrFE7UNkn1EqxE-c82jgDkebzQb9B-aosCKptwM5OYkMmmb6SsV1a9l3GSACXG68iKe9yQud-B-lfFRZ436d_JpY26yf3Rql2NzVPgil7kVyYth6efaU3EihloC0uPLM6KvJCs9UVg5RSLAtHjM1kcyz05fi0ZX2qydzzd_ERWDgMYlp32NdPhWk_w5enPkyzTYk5vyC1xIjH21mxRfV6xyX6lFALXgzyKGjIpYe1_v1MhjLvtDfwpl5VD5nGrKxoG3yTdMeLvbb8YF7BglbHg3l__UQrTP6X3voWCiMb9GKfOXCNrfoR6pvxmuN_W0xJCnGwsT-hYBfKuRXIf3Vl9c7cFEDC1JzLl4-gfEPIrIy-lWhBxCEzBmIbY0Htio47cnOCa6E3oE8nxdDrYy5mmFcyrOoSY5iLvSzOK9yU1VT6Y6tc0QWHg2Db7zfMs0MhwcrLXcgGYDuAeQ7Ge-o7YupwsSREDEMfluWAz3VIKNGV0lMJWOTE-PtswqsWVisIioHXXf9746wMyPkE7_5s0qkaWUcjQTg5wm3Oi6v40QgXpLjP6hg-Zf02SIyjpTqw0vX3tHAzbxeT92YDSGsJCkZiiJR1WVhWEWtZRWwimeWn-rSsRlBJnwm-hq4Y5hZtrnf8FaLrTVMBTHDwxtTsHG_OgUu01sBlOuIRZPugUd5MnCL1JDjRapHV-wZC_cVPRW2vKV_mIopXtVhNRGI5ese-AjJZIv00YOMPPw_eqMvzC5Y

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:48 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 3C6E 8 KB
802 B 199ms
183ms Stylesheet
text/css 74.125.68.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Condensed:regular|Francois+One:regular|Oswald:600,regular,500

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4069805372741400992/index.html?e=69&leftOffset=0&topOffset=0&c=6zVXdyWvXR&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c00bfe63933627506c70c4ffb0dd51c3793dd62521653147c1acc531feec1893

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Sep 2022 05:31:48 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 12 Sep 2022 05:31:48 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Sep 2022 05:31:48 GMT

GET
H3 200 JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js Show response
pagead2.googlesyndication.com/bg/ Frame 8985 36 KB
16 KB 193ms
181ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2510ed81c525ffb3948c9e103bc6d56f036e45346a0d4c6e481602c223c74ba5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 11:24:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65229
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15893
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 11 Sep 2023 11:24:39 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F876 42 B
64 B 526ms
183ms Fetch
image/gif 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvLX2UNIq4MDRhym6QeUjq5_EPtjHP2MUTQRgPgIf1LRU1KACNim38W9dy4GTBKDVGB1yy6Zrig28NgdWR10Rc-OUke4hWtS_4Ufus2hDZcZXi8VmCUwvcAADaDSCeDunM4aXqQ&sai=AMfl-YREypfcWbZEEVLpq1-rWblzo4CtExLC-EIrnZ5yGizltIXJ52r76Xeog1ZWmv9uo1M2WoEurj67F-Nsr55ZJlU-pw1CJYsYFfqEJlZnIJa-q_1WGQu-VLdBjcHReOUx&sig=Cg0ArKJSzMkvv-Km3lJaEAE&cid=CAASKORoXhRNQzye7Y7Ilvs_7ACSiot1v9xQeSyVBVUAmndTw8K7T8GdWpE&id=lidar2&mcvt=1004&p=1110,436,1200,1164&mtos=1004,1004,1004,1004,1004&tos=1004,0,0,0,0&v=20220907&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=47228975&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1662960705864&rpt=1955&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js Show response
pagead2.googlesyndication.com/bg/ Frame 05E5 36 KB
16 KB 204ms
203ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2510ed81c525ffb3948c9e103bc6d56f036e45346a0d4c6e481602c223c74ba5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 11:24:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65229
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15893
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 11 Sep 2023 11:24:39 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 3C6E 118 KB
40 KB 296ms
296ms Script
text/javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4069805372741400992/index.html?e=69&leftOffset=0&topOffset=0&c=6zVXdyWvXR&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4069805372741400992/index.html?e=69&leftOffset=0&topOffset=0&c=6zVXdyWvXR&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 08:14:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76650
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 12 Sep 2022 08:14:18 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/5217957964584845312/ Frame BA0E 21 KB
4 KB 181ms
181ms Document
text/html 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5217957964584845312/index.html?e=69&leftOffset=0&topOffset=0&c=2o7GEcRwl4&t=1&renderingType=2&ev=01_247

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79dee990fbcd9a3a7318b1dd6694135f25ff8c548972c2de7e004941907af761

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 05:31:49 GMT
expires: Tue, 12 Sep 2023 05:31:49 GMT
last-modified: Thu, 03 Jun 2021 10:36:05 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 04A2 0
63 B 489ms
188ms Ping
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuBtClZOpUQ7-l9Gtulxw4T5xYRaNuiyZUUgRawKQIORtjaoJPfqk1-kxuSRajGNMB7g_qP5fMioLNFUd_9mPaov35qXcVg5_8PfVVUhW0Lgokr-fs0QRJgH_jEfrpoZSGp6o-lAvQq6d02TXwp6POz&sai=AMfl-YQHm_blwiON2wRrO9xMQNwHMKlgnj8wLAqj0_837WBa7PxeyA1KgrbofF0OlE_FevmfKypJ5YJRFtb40dCfnlPFzhjepOPX9p3CMNB6RvTMIJPcJu5xTGAhRo83z1d3&sig=Cg0ArKJSzB1rjFFG7qqhEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=424&cbvp=1&cstd=420&cisv=r20220907.06096&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 m
secure-gg.imrworldwide.com/cgi-bin/ Frame 04A2 44 B
721 B 524ms
172ms Image
image/gif 18.140.108.173
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-gg.imrworldwide.com/cgi-bin/m?ca=nlsn350223&cr=147815508&ce=N924321.3346916UM&pc=343460136&ci=nlsnci1551&am=1&at=view&rt=banner&st=image&r=2786866360&C78=G1,DCM&uoo=0
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.140.108.173 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-140-108-173.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
server: nginx
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-gg.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
accept-ch: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
content-type: image/gif
content-length: 44
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 807F 236 KB
63 KB 383ms
383ms Script
text/javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 12 Sep 2022 05:31:49 GMT

GET
H3 200 300x250.js Show response
s0.2mdn.net/sadbundle/9438485774792436297/300x250/ Frame 807F 38 KB
7 KB 281ms
280ms Script
application/x-javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/300x250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1dcbdfc5488488e89cbd90293ea569677dc790d9f5fdd2efa922f30023b7607f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:32:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21582
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6654
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:55 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:32:07 GMT

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 41C8 236 KB
63 KB 396ms
394ms Script
text/javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 12 Sep 2022 05:31:49 GMT

GET
H3 200 300x250.js Show response
s0.2mdn.net/sadbundle/2863677302136658033/300x250/ Frame 41C8 15 KB
3 KB 287ms
285ms Script
application/x-javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b5db0d95ffa94ac8e89f08909cea2a63c35efe802d5d55fb490e8277ed38ee72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:39:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21153
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2684
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:39:16 GMT

GET
H3 200 Enabler_01_245.js Show response
s0.2mdn.net/879366/ Frame BA0E 110 KB
38 KB 222ms
220ms Script
text/javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_245.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5217957964584845312/index.html?e=69&leftOffset=0&topOffset=0&c=2o7GEcRwl4&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5217957964584845312/index.html?e=69&leftOffset=0&topOffset=0&c=2o7GEcRwl4&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 07:04:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80823
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38568
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 19:32:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 12 Sep 2022 07:04:46 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame BA0E 2 KB
564 B 190ms
185ms Stylesheet
text/css 74.125.68.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Condensed:300

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5217957964584845312/index.html?e=69&leftOffset=0&topOffset=0&c=2o7GEcRwl4&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

17eb650796d0b0ed5521666058a0d6b184785c0a05edf85f3871b6f22175e165

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Sep 2022 05:29:10 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 12 Sep 2022 05:31:49 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Sep 2022 05:31:49 GMT

GET
H3 200 logo_2x.png
s0.2mdn.net/sadbundle/5217957964584845312/ Frame BA0E 17 KB
17 KB 178ms
178ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5217957964584845312/logo_2x.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5217957964584845312/index.html?e=69&leftOffset=0&topOffset=0&c=2o7GEcRwl4&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ea4f88539ccada4ec5e4f57e3f65b66b86ffb4b41075c75267c3ca206c645fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5217957964584845312/index.html?e=69&leftOffset=0&topOffset=0&c=2o7GEcRwl4&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:33:57 GMT
x-content-type-options: nosniff
age: 21472
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17657
x-xss-protection: 0
last-modified: Thu, 03 Jun 2021 10:36:05 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:33:57 GMT

GET
H3 200 1436e83afe0f7197a1b95969b40fada3.png
s0.2mdn.net/sadbundle/2987880808898358456/media/ Frame 3695 68 KB
68 KB 179ms
178ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2987880808898358456/media/1436e83afe0f7197a1b95969b40fada3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c20451840a6d825bcb124d211d619133aa12681916d732010421c004c9f49e8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 07:00:44 GMT
x-content-type-options: nosniff
age: 167465
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 69488
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:44 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Sep 2023 07:00:44 GMT

GET
H3 200 870db89f4d8f886feef2e5fbd187dbfb.png
s0.2mdn.net/sadbundle/2987880808898358456/media/ Frame 3695 1 KB
1 KB 191ms
189ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2987880808898358456/media/870db89f4d8f886feef2e5fbd187dbfb.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8b4af3d2a15cadc97a10007db3cedc12870c8e593db8c8d193684ef0467afb2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 09 Sep 2022 20:50:26 GMT
x-content-type-options: nosniff
age: 204083
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1192
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:44 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Sep 2023 20:50:26 GMT

GET
H3 200 eda1785c4ca9f845cad66226ca68ad9e.png
s0.2mdn.net/sadbundle/2987880808898358456/media/ Frame 3695 1 KB
1 KB 192ms
191ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2987880808898358456/media/eda1785c4ca9f845cad66226ca68ad9e.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

11a017687e31a05190fc12e4ee19c3b90c4418b0c3796f1d52f927f13f77542c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 07:00:44 GMT
x-content-type-options: nosniff
age: 167465
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1096
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:44 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Sep 2023 07:00:44 GMT

GET
H3 200 44ec47d0124001a1a471f1217a750c94.png
s0.2mdn.net/sadbundle/2987880808898358456/media/ Frame 3695 665 B
700 B 192ms
190ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2987880808898358456/media/44ec47d0124001a1a471f1217a750c94.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50dabaa4de5f961e0711ca61ba682ca26c1c3e1e24ef85dfe052a5ab0753a15e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 07:00:44 GMT
x-content-type-options: nosniff
age: 167465
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 665
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:44 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Sep 2023 07:00:44 GMT

GET
H3 200 cb907f8beb8c1373c5101855b75a5493.png
s0.2mdn.net/sadbundle/2987880808898358456/media/ Frame 3695 106 B
141 B 191ms
189ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2987880808898358456/media/cb907f8beb8c1373c5101855b75a5493.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6185857e1e78ed8a5ce22f67e8ffe9224559bfb122a73e1e4fa231c79292b06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 07:00:44 GMT
x-content-type-options: nosniff
age: 167465
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 106
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:44 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Sep 2023 07:00:44 GMT

GET
H3 200 c91afad6a37f3cd22e3f79843f0a0373.png
s0.2mdn.net/sadbundle/2987880808898358456/media/ Frame 3695 5 KB
5 KB 190ms
189ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2987880808898358456/media/c91afad6a37f3cd22e3f79843f0a0373.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae5179c3a7d42f8e5768663569a81a67455c14e18e5fb296f24da5ada19afe3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 07:00:44 GMT
x-content-type-options: nosniff
age: 167465
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4933
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:44 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Sep 2023 07:00:44 GMT

GET
H3 200 fcb0ab3741c84fd3e7e1e4261aa1d189.png
s0.2mdn.net/sadbundle/7704509421823420664/media/ Frame 99E8 49 KB
49 KB 188ms
184ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7704509421823420664/media/fcb0ab3741c84fd3e7e1e4261aa1d189.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7704509421823420664/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eee7a76ec10c9e63189aae235684f0181be729a98740f2e624678aed57ee7d3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7704509421823420664/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 12:25:57 GMT
x-content-type-options: nosniff
age: 147952
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49679
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:54 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Sep 2023 12:25:57 GMT

GET
H3 200 6b4888100ac16a4094eac9f567c568c1.png
s0.2mdn.net/sadbundle/7704509421823420664/media/ Frame 99E8 6 KB
6 KB 181ms
178ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7704509421823420664/media/6b4888100ac16a4094eac9f567c568c1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7704509421823420664/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

acbe390ab3843bbcee111f663a89d6effb6791cf2fdb39eabf3a79e6c8b479d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7704509421823420664/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 12:25:57 GMT
x-content-type-options: nosniff
age: 147952
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6464
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:54 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Sep 2023 12:25:57 GMT

GET
H3 200 eb225bf4e3ef69f9fd894c80c195c93e.png
s0.2mdn.net/sadbundle/7704509421823420664/media/ Frame 99E8 99 B
134 B 191ms
188ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7704509421823420664/media/eb225bf4e3ef69f9fd894c80c195c93e.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7704509421823420664/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7b19eedd4deb11847300a35bf836cecb7232c33b05f634cddafe155629fcb54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7704509421823420664/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 11:47:15 GMT
x-content-type-options: nosniff
age: 63874
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 99
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:54 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 11:47:15 GMT

GET
H3 200 03dc6c0f233b4eb511a9a55c85e82fdb.png
s0.2mdn.net/sadbundle/7704509421823420664/media/ Frame 99E8 6 KB
6 KB 192ms
188ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7704509421823420664/media/03dc6c0f233b4eb511a9a55c85e82fdb.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7704509421823420664/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

026f321c3dd45a524abf52bf92b8fd40be86d58117f1c977b4a0e5cfc9f6a080

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7704509421823420664/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 12:25:57 GMT
x-content-type-options: nosniff
age: 147952
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6032
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:54 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Sep 2023 12:25:57 GMT

GET
H3 200 c4efb47847f971d10e938a7cf9284175.png
s0.2mdn.net/sadbundle/7704509421823420664/media/ Frame 99E8 4 KB
4 KB 190ms
187ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7704509421823420664/media/c4efb47847f971d10e938a7cf9284175.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7704509421823420664/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f148174941b1f66b153a9055e9306d83603dc0dc0bfae3cb5abaa56c72f04d05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7704509421823420664/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 08:15:13 GMT
x-content-type-options: nosniff
age: 76596
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4411
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:54 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 08:15:13 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 33EF 0
20 B 184ms
183ms Image
image/gif 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BuYJIQ8QeY8iFCdS04t4PhuiS-A4AAAAAOAHgBAI&bg=!dXaldjLNAAZTikH4c4o7ACkAdvg8Wtewg_41zqH-UTcTdmFUlEyAVrzi_UZMuowGBJPpLEmLfSx28wIAAAHkUgAAAAJoAQeZAvcpRU6fpRekWg14GK1K7dd1MhsexhxQyvGobWuZ5cOIP-Z1gOrqH-cQZHlF_OrWttFuMp9Ljf1hhD2bBFS5Kym9fVJHlCnwwgMAckhDnu-p-kR_zm0uo_vHlvPX04vn9GInrQ3a3Cu-Sqfa0nGY_7jECJwF2MNRPexC6zdGVNn67fMfxeWSf13VkGBruCH1zigAOgKofaKNSmDPT8Y_4859zmDP2oIc4dQLMOQwkaysoATW-oD2I7zp4dwKl6dhdTR0JvL4hx2sA7GU4LzzjhglJbcnXW2lces7Tmlr98pItVRC54i4fyFf31BerT9gHHJVEYKCN5BCIpvtl-RAbGaVlFBhZU3eaftcWfmUAsZMKADtDbQ_FFaWQoJS94YTNWuuyiYHjq5MSzcs4-JGiQ-7_-bz5nWTqWGmWuxjo-WjsH4LHcwaXA-ZsJ6hw3woxHEx_9kXbC6rxIbQk217fafZDiRk6a7B7VEz1DOaivEeAUZasRfMbqApQA6PTDdTeSB6iYntQwGwey553tfRGIsyO9sMd1C9TAwmSLyMfs6kv4spDqVgfRKS4azWeF6q40iXwOK53CN-KZ7eaGNCyxhuZt3K6oZmPZZ1pvrWbBV2rUFyvY3oBuivgo_NJD5E5OmE8wvWa7E8qPT0fB7aXHp1GcDnYYsyO8vGLLVXmggyK_HNefWXptG42H5ufDqNUVOkY7Fo3EU4u87UDUIdsSgpQ0DzcLmjVmfRT1ndD3aULxpkFlPLLjgVVJygNCuGB1ijdHMuEhoN5pgVxYwUBjinW0zXkeEFq57Srz2HiHaiFP2vPDp1hkwijrAbC29CH-2RRWYp6V8iXMlXhjGsZDnkIEWcmUstlK03aXKUEaVNtO-zYCrhjKxmDF82KaFZn01yajD-HZkbKuXjANU3TX8J2OL_4GmrEH86X2Kd-1wmKC0Zi4G-S_m0ZlBzwb5E50CONu96mQgyyREqdpxoMJ9dj4JhTMViI85RpMhsBcoRVzOcARPeA4U

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DF99 0
20 B 184ms
183ms Image
image/gif 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bs-iHQsQeY5jlO97cz7sPiIe7yAEAAAAAOAHgBAI&bg=!u7iluPzNAAZTikH4c4o7ACkAdvg8Wvacijver4J3e8EH6aU34fyFRL4oZwwSc-0TIpC_Jq7VXE2bTgIAAAHdUgAAAANoAQeZAvccemtvwFZDvGCG749iaHWPw0Hn9k64aM-hRiPhr__xgL0UyPRXh9KlaUwsb0Awl142Tm_TdBaBx4t8QvXlQ-HsoID8DINWGBkxSpV7KIGSz_Gyu5ib-CgsYKSrTTHY76Ty2g0K8rCtGriJnY_-o1mmrsGtymztgRbo4t72GfZO3mEXEPugt-uH7XsnIRjQ_vINI_TM7cO36WZ2tuiNdIrm6CgSl7ThpUZ0n-wfqPiocTdkrbEU16e5byQ09rIlp2gmJkHvj2It5I4197SgAVEy4ArnMBBu7cJ8UWKRbSwskavtEOxDe1aA6fJaNjFMe-05PdfgFSjoeqS4-8RJG_BRlGUNnfF6ltL6h8Xa_3HYYDyf3wYjhxIkXj1YnHbbMKjm6vuCBba0a0xqlb567eo0tBitxA4TOHCScWgdn7S-FRkpzqN7eKYeiLm0Q-395LrxILii2NyIaJStXUg8f3KkmAO9xLNmDFZTCekvcO3JijkoPup6PyLXCc66A0ePKHuajPB8wfeNsn5RzwNOKmoPaKJUX7IHpohPahPI10vK8zRJbm_NLh3RpGUEZUmhNEyTVJqOSQA0ETKjay7E0VNfw8w8lWQJ0xJwgRjd3xXuVVoNhibS6s_I5isXyDU9S2laUjOg-J_myzf-K-E3SHDxRrQDV9Y16FKyns_gFWPp31PR3GE0kSVTsTIpbsksPi54Um7JceE2IqXpWqo3vajUzvQouqqxzp_xOCz2VfBsjhV1eQLBVmAOqbxEUw1klBwUQZvey6djNMTEwyrPYfe04tw12mrNaXfQgyq4XdSPo-ds28NU1ycYWJyJ6UA6zTTrc1BCzG1SktdyBp4csc4IkW4CG5eavJTFLTZKKmWWHhtNnrUzDBNcVUQPGLr70qeQR49Cm1PuELdiZaNylWDwnB16I3plyEjJlGPSp2jHmr28kBAg2_1oG77ljBwiBeD2L1458OGwgjV7QJ07N6rMR3umZTWdg4wVLTLvIWAuKWkzE-KFXHY

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 0C94 42 B
64 B 183ms
183ms Fetch
image/gif 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvce7G2Zpg4vONi2pqwZfQvX1h6rITsI4HKPl7X5RSkMLmjRjqf0iS4M-0CqND5cfsPkAhipG6ODF1aNV9whmohCrqra6ARYn4xg9o-A4CxsBl2V6esaugCvXWLI68Jni3wQoDj&sai=AMfl-YRCWK3BZwHhBQkyZLvV88pjmXPfsrNztf5PFm1L60LRsmCFBuQy0P-46BvrwEMcIHXC8YPJdbXQzWl6SB7xnCP3qgJAqBJsMOUPGK4jTvmyVKjIPsOqTGTfIIhAjms&sig=Cg0ArKJSzBBftbq5dyXHEAE&cid=CAASJ-RoN1dZlOBODV3vCB8bHw11IRgq6dSGf9mk3FkTwH42CKvs027geg&id=lidar2&mcvt=1082&p=982,496,1022,537&mtos=1082,1082,1082,1082,1082&tos=1082,0,0,0,0&v=20220907&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2049900766&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1662960706541&rpt=1349&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/ Frame D802 3 KB
3 KB 178ms
178ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/cta.png

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c9aa038885866972c923e9db4b9fe76f5cb08aa78dab3c5b7a57a0ff444761b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:39:16 GMT
x-content-type-options: nosniff
age: 21153
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2907
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:39:16 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0DD0 0
26 B 186ms
186ms Ping
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuE6GKGDVVJl8Me9UPZwXKmHjv-LpQLwhG7T23FWl1MKyXq5jY0_-ZsFmli-eql7CUoAYoWGwJpSHbrv-fyNAAeH4GJzG_Z3ZdwRRGJFonijZvl2iYpskhhE7DAhKax8VcF_V4V1L0hfJCvOd9PcytJveEtKP5OJOcjXyNVbWs_aw7VmDr7LJUBoYaRzgH2K7dyrf7Ljec_RXj4VIXDmaCzD9xpeYsnuSdzoNr1F3A0lBGEcj0Qlf5ejV6Hv1V8Zb_cE2Sk6hpZu2CpReqIn5cn1xc99Xio8qoKjLYnVoMxEaskXfpmXuPH629mAe-bW60ao8EPhQqVgRi-2BEl_LKWJ3CD8qwJCr-jbA4bNU8ZfvEbxZdho9k3vED_WyWfY9BBbz5JiR7OJ3kFsizJM_0hcddPguuZlyzWaI1ndc71jw_n8ipGT23ZXqyNIR0WFqF-kx6KQki3l3WlMT02ZuRP9jmZNL1Tyr66QM7733tqsj0cjUdhAfFSFEcGocqiSR2TDQ1HdKLcW4dvrvs24ECuisa4i-pbtRli4Y_NHHHnrRlSsYpaie6s_ZpRk0LZTKa2nNDtvGv5-nwlQLcABqQFdkYuWVzvj9wGg-s0BF7lObaQZeyhOUD-eirp3nAt-Lr2-e6RDCzdET4-k0tIuY_8zprV8McxNricgoPqpmN6rI_KxcKue5elVFnNCOLcrYz1F9BUAYEv-GscDMu8VIWb9IIY2E5ESK8d9vKD30H93c5p3glICVyu_3gcI0CTwC3HtQMafgbEZtBXnCG3Q0ZaJ3xw6PgZCixlT_aAjMhfClP1qrRU9dpJT74rJf9ZhLzR9mgLsyXEuC_EbryANdRC5_6J21OeZjsQZH77_-g3nSOOAs3jPE0LpOqHa_sgsm27bUhRvF1sBfVPKxp-_c_ysGemJV3Ra-Sh9fznXj9ZrQa6ynjdIiO_w2oM_IrjCQQsf0y3nOekopZSBF0-KO_ZMFGPtV0j7ImZqSu9fpFu_8qc3f0x8V37E9Pz4fil6ivCZJaJymG50XaOkW2eHJQdqcn4-vR12ryJgiRFwuyMKx42wynCLlmlRcc9MYAwifb8helKyxO3-hVyY0q8R8m-Zh3vndR6lTOqkGbiAzP5Mt4v9a5rDhY_Wo-sRKrn5JrmGVKvXYCOMPwIHXcMevgVJgQdDs2CC5P7xm75o3tb7czXzT38PwPRaRK9TyTgrOf5om9ZuvZn7zf8gjG8OVxV4hHuxC_yv5KyhlADSoCOjeKgZG-YZpaSBSWaSjaLAXynk0xz5U9ChJL5TvSilQ&sai=AMfl-YTtdxYqLwugI-0gynxRVc73Rb0HA3O7JJVAu4I42j1D94S_uU0ymLzi-0mG6pJSXb2paUJFLEQFj3H72_2jsJR5BIuiHCU1I8pNHQLp9O73EB8mY69b1FrmzuBF0M9Id_fdItwa-VHHI89NQEE8k89aBOJ1jRw5pJ8EAaLa3hylee7op0FcUdcstHIj2mHzS7Q7YX0xd9a4PTSqWWz70_dNSDitwQrt8A&sig=Cg0ArKJSzHZYQC2zf6tPEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2284&vt=11&dtpt=1499&dett=3&cstd=782&cisv=r20220907.71286&vwbs=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/13099338561793074780/300x250/images/ Frame 10DB 3 KB
3 KB 177ms
177ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/images/cta.png

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c9aa038885866972c923e9db4b9fe76f5cb08aa78dab3c5b7a57a0ff444761b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 13:50:39 GMT
x-content-type-options: nosniff
age: 56470
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2907
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:47:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 13:50:39 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame E942 0
26 B 184ms
183ms Ping
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv0ZsxgM0QfCviPogl0JjYmf6cc0gh-YrulJ8u3opoB-B5-EMKsobkTKzkilRnEzFt4isIxaAy-ZZ_lkgrPBd1gfcwPXjpHrZwVDFIdoVZHf0GK32smero6J7zfUSnvVfQvilNAzV8IKYNP7RgBJR2nZv76sWl1Giw84myR6VhxNr7oIcNUc23GAD20A3vjxbkkOrtMSv_FrCLx8LlfnctMcnj6WBa51Yns6gD6QE7-fSUy0eexNYVE8iIqwQVlif130qmg-BBVE3RWu-ftzMRynp7CzRHVA7dIqiprVX6XtgGMA1mYVQUocv-O8YuMlkMD8EZeSTuQIMjz3MkmgJA1JnKfbDDbEHdzBSqaHPKOh-W2iqPz7vkm7dO7ft9in_D6NyvBnz0WLD4oDwrkrf4rr3bCtgvnqOJtbtK2yd6cUoJ1ctoozbAMoEK4QxlVwFAjZxkLjHFzb0Zomg-Jpi62OCmBCB3IiQIh4RbLZL1VuW0IzYbjLADABqDDirXzY7u5msqEHj6HvEOL2glABrg4QITwuuOqzQr97NJ4_a5KtxB-Uc3ZALo9YMcJK_MdGFvmzUquTy6yd5uVsEz0Wqthl5VUBlgavgkihEAPGg-I8QwiZaHoL1rw_QM4PPg6swAbzu3dZO33BjJq5ZiVDkiHRHReypMiQZ8kCT1XeLGayKfrQbcl1CoaWTlaTWXY4pAir2bjcksSPgqoH4ddGsW_2A6liOLUtvAIAbjwmy3TvZMWw1Ixh6G5TLdAQx88T6BZn00fUS0pHY60_MP5icgx-G8NsLKgiZk-LDMw-xUfEtEBO6Mk_0gZb72o4AE7vtwvFaFquJyt0QgvDzsZWBVHgYG2wyzzv3Ci8r3MKMWhmxm26JkFchLR6vr01u5qJXp1N7aODV4eSIuv_qIeNKeDHnpW8c02BzyVmddLI8gUi9rpzFLj6GYxB6x2GZGXot6wRRB1xa3uHlB08ytj7XpOw3qOIMMMOq2Z7cnDf37YMxeUaJwHpbGTNdmFGCs5SWNMBb_GD78yWd2XN6Tw3aN3hkqTZBGl29qFu8A3SXrk1l94LTRpBSDpsSsyzjmEHNs_n1Too89JYbyre4M8yetUJTiJuxgflNpSp3-bMqG1Kpt8tpFptAfwBMUFsvAkzF7bMzOhadE9LVaqraihxjdGPKe0hbDdpWAvCK-G7Dn5WjjmaP9A_l7Wg3Z94W5-9wJm2mtZCix7qpIdop2aRPau3KKnRRyausiCNx6N6JER8aTHGD31WUJVOdqbRCs9G_3eLQ09AOptsdWrn1KtCUVlsh95DIFpJwcZZr6sh9tTxrSuUL0&sai=AMfl-YRJi7zGpZ5Jgv__1g0PBFnLsKAOBkQL_dC3U4VmgfX4JLNvtUh2B1RKIwQs5Wv5YRrPqp65awtK5dHbnFUMy7pyEn3jtQF7k5MHGCnQq416Rjuhk8vw12ymBHVvcJMf5D05fCNb5S6Cwdn0mpIH0m1y_cSpqODr3S4FQJH8rZVU9HglzSYpNSa0Mn7vMljLwbwxnJVCPLgVly1uM-wFe9Cr&sig=Cg0ArKJSzCShQ_kOfctGEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1998&vt=11&dtpt=1161&dett=3&cstd=835&cisv=r20220907.79321&vwbs=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 04A2 43 B
215 B 290ms
289ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1133689&asId=2554d9b5-3795-e4d7-d4de-80446e76c5b9&tv=%7Bc:nYx2uV,pingTime:-10,time:2047,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8V2luMzJ8fEdlY2tvfHwyMDAzMDEwN3x8MHx8TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzg5LjAuNDM4OS43MiBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1662960709724%7C%7C26e036bb728a8b0cc3d3c35e4684b558%7C%7Cf34e96995ddf3ff5eb1bfde138cfe29c%7C%7C587b7d4cc6586893e1357a4d73eac653%7C%7Cca608db009a6a9eb3c676763fedbc365%7C%7Cb6faa6d969df7f6a256aaac9961407d1%7C%7C1910643425aadf9208060b7d6625ce7e%7C%7C8fe07e8a25cc7fb91b72bf1540cf249c%7C%7C1629390669,im:%7Bpci:%7Btdr:1570%7D%7D%7D
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
x-server-name: dt07.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 ieVi2ZhZI2eCN5jzbjEETS9weq8-33mZGCQYbw.woff2
fonts.gstatic.com/s/robotocondensed/v25/ Frame BA0E 15 KB
15 KB 181ms
181ms Font
font/woff2 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotocondensed/v25/ieVi2ZhZI2eCN5jzbjEETS9weq8-33mZGCQYbw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto+Condensed:300

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

747d5a0865fe76129cc17fe70097fd5b1db733ed3bbfa0210a8505d80c14ab5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 09 Sep 2022 08:06:26 GMT
x-content-type-options: nosniff
age: 249923
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15528
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 18:53:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Sep 2023 08:06:26 GMT

GET
H3 200 0c8367baecb3d721ad3758ae9f9d0408.png
s0.2mdn.net/sadbundle/2987880808898358456/media/ Frame 3695 480 B
515 B 179ms
179ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2987880808898358456/media/0c8367baecb3d721ad3758ae9f9d0408.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33ef89958231c1d9c57b8707fd8e393367c7100b261767ebb9229b3540e630d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 07:00:44 GMT
x-content-type-options: nosniff
age: 167465
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 480
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:44 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Sep 2023 07:00:44 GMT

GET
H3 200 403a34b838ec0b76591357930d76a8be.png
s0.2mdn.net/sadbundle/2987880808898358456/media/ Frame 3695 1 KB
1 KB 177ms
177ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2987880808898358456/media/403a34b838ec0b76591357930d76a8be.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bf8cbbe743efbdba940e50f0e29b8bdcfd134ab8df75852c720a5cee81cd3087

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 07:00:44 GMT
x-content-type-options: nosniff
age: 167465
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1254
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:44 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Sep 2023 07:00:44 GMT

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/ Frame 807F 3 KB
3 KB 179ms
178ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/cta.png

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd2ab4403ff0658dca80aca0b3ec5bec1afa64362e3bdb90c3d5013ef388ba21

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:53:21 GMT
x-content-type-options: nosniff
age: 67108
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2881
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 10:53:21 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 302A 0
26 B 185ms
184ms Ping
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvWlJdE9q1HzrppBAIVaXKF7DRJW79lmEgf2wIUBwoIbq_1GL_geOtbyG8EFEFSOf0b8VYJGzaCy7JmP8ecr1vkd7A4G97nnngtztdxOdKZIL-2dwh5zVlBZ2myLpmtgmghQ972rSq552-ysLYmM5kMgQq-6QiJTAnuyPGP68B72fKUQvfY57dj1yRL5BkzmKdCGi1qB7ZWDITXiCNLkN2jr8a-hNsO0qBCFgwtwuufltD3W2rPhXxKmky6sAnC2CKvww5vpttHmJ7IuBdbw7mFEGhd94h0tq0_9GTvtIQHN6yqj2XqFJQNqyUc7LLlzhimtPlpwCfhlGTOIVdKMf5AbPDDZGr-Ec5JKoTcC4-OsXP-Yj3HZKgmsSY2S2bPSQPdSpfQY_CYiLkx982EyYgVwb8G5AZEt5admE5prA7878mrd5vmBd-pKRupyi_HXCuuWDV2XBXCG_QV2vzZoRvRJyp_e9Gl41lBbVLzEQOhE4XCHBWd5iZ0pT6acRQuNEf5b2IX1MFKCdNMgxUvzv0TSBOcHY5EUeucB3pNktCedgRymX4nT--gRprJigrYExQqMEs-V0VGa1jU2_45F5prwYZOSc1PXEeup7Y9LDMW2VLf4gTAJgXVifTc5jk4UhfjOOB2KWFMqXqwDhnSc5dSqUyKojHLgG96Plsqgx4QHOU9fye0Yv4nIEoBS7EPrOdKVOE06FNVRmYf6Ss3FyWDk2WWr-Ef21z215jEJOOtbzWnkM1esyP3ePCRuMltpr3Gt1VnuGKPMj0dcJDIXAKsfBzUb_62u6uHG9MP0qADRoe9N_P-cxsEgZ9DiCZb6sAGeCHq232DjngExwzsUsLwF4cLt-2bwi3-DVx5vHz_-1c9HRMTLNlCeXXuHJDKhgMx25AyfD_8XO1tw88L178fTwf8BwwE6OWWCj-YyldK2HvhA6oZ23X5zJ8FL_xd_SAA_RXo4kcYQDsK1pAs2qScSQGsTwXsiXhJSsan-0EH4zhUHpzv2ox9LtvA0LBl13uyqG6ap1dzubu9ogJUkULIdCnc2a-pqoJajkavGp3yKo6cEGif48cIp-Yyw--g-WnMgH0lFU8lvaEtI3LbwtululLKLxQQqeImSvsR60S9MNzRwPWBO1zB767mX3gkYwhXlZApEKT5YuaOmrktXvCApGTWWi0z_wrViWEiyVI4C5oNq6-nsrYKxLchCsECtm-7Wvk3P_QSgqdyJZpTNx-QZgsqMG7Y42AwzdpZcJMdf4lYFhh1RkCij_B10rqfnUI0oeD_0ansrNOH-CRi10ZOixBHaQzRUmkipxtgTi85hKY12Jo&sai=AMfl-YShy4OhPEVxFHvasLJ7c7E-D_QOmjsBVwtKeb8QTWBUeRlHMFw7mb9UI1VmbJamRufhatQhOrH_8XthhRO9qw8ES5IiAJ2DCOVn2kK-FjGVb79rX6joAWemG9z5HYjXKKDA-IxFBBuaFsT2u2c9dipz5eo6BV9KVVKOfrF0UDHILhGhm33exEosyBiOp1HamXivq8AylewY_FChSgCOmLBp&sig=Cg0ArKJSzJf4blGgrxZkEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1762&vt=11&dtpt=1128&dett=3&cstd=633&cisv=r20220907.01291&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 3C6E 7 KB
6 KB 182ms
182ms XHR
application/json 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

96c4505a63a51ba3c78db2939611ba114a606062c5aa654f1de5624c4e99e9fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5624
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BE9F 0
20 B 183ms
183ms Image
image/gif 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B4jNPQ8QeY__7CNOkmgeswJq4BwAAAAA4AeAEAg&bg=!k5ClkNTNAAZTikH4c4o7ACkAdvg8WgtgRaZgP1pocrKhgL3NLWsDIpQ_rlXUSoTuonNm6xmwIuhq9QIAAAJnUgAAAAJoAQcKAKfzoCqw_TPNUOdb0qTjRrixF1PwQ8olfVCjHLiotGJxn0ZWbgVTSTA2PHfaoFbqBjAqny7x8GIAkA27HXb4caZwSu5t7t9F6oofpmRgfFpDtmZqtOIB2pIAEKRzjy4rw0wKTRQxNI6duTTRkH5Tn2V3ea-wKjUZE5a1nWDDB5-tBNNBgPP8tFoVIX-wiYrwEdcJDfPt8ISuBgjuafR8cZp4zWBKr7JCzpkC8uAaupb3v_NrHJ62sh0bAd0Hl2cYAZsrc1BCVD6afTRAsrQunB5yjYVa2pfM8j3s4N0V3MkttPA38mXOh1A-psQsl6X6t2fNKQ2fg5lQ7SHyvMSP7fpM0rsy7Fx8VyCkHRau9B1_qwh6vm6qPAI7AXEUYxYAKCAfwPvXpCDzAHXyuRpw4Bj9PllL7PIDPPyc7qUW7UEt9Qv1l6gpZu_hNxPhlig8dSsga1BaJ3FEYxPI7-PNpwaQ6gR6vTBQn5vI5RSQ6I_pot2cuhj04Q4XR_n7QzjVnHoxGoIUMS2f3g1lOoWBKUO-2kNiwSwvGBR_GlCk3e9I5FDWGOUV1p4sW8jZ4L7JQ-6AdU9RPbmUyIeQ91pD-LRZyzXig3ZJMuNzkljL8MBv68XUJ--Yk4arx_2WMJsO2gNoFFuXo8toj_ZFKmAmWuiO6qZb6g0q0-i4osFmw8DdzYrBoXrB-sIBmICWoqytYOiiMbgA9jFTcouIS2QLkC6FnvSdNhN7nnFImUc90YxgfW6sb_LG5qHqFbQssglPc9VQUZB-OD0UKhjMopWXJVt-J-x2COgR9xQYEl4a6Z4v8DmdDCLAD2CFXT6jk8ob3D6MQ-JFpVcXRm8TydQ9KEgirs7VabhFy0vlqA-togoi-1O1d2_MTqHznPRKk5XNdRdVjz5cxB2_z68D9sR1GXouBjgLzp69FS5chiPy8rZBSl5N-fayZbt9oUq6jpSsXL4978_FF6VYS8WOh49RSbfSG6lVOAAPH40mehDxFPhveRMTEkKvo-19DLrWvbPj6NeXyI_CCSln-HJDj7BcJznicYgWO3lmuoa5JbPQDgC9RdalhUitAFOJk-QnG8-976QkXk8Nx_39xYK7J8cEl8s1Bub3nusnwKrRfg5k4hAeTHlX9qvuYN8NCrfz1H9Lz45ADIdtdNCO4hHSN0oTfWPF2yJBuXFx1CpYn229LnBQFw4NFiikk_wbdRCX6vb1QR_bBIjtDGw93oobPR8

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/ Frame 41C8 3 KB
3 KB 177ms
177ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c9aa038885866972c923e9db4b9fe76f5cb08aa78dab3c5b7a57a0ff444761b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:39:16 GMT
x-content-type-options: nosniff
age: 21153
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2907
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:39:16 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 73F0 0
26 B 184ms
184ms Ping
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssLjuuNZ5kCPLu1AsGntu_j7-KyidR1NEoEzm5kpARf6FBjBunDWPxDTwZPgmTj8NM2UrWLP9vAz2bLXNzBvxmlwn7nPAMhyW8CfhfAWvqm9utlPLuXjEhmTcXRa2cX3dL9Ukr8NRvLXZUO-maNONwKTHVAa6pUu5JApBFtdu9wwGUJsezZnowCCFuYgTILzTWfR6GR0FL1Xran8Ym_UxRcgdCV14wBWgi3c6kMLRHbN1brhTlnkiRjUxs9QJ0oSgyiV65rzfJ5ClMT-BkXD8Zi9MXKY_ABI93nUA3ijmvoGU3QdoMQOkFno16ny0i_-BXgmjHb7_seEIb-nXe1dSFpINFJiGTtDSlNX0rIedm695MFJmx1nM-zR8JYPSvhnvzyPKZRhlMzVz3haArHsXrpI_Sh0GGrfV7Qgr7l-a2okXpCw8p9lk8e8uSGcC9UX-Z6IwKisoXatnkftAAnckllfLx_nvgJAkT_X33e4fbqDPeNhEMEkevNO7_ZHaIEitNvE6Coo0-xilrDMWD451xZhQFJmswWY_KTEzjS519lmeT7CrlR436u8uCOW4ZFVQ7dtR5Ujfs_B03sv5l-Uyhc9fe46lqUzI4xws4MP_fSt27QTxzACaCkKgMWgw8mcFI9fMzLBrgDm8SsWjvfaFW21btuq0g_gk5SIVZ6goTUJJG0E8u2YEYauV7WiAp2C7waTjrly7aZfhP-yHHcmg6J3QZBDKSv_8SyObno9jINklGU3WzZf5qVgNcKDWZY-zRBlYz8o3gb1T7gMxBfJluQ3VwJ7fJcDSP1NS_LO2ubCgShGAg20b9crgslfgUTsv5GiJlMJT92s_gh-Zw7Bl8ZN52dF65dYj1QlsKKKPAOhO4KwLJ8u8dgZsYVdYnJW-TXBNUeZy-3P6LdSQg0M1iAATSf8IwCAP9qiuubuSa8ejH7O6sk1ZMLT8sT1AlC9MDudAC5QJFbinyPJ3M2qyS__N-ffdJ6Amd2TKZbd-pLlG3d7UTEGhLXhuLk6QMdTW879fmQ4yWQQZng5FTcMSVkJfJk3DPVT848yywMmJqfney0npOXM660FcvGqNaU3Rr7vwRpWA8RHUw_KXwpGB2vepOvmdsjhpd2f0p2OifmQC3wPQArBmtaYaNkxd5umf4wjrG65p-e9HRxjerqh6NbxhIlu2CpBLW_jzc44XrB0NScmK91CPrHzIO6kB7b9y37ua2uTzZy_sy0BmbtuwgwSSQKryU1UmGq5QA_AujXKqwKiz376yQPCnsPy9rh2wyuphsUsrbRYTPNCLsT1qZOkwstwuMJVqCuGwdE&sai=AMfl-YQ14f3hbw6Hg3oZe_TvWXgLe9FwSv8CoAufHia5pNb5OPAEBbAuKHhdxe4NGFzK4ffU2Hncmi56Yy3ZnCzMZnJTJF4B__N69Yhb_dIIMWJ56iSd2ERxig4olCszas37Ndj5FwEyuyEaQI5HV-TJIVl98fe5wCn7S_XkAGxxcyM_WDyi3P3T5E6YfVATkoRZ9gb5SWEE4-3rwtldhas5fg&sig=Cg0ArKJSzMXUw1wKotLbEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1765&vt=11&dtpt=1123&dett=3&cstd=641&cisv=r20220907.56808&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6973 0
20 B 183ms
183ms Image
image/gif 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BH915Q8QeY9v1CITT4t4PmNS4wAEAAAAAOAHgBAI&bg=!CAulC0_NAAZTikH4c4o7ACkAdvg8WsnlUTpp58e37SFtE_63HCFHMa8HoHQbBh0E25RsUFuLI6xcOAIAAAJWUgAAAAJoAQeZAvc6_JO-2gIkggaSdw9zQj-rLekgGybz8h2-ovSaxj1mAgG1XnXA_h4ax55ZpcMhHrIbhWLfd0kjXYaVMBdnqlquU7H4wHCF9ZVcim9Lb2XFuQLGb0G4IvU9F5qRFWOVsqD7hyCKSgO6cVGDCDj9AN9ShcAx0etWqx5rv8MPAGd1vg4YTdBXe84AsjW-88N1Orp_5bCyxsrk2WkcxoBdmWhhN_CELAiE9VRwdJ5bjf7b2bK6c4JBzCR1gHeLqwwqUzHooTTGb3DEOgSsVPajIpHJVHhLZc55ndxOygXYUt2b7qh9Nw4exJnkcjM5xzQlcJDDsyL_RdMVzY-FXTzewsKyocgrGf_w1IKMfGWehYtA6tVF479ouQYzHV_o2HCxV9zR71gteq86Xb381iJjVd19TyJCffruiyct0XQG2mDhtdUfcquhFBfy7Y_6BW1F03ZPE0FiN_vuZ9kQrJEzaf6_DL52lccFx2PtYtVWKARmQxxkxEMf-AOI-qel44UgKW4-36PI68OTpD1g0LqY8gXQ0Ul-FE70c1PX2ZvS6XK9Uo9Mw9Vt5WpiwAo0IvYO92RUszA7y7Fz3zfbM6Qp_cfbHWyngzIhR2CKxDwYY8FtCEHYHZw-GXlUFtr6IiUuCkPA-dc7JfpRK-OBnpqpr9z-hWObafymQVAuuynOgff76vFvcUeU5LrnV31zW1BfGXdduwbhVP8scEniesEEuEQOMh57-fjYkNUsG3D-WJyWrYY6Cb6q3SEIk62Q2V9OXfNS5bnqUa60qsWhdQ0uT9mQmCTdSHmvvF-_RVESWnYvqujmpLB992ISKhKwwX7U34br4AaZdMHyXamiWBiSIxahFz_mvHyag2TgtOw9UycaFFIdh7rUX7V-dK0gwn-nR99gIFlsS2Iv8cz0jdETcMvjySDBQyuxJ1uQSYMrwgcKWRhzmC__Yubrq8NtUncGDJAAo3hEbpMYZ4FJR86q2zjtq38FL9XAhu3Im0swAEXJAWHZJW3rZ5E

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc35d9c4db8d8f30c2fdeb93c4180122.png
s0.2mdn.net/sadbundle/7704509421823420664/media/ Frame 99E8 49 KB
49 KB 180ms
179ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7704509421823420664/media/dc35d9c4db8d8f30c2fdeb93c4180122.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7704509421823420664/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dc05f3e1df406dd8f872ebb06545bdb16bd0ef613bc3d63b9d8c651d1e97cada

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7704509421823420664/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Sep 2022 12:09:53 GMT
x-content-type-options: nosniff
age: 408116
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49715
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:54 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 07 Sep 2023 12:09:53 GMT

GET
H3 200 9a7b2ae67432127c94292ea1df521951.png
s0.2mdn.net/sadbundle/7704509421823420664/media/ Frame 99E8 4 KB
4 KB 188ms
187ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7704509421823420664/media/9a7b2ae67432127c94292ea1df521951.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7704509421823420664/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

beabf5dd4f0317b2a0094aba6e79aee9b057894b13664941509f9f10cff127a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7704509421823420664/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 12:25:58 GMT
x-content-type-options: nosniff
age: 147951
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4220
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:54 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Sep 2023 12:25:58 GMT

GET
H3 200 TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2
fonts.gstatic.com/s/oswald/v49/ Frame 3C6E 17 KB
18 KB 181ms
181ms Font
font/woff2 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/oswald/v49/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto+Condensed:regular|Francois+One:regular|Oswald:600,regular,500

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d8543b5dcaea1fc4a0301dc12b5b2adc9079e0794dd6a45879588fb844f3438e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 05:47:16 GMT
x-content-type-options: nosniff
age: 517473
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17908
x-xss-protection: 0
last-modified: Mon, 18 Jul 2022 19:23:34 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Sep 2023 05:47:16 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 04A2 42 B
64 B 182ms
182ms Fetch
image/gif 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst2_0lf3VDFiwHH8OYcQ8Ux230ayj7PM8ritFWJQjMCtP1pPvuqhLs-siBfAARohVu4q7GpF4qWOvQzp8JJMEqBNfQZfhAhP2hwMZ912f1qwbkk_v7r-v1QzUpkAL2VhurWXAXV&sai=AMfl-YTpzXS3Ivft9J1TWfTrCIOvVDe9FAt32Bv4VETX4wTxwfqb94nTegbED_VdaVeTbhfsudyBf3rjTduccvXVGsdjWOPCwf-W96jWR5uGIDgpJEFFqDaJAf_cr0qQybyP&sig=Cg0ArKJSzMk579Qr2XokEAE&cid=CAASKORo8uV5P427KDgXkjANLdKgFJoApK7MXUsJV4R339Ch57OTRt2TeHc&id=lidar2&mcvt=1055&p=439,237,689,537&mtos=1055,1055,1055,1055,1055&tos=1055,0,0,0,0&v=20220907&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3524300456&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1662960706005&rpt=2767&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8B83 0
20 B 183ms
183ms Image
image/gif 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Byiq1Q8QeY66sHuPPz7sPuJ6FiAwAAAAAOAHgBAI&bg=!HR6lHlrNAAZTikH4c4o7ACkAdvg8Wl4dIQl00f00ReT3kdeZ11-xX6xoilSoV5zP5DWYxfboqF5m8AIAAAKUUgAAAANoAQeZAwGYqF_WVkabvBH91bc_DvJuzugAVRPUEVHGzCUZ5Siw4BEfYMxd8Hou4P3F2GU5U8lAKPsvoYcSXOBpT5FsAruMgnSJAQlE-LeIFAJY2jtQ-omf56yQ-uZdUFES5UqqXichCoqPiUIu9DQkdy10QntYzfkDox8SIzW9jtfTip3Db2ZWj17ymLMPkOg5nWYT-Zja_ZZ4jHr5vKXZ54LQui31jDeM9Wso19Cc6ysZzlgd-nYFayQg20_1nCZmPH8o0_XVtnOzPbNBe-kEqPfI3GV1ou23SCMReWHtlNngdV7vSBt04CQ6Dopou7IQ2sO-ad0eoE7gw8ALOG8WwfIyHUz0ZfNoZBs4MSY8t0dEhUjT2BPafqzKF9fjJTnRIOA-BAqKzJ2pqL63E1hzA1nofYgVTFyru4O6bqUOffzelrq6YM2ujtDCK2v4myTYxss91EDQ0z_omoEHs-CZIXw93OBg6UzlNAyYBPObZ46NGtQK2QUGBU4PCWk4-xr-LP-SQbStmCUsR6v7cf1RrRiIVt2UiNTIRUCXlTsN3zRH-tJ06KIQey_-fiPsL0uZXIQG_jw27PBvjc1DscsO7XyWgDqxWyxR8h8oWlv0it2qmawIhOkVab001HgK9_72ISfITacKIn3iataGwyQEbz2HtOuWgirJdPEh00q0ZYz_FMar2XAe7FO4g1mvVdhZJhhCi1-dg97a5zPFj6cl1Zsj6Rqd13ireN3dGRsWBIMKTNZVDgDN3QcAtRrLhr0K9F7YNPt6nLnWh0gIrYTW5C0CJJSQG2EplJrsWMNOVGrltkHVmZ4zCpYCjQX4pcKGaq3NSw5lcqe_nXHhDVE0sWTarwsx9Evs9N1rFHKKNviAEsjtkAjm5wQairt8uctsIxdaj0-Equjisg5AqoXlnrKiW6EfFVdP5NplP5CWjUEHUNLJxMgYicAMnCFMwRQRRBTnIxZbJNf4CLs8wGsdRNFFL9DHFubxr_BogHqzUvhDSeYfbJblBcczWjMKCgA-T_ONzWdV

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame BA0E 7 KB
5 KB 186ms
185ms XHR
application/json 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_245&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

50c3cc2c15d3c8f6bdb09ddb84e7b6cf4a436b2c277a29772f8f95e7dd477f65

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5491
x-xss-protection: 0

GET
H3 200 kv.jpg
s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/ Frame D802 26 KB
26 KB 178ms
178ms Image
image/jpeg 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/kv.jpg

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b9bddeb595583540c8b614a96636caf77d6433791e34e4b7f80be1d747049535

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:39:17 GMT
x-content-type-options: nosniff
age: 21152
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26981
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:39:17 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 73F0 43 B
215 B 291ms
290ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=e7bb50e7-2c26-f33c-60dd-a6e4e3070ad3&tv=%7Bc:nYx2xA,pingTime:-10,time:1545,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8V2luMzJ8fEdlY2tvfHwyMDAzMDEwN3x8MHx8TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzg5LjAuNDM4OS43MiBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1662960709724%7C%7C26e036bb728a8b0cc3d3c35e4684b558%7C%7Cf34e96995ddf3ff5eb1bfde138cfe29c%7C%7C587b7d4cc6586893e1357a4d73eac653%7C%7Cca608db009a6a9eb3c676763fedbc365%7C%7Cb6faa6d969df7f6a256aaac9961407d1%7C%7C1910643425aadf9208060b7d6625ce7e%7C%7C8fe07e8a25cc7fb91b72bf1540cf249c%7C%7C1629390669,sca:%7Bspg:2554d9b5-3795-e4d7-d4de-80446e76c5b9%7D%7D
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:50 GMT
x-server-name: dt04.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 kv.jpg
s0.2mdn.net/sadbundle/13099338561793074780/300x250/images/ Frame 10DB 32 KB
32 KB 178ms
177ms Image
image/jpeg 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/images/kv.jpg

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fc9667c5f027c6177402417352d668cdaf43418b146f5e22604c6eb26f5adba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 13:50:39 GMT
x-content-type-options: nosniff
age: 56470
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32929
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:47:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 13:50:39 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0DD0 43 B
215 B 290ms
290ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=448f140b-7a05-9ebc-3cc9-516fb1a4642d&tv=%7Bc:nYx2xK,time:1986,type:e,im:%7Bimprf:%7Bttecl:1968,ecd:1169,tsecr:185%7D,pci:%7Btdr:1685%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:1986,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1979~0%5D,as:%5B1084~0.0,895~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:1113,fm:thc9EK2+11%7C12%7C13*.1102537-64448508%7C131%7C141%7C151%7C16.1133689-65389534%7C161%7C162%7C163%7C171%7C18%7C19.1102537-64448505%7C191%7C1a.1102537-64448504%7C1a1%7C1b%7C1c%7C1d.1102537-64448508%7C1d1,idMap:13*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf%7D&br=c
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:50 GMT
x-server-name: dt08.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 05E5 0
20 B 183ms
183ms Image
image/gif 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BZ0m4Q8QeY8DuId7cz7sPiIe7yAEAAAAAOAHgBAI&bg=!4uGl4aXNAAZTikH4c4o7ACkAdvg8Wv8aWUVPCWRPqBx21RSWGrmChoPrIKr5y5f7bjwrV4P8gkCKkgIAAAKEUgAAAAJoAQcKAH70_mxmIPDAxPZe6pyL3G-_Bb4-bm9RKDXN-bxZCS766AhepkmT1W0wJNHzYPOhwYgu6hN0LRj3CKepPZVG3N34vJTAUV5IQvzWvIFwTMbYZ18Jr1qtsG54DtgyIG3cM0wWpKnpnfCSX7Fzp7NhlzOHqXV5503D9Po0sZPyq96ZAvhEt_eMvPqYzRS4_15E2QI5DcTXyBkJdQ66-23-cncgTebIUEJ1vPY9P_tloKEttTM6KxuAJZDWKFc7FmKWBedjpYk1J_Dpdg1QFq55O62No5Juhf5n8s0X3FqeH3rK7eikkuzxZm3kjQ2Na-w0Oy97joLp7CFcYxT5JkA8kMeRzqllxKxwRaO2tUGUeMOIbVIP263ApMf1sSX8GE44OpvXvBIns4jvDUONOXCbhfK7HNqnHIdh0kTjTczRGT5T3SCOjyfdOGefrNuRFzrwkB9hCo5-5Vo2brylN_KH2CfrifZ0pBX1rgBgyYLtxwSb0gwOVJBLmIAxUVdSE_xu-d6JHf_ZboKE5SBrmOjKhuAC_XhHvfFnPPYjJOTeSGQG-qfD1luiwF1YGny6dIAo1-2tqI6vq20I2EVf0je_ZNWxh2TNJghWUxZC6D9eADBF3wuBsY2hKr8OfmWpOeZpyoU5y02DY3bSBw9FK9DbkvIQtrPkKdRcCLTwlI5-_tDg9xz9WTWqx3W60j-iY4nqDUoh4mV7eYES7900PlXV6OO2zUFl0FzqHBAGjXO8r_Mnq3o9AfLG8BAI6ND-mkMHSRP42S-WKxNQ69dD--DesbzUTZn0Eb5rkrKgHPY0_MBJtdgcEIJf5KqhAwr1bcg8adH72mvPqnm6HaEdrgE1qwS5EqNSU1U7ceJzo2m09axjLpfxmtxRku50Vfgh2gu92he-nR4urlKKgvJozwCuYVoEh8oEPBeK_qU8Ac5apa8O2VWa9olm1rcg_sG-hM3RPPSL0m_TcE2DX-ggMzUX537CkuPe7Hu8GeAsMDcIEVy6pO20actuilZZEbDy3LauBbhSA6rQczJRV6QpoiSPTaRgBZFfdbpKSw1aM2aF9Hf-Zu1yk0sQwZwpXzfzZ31ORuDrvcGpa3QygySTmVi7eOo_yLwnmi0-h_TQLUDvXnj9awku9WHg6okkPtTF4tICb-AgdPOLE3kHmk-081m6hJ_LYrso2iBdRDMe

Requested by

Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8985 0
20 B 185ms
185ms Image
image/gif 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B2vl6Q8QeY7WHIeey3LUPre2kwAoAAAAAOAHgBAI&bg=!OjmlOX3NAAZTikH4c4o7ACkAdvg8WlkHwf6_kOFTgtjbonlGqM6U67_dhURKaqJr5FCRDdVMvx7_UAIAAALBUgAAAAJoAQeZAwMSp6onpk0VFo9_sePu7Wr0fPDBRjdLdmxOfk7Wf8u5JP2PEItH1y1miB1E8jsAnl1RCwzwDFB4VQAmFLhlLURzDigXEcMgXD6VdJ_M9Z0w1jnXtmHmvvusPTJQcxHHYDsXZ0hAvOZATU9hgdTu1JY9PrIch2IuJdfZdNhkQUo4ywtScoMAXntluIKUsbxZVePhhU6mURnqjMJ4dHEDRBbA7RLjsVw8LUObx-ebhzh-n0uBNgs0YFmmAj9MSfLLTSLNI6Kn24W0_t8gr4IUZxskyZMDMU0aVMLNb568yaD-um-SkwNG2HCZdv00K5SotSrQIvErFAsoc5NgQeYWWUGg3o9a4daMfRopzgMGFfwLDtwBiewGndHGrizx1upbeS5vSOrS_hUKbA_I2fUdtyK4Gysz1ShYOLEA5z9U1BRJluv9qRiKKl9ouNWsO_mWkauD5zpDlLFfNnl6WMUuh5SdYanvlKl0VkAQUjxSW0WwnHxAgtkrsCc1320DJ1Vq9c2rO7Gm5RlV3bFNjNicARIeeEb7NybfawA8Jl1CXM_b_jGEeUBjlCSTnGo9bq2t8lwz2aewNwoeENBHHMFMqxDpnk83pnazhqVyfg9e_i0dd3SjiQwM-3hR_jQCf5-zuObGCdNfbk4cMhUVdGgWbisDoOLDd92g2a1A9IJzWfxYk1_Iise9Yr7zyFrt_hY6vKPzyab3BfF78PDPe7mw6mtX4lJwp--7Nu8r3IMdu9ITnziv0mI8IIdDXx0zRcO472eisQEyMkp8tLewLvhpmybCXtIFVedEeP6x6QBxNXF3P1KVNs3-fqHO8P8JGrDgfTmpMq0T3x8ht3IHfhjPSFo5wOqhCYjN6gdOwQ-C56J6GzjpOdTK_y0qGKV7pMtEc55I-J80pVhNNVAu9eIIresmW_kBalhfPTZcLqLLYaTrMKJaESOWIyuuPj8cEbYzjZjhRUACiXGkAgtUU0vY59mOULCw7s38GeA-xE91zo69G45xrXBCH4iSJ-VcnumHqLVCIiQ

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame E942 43 B
215 B 291ms
290ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=a3fdc6bd-681d-a70f-229e-dc8362df05fd&tv=%7Bc:nYx2y8,time:1780,type:e,im:%7Bimprf:%7Bttecl:1625,ecd:941,tsecr:172%7D,pLoad:1527,pci:%7Btdr:1590%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:1780,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:33,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1773~0%5D,as:%5B1138~0.0,634~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:397,fm:thc9EK2+11%7C12%7C13.1102537-64448508%7C131%7C132%7C133%7C134%7C141%7C151%7C152%7C16.1133689-65389534%7C161%7C162%7C163%7C171%7C172%7C18%7C19*.1102537-64448505%7C191%7C192%7C1a.1102537-64448504%7C1a1%7C1b%7C1c%7C1d.1102537-64448508%7C1d1,idMap:19*,rmeas:1,rend:1,renddet:XIFRAME.qs.dr%7D&br=c
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:50 GMT
x-server-name: dt17.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 302A 43 B
215 B 291ms
289ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=ca6d7a58-60c0-4dc7-4382-be8eee886ee1&tv=%7Bc:nYx2yj,time:1641,type:e,im:%7Bimprf:%7Bttecl:1910,ecd:1528,tsecr:56%7D,pci:%7Btdr:1593%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:1641,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:25,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1634~0%5D,as:%5B1170~0.0,464~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:635,fm:thc9EK2+11%7C12%7C13.1102537-64448508%7C131%7C132%7C133%7C134%7C141%7C142%7C151%7C152%7C16.1133689-65389534%7C161%7C162%7C163%7C171%7C172%7C18%7C19.1102537-64448505%7C191%7C192%7C193%7C194%7C1a*.1102537-64448504%7C1a1%7C1a2%7C1b%7C1c%7C1d.1102537-64448508%7C1d1%7C1d2,idMap:1a*,rmeas:1,rend:1,renddet:XIFRAME.qs.dr%7D&br=c
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:50 GMT
x-server-name: dt05.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 73F0 43 B
215 B 294ms
293ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=e7bb50e7-2c26-f33c-60dd-a6e4e3070ad3&tv=%7Bc:nYx2yk,time:1591,type:e,im:%7Bimprf:%7Bttecl:1901,ecd:1481,tsecr:56%7D%7D,es:1,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:1591,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1585~0%5D,as:%5B1126~0.0,459~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:616,fm:thc9EK2+11%7C12%7C13.1102537-64448508%7C131%7C132%7C133%7C134%7C141%7C142%7C151%7C152%7C16.1133689-65389534%7C161%7C162%7C163%7C171%7C172%7C18%7C19.1102537-64448505%7C191%7C192%7C193%7C194%7C1a.1102537-64448504%7C1a1%7C1a2%7C1a3%7C1b%7C1c%7C1d*.1102537-64448508%7C1d1%7C1d2,idMap:1d*,rmeas:1,rend:0,renddet:na%7D&br=c
Requested by: Host: 379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com
URL: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:50 GMT
x-server-name: dt10.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0C94 0
26 B 187ms
186ms Ping
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvCH-Uq_7fbfHDh-FUoVEGVZMj6e_-OImctlbB1yM6UTIH-GZ1Mqeier1QhxRLwbfJwC4gDY9BaEilWUE8P8tGI2kYkB40BCbUvNvkeFT-c5PgkS0JJiEBMndXnrHaYmTWBh3LnhyWyvhCvhsjXA-LKOZNFaO_ER9m172s2nV8uQSvPsdXZcrUTc47R5W4TRbHWqT4IoSMzfsAlGOr1WD-8_0xiEdyHmiv4eZ4f_0UoaV4V590M8jwkRlYqtSi6tAox4H4JSThsHM51aRUc0HtCV9r3PKTpLstL7EXVcEyQBbq7Z3X5v1MSdEVMhZseVh-YeclynkGk54uXMHuTvX7AiRaZpLCsycaQmJpy1N9rZhf7upi7yKN-wzjDvQdockJTcYybCE6eK7at9xMZ0Z1zlom7JKTd2kqfDGOQjJKjD7JiIHxTlIUyLgi1RZiQvegV9J5PDIGHxpurfDm9mgVnolRS2G5HyktBVpH9qKrckyYJkn6x_d_zoZ6RjeQaW_t1gJeBTSxEx_QqpLqfvXoDuxyWsYWNKO3hUOL3NMoYL_rJSQHWJAUWe_UiWWmSByspX-MO3pTkA5rjW49-3AhvVf9KNSFuBandBdVwOwKGLw2uY9UF7Jym1Ao07upFxTfZ5nb0VxO0oHDfdI634faMIW_W-xCznUwzakrS4xyRyIGGrgEgYepM2dsY3s5NqqQX90m_GuU-7H4iFLvexB_ximqpoU_ow8NDit9DX8Uc07JIbn_4S-XnTwLVRh7WalN-fXz0rhsRB0gFZ9ErVOiZIjAT4ztyut8cAh8dAPLPGzfYq9fAB2lPF_GOaSF2OCKB_EPBbmCiZ4lGIVQUmWfH2BruBr_mGmBpRIf-6ooeCgPL_Oeq5PDsSKm4Ma_K6jgF5ldyfw74M40lG_2PGCLHyHD8ZCkdOa4_8-DayIf1J7ywRNmUbg9ISD7ija4OQJ1uvkHiTTRyhB92rqZczBpqA8XqbEn5Ezwd7zDAp9L5MSv4aPAfWdCciU_Bele6tv5NO_Xk6AJI0BVl0v0fkvvorJSzZHAh8r6sQGspsigvYWfWk5kEfsmjg_l-VwVka89hltp8HE9wAta6orO6JvXeUkHHRWCA79OFIHXUlTlXCt3GpnmCaQitU2_5wDoer_yL-PX7GAUKHQ2SV85mcUbJxtoLB3SMkLWH6RzmzPwJms2vSgVLIG0QI3NGXqAJFnuV6uS_vwEhNTHf7m51HOEb_kcakJ8zRl9cdWKf5NrUTxtqAvD-qQDREM-81JHD-t4hVdEEmVS5VriG&sai=AMfl-YT3DHj1W-eDmajrFR8H3nHNX7Ez5zpnVMT4jk7N3M5nLtOrQUveWyO7jHVUAcFDKP5xjGuStoor3s4Dcu87wWRcAv0AvWMCNctQhH8-PSS9WN0DRrqabM6b6QsJ5p1Cy-9urSoIa17Jao1gZqSARHtaytnrnUpGy_zgqc15vfSNOYwuVYkl-mCzKYyAFh4lgDz6xxxsnKEx8JfCh6HuOlDeR_soOf8&sig=Cg0ArKJSzPYSPqBsh7x6EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2341&vt=11&dtpt=1423&dett=3&cstd=916&cisv=r20220907.06497&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 04A2 0
26 B 203ms
202ms Ping
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuBtClZOpUQ7-l9Gtulxw4T5xYRaNuiyZUUgRawKQIORtjaoJPfqk1-kxuSRajGNMB7g_qP5fMioLNFUd_9mPaov35qXcVg5_8PfVVUhW0Lgokr-fs0QRJgH_jEfrpoZSGp6o-lAvQq6d02TXwp6POz&sai=AMfl-YQHm_blwiON2wRrO9xMQNwHMKlgnj8wLAqj0_837WBa7PxeyA1KgrbofF0OlE_FevmfKypJ5YJRFtb40dCfnlPFzhjepOPX9p3CMNB6RvTMIJPcJu5xTGAhRo83z1d3&sig=Cg0ArKJSzB1rjFFG7qqhEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1450&vt=11&dtpt=1026&dett=3&cstd=420&cisv=r20220907.06096&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 kv1.jpg
s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/ Frame 807F 20 KB
20 KB 195ms
195ms Image
image/jpeg 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/kv1.jpg

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c1f21ece426c9b383360e35f0e01b6ffe83eca5cd529b07bf86032a2fdb99d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:53:21 GMT
x-content-type-options: nosniff
age: 67109
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20543
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 10:53:21 GMT

GET
H3 200 kv.jpg
s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/ Frame 41C8 26 KB
26 KB 197ms
196ms Image
image/jpeg 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/kv.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b9bddeb595583540c8b614a96636caf77d6433791e34e4b7f80be1d747049535

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:39:17 GMT
x-content-type-options: nosniff
age: 21153
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26981
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:39:17 GMT

GET
H3 200 31127580_20201112200842599_Communications%20IT%20Intelligence_300x250px.jpg
s0.2mdn.net/ads/richmedia/studio/31127580/ Frame BA0E 153 KB
153 KB 179ms
178ms Image
image/jpeg 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/31127580/31127580_20201112200842599_Communications%20IT%20Intelligence_300x250px.jpg

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a60c536bc3cf452e17655cd63d31b07b6bca1a16a3d5ec80cc2c8d763c02458

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5217957964584845312/index.html?e=69&leftOffset=0&topOffset=0&c=2o7GEcRwl4&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 22:23:39 GMT
x-content-type-options: nosniff
age: 25691
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 156244
x-xss-protection: 0
last-modified: Fri, 13 Nov 2020 04:08:42 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 12 Sep 2022 22:23:39 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame F876 0
26 B 185ms
185ms Ping
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstnmbsgBmg0nef6lBt8eSkYnjmylsWHYNP7zIbNMdBTRyHY4A9AKXs9GLYCISER_CW39lxFqwxhmvrQXouegBy0TuR-0EubO6IE-YMmPUcAsgjIRVT9LS8dhrzwPvm555TzhnUsS6pBmxc7cP04PhsVmqwhy69VWsHo3I6dl9tEj7huZd4g0F0gxI1ILCczUGv0o0h1yOUncELgjyFObVgp_AJtX-a1xTG4ODFup3tksbNr5PghenVxz1hkHiutGVsY0BKA2jDdPhoeZ85b7xCcujwvQ6g3z9BMVeXBrmyzX2OKPLf6S6Y9_JYRuz9VdY0pMOGOVfZY4sx_3kgt7UF2DWaQtDssy6CXC6iDO8UPVdUc9YzEWzKtrWVNf_rqWWTMhTKzFNssyHrrd1A6sCgpuT7GbGDT_ku-2G_d3jYzNStw3iLLl3uKCrI_mYkGjU6CjxiYTshE0pZ6ECL3KYBuefW-pT9Nl2lg7H8TFgh9miOHjlrt_I_nbSsVndO1Nn0x_XajHCqYhlgs6yyYonDQQpoSA_Ydd3LOEaPU_aGLcUZlFz1uhILBUp-_ODlBaTsFPgY1expDK0hmDSFznm4Ci6r-L7g3Dw_MY0Que6NYnQKkyZmm0r8eQa80RTcFc-fubu7gx8ShWx9CWXneMjeCyKxje74jqaMf7khNT5Uqyb0zZVPqy9vng5UYlD1UAGqTK65qz5lgyDp90cG-WDHybTNas1adLZjUkXRKnxDWfSCg9Pci1-oFHQmo4d-dTy-YIY8Nd_xInYGvUg-1laKZ_-7iWD4kEKUdiuK1S35n3Zc8oQx2D2Dxl7QLG1xLdldJqfIpNDaIaxPgnHOmtFXNnZtrWcaNCgZe6BIqltRmFlVQIlfUCb8szkhWw-gYLDv_xw7XD_Tw0qgv0LFA9Zs_xwTsYMtceQNbW7N3osrx32KndDoyuMt08jVCH_-_rPFLNvFHMa391wxpfRODC-BfDYHnWif5JW676GASG1tV2KurT1yv-_miiwpsuYBRVgQR8AK9YaHCPpaZsHyAQd9jWnbTFYE_HVAU5jYQfCr7RIaH4KGok-mjSkkjY6kQJkG1dXHn_0VRq6k9qk35Emk18IuFuhkHJt3zysYdiwfgU43P5RAee88CFzDT76Y5iJWWFPWpOd02b4YyC9iHOzKQ-JLc5F1CpP6ZO-dGtH64Fe02KB1hh0-UrxHl8IVwCGvuh4jP8l9ZJDxZZRX_CvFkwo9ypLhZsU0D--8QvuyngV-hSraLceLT97SlfyIbI69HY0oYavz0TA&sai=AMfl-YS-qiSRWkQp_gUguQKuTAjLICxzxyGgbAwOoZy9zZSvkZJvxk0LAaUVTSTZC1ESRMbNmcpcaJ38dXp6vte2tJx98gCP3PW4Q5jw6qqveB8JEHIlHdLuixcabhyLKjnlrXQwXXeOuIPl2v3g1DS5PdcA-IxlZp4NtyKj8NHKdddURQdkg55pqk39oA8zv5wn4XDPFuHugBEUyR2PqbSIMTk23bQ-i41FNg&sig=Cg0ArKJSzHCsPTdsXNrsEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2556&vt=11&dtpt=1466&dett=3&cstd=1088&cisv=r20220907.94469&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/ Frame D802 3 KB
3 KB 179ms
178ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/logo.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13d8fd874e8861425cfd2211577bb8da51622bd2a22cd90c403e11210b9cd5ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:39:17 GMT
x-content-type-options: nosniff
age: 21153
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3088
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:39:17 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame EE34 0
26 B 186ms
186ms Ping
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssy_BUv47o9VBACg8OfXTayBhAm5hALbK7u-46ESvnTh0uWpHc654YR-a6ZYtbgs0e0i09uLT-qMevxK1iiDRvpXJkeWUp7sjcXP8MEETd89C8TaMAv49XG_q0k84IvGDTSrVY3C-S6h6042oZFzaLtVelagdqhbQ_CYvMh_rcdLYQbcTt7NUS0XR8Pp4FLFoB0webHgRW6V2GgRH0Ugz5UZbeu1-URw5ZagcF734OdE42HcKf8tBWf7y7oBX1ws2p9Iq_Pi_8i7bjuZDOJdzcJ3ZX_qOVou9P6yNSySbSW-78YrkYk6UNU7CkPTK9yl83OYSEBH2b-iqoOZdkqpA9og9BwA5fRV4xaZMrm3oek6nSRs-ezjm3XWCqyr5-oULdfzMesfmzk857r2ugKnq9zZHs68zukw1uu9HehS0VyIEFskhFP4yCU57XILev-wtb4K597wkPgUC1yng0lTsJ-jEizYJd3YhZVjV7Tx7H7PYxJ_QtikRpkosIOhHWJetZjFZX_C2bZRSSubxe0zvmE8QckueLXEfDKFZIKqxIzVWFzXfkhO6vBZeeS6QdgLS6OTneqQOQn27u6xngm1vjSn5JDZg56sHoqjWnDv00Aw41wqVpFYFd5ZKWBGVwGz-1z22e9RYpknPAwYnPr9Fekr-efxEoMD5dXMyDrWz36soJLAjjkBOaIFFR918cfazbx0dsKBY8jHJBCwtHUIJWWGRkrYF0hqQAkVZHpwvhiCopc7zODkFhGeo0qq21pouSDyp9e64z3Zhl2GBIAIvJTlfLK0nSUraK0hvOREEIilWb3E3x69Z4XwmrljD5fb7PDjsX99GAL_R3EteyRnoQ1RhHRVPFbVy5vR0bKeEhfM3Feq7-yuKZ175xOenW4vwEWRRfRHqGyuVuQL2KB00Fq5Z_vIBZe-GIxJwQ0bezpscaMullLfIJgOoLemQSb81A88XwDM9YLIeCk7LgjuLOh38qCWTVmUmnI2U6ltZFmESXSzKciiDGQGp8Ls9H8PTKlpDH7BiG0GsHfyFBlflEmjQeDrZ_LzTRKnKcwx1t3-bNokGbN3xmCPKRedZ1OCHKAnCGRzydt6Si0CrS5tRpfDUDUXzOZbmphpZEjOIEuLKLNw0dSai-NmJ05h1zXp2B5MJh3uimQ-r8C8UTRbmObLSjIm8v9jjsIAWWR0fmHnRO3oi0bDZYTDZ6nIfXFAZknDhj_JDnQ4PPLvuMw3pad5z2oc5GXFdIvRO-SFkziGvSCccbyWWCRwRVwldOzqwQfA6oO2w&sai=AMfl-YS_b6sJ6enX7t__aS9sFzDu3Jz_UVlhwaIrZZApKKOY9ybLTsMYg7n6O39Gacl6uWKgd7t0yBAYO6eRDaGNWPIGk7DuJSzOF4nYJLl-Rbo_RpZo9LhErfbNEmZB8RhbZrZ-zH7LWUNVS3nK538UvGqgW-x9mWkQK-_dFP7c8pPgsKrR6fPmCub5_2xpOlOfg751hUTbNNZw-Jcea0tE8izBfyfVWukno4vY9w&sig=Cg0ArKJSzGc5npt1NWsjEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2471&vt=11&dtpt=1468&dett=3&cstd=995&cisv=r20220907.35193&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 05:31:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/13099338561793074780/300x250/images/ Frame 10DB 3 KB
3 KB 177ms
177ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/images/logo.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13d8fd874e8861425cfd2211577bb8da51622bd2a22cd90c403e11210b9cd5ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 13:50:40 GMT
x-content-type-options: nosniff
age: 56470
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3088
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:47:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 13:50:40 GMT

GET
H3 200 kv2.jpg
s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/ Frame 807F 19 KB
19 KB 180ms
180ms Image
image/jpeg 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/kv2.jpg

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ffe70e8b22d2d74850d1df4255dcfe37fa0bf59c38de2778f401bc21fbd3da81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:32:07 GMT
x-content-type-options: nosniff
age: 21583
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19104
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:32:07 GMT

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/ Frame 41C8 3 KB
3 KB 178ms
178ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/logo.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13d8fd874e8861425cfd2211577bb8da51622bd2a22cd90c403e11210b9cd5ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:39:17 GMT
x-content-type-options: nosniff
age: 21153
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3088
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:39:17 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 3C6E 17 KB
6 KB 322ms
322ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 05:31:50 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame BA0E 17 KB
6 KB 318ms
318ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 05:31:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 05:31:50 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame E942 43 B
215 B 291ms
290ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=a3fdc6bd-681d-a70f-229e-dc8362df05fd&tv=%7Bc:nYx2D5,pingTime:-10,time:2087,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8V2luMzJ8fEdlY2tvfHwyMDAzMDEwN3x8MHx8TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzg5LjAuNDM4OS43MiBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1662960709724%7C%7C26e036bb728a8b0cc3d3c35e4684b558%7C%7Cf34e96995ddf3ff5eb1bfde138cfe29c%7C%7C587b7d4cc6586893e1357a4d73eac653%7C%7Cca608db009a6a9eb3c676763fedbc365%7C%7Cb6faa6d969df7f6a256aaac9961407d1%7C%7C1910643425aadf9208060b7d6625ce7e%7C%7C8fe07e8a25cc7fb91b72bf1540cf249c%7C%7C1629390669,sca:%7Bspg:2554d9b5-3795-e4d7-d4de-80446e76c5b9%7D%7D
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:50 GMT
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 31127580_20201112200842599_Communications%20IT%20Intelligence_300x250px.jpg
s0.2mdn.net/ads/richmedia/studio/31127580/ Frame BA0E 153 KB
153 KB 177ms
177ms Image
image/jpeg 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/31127580/31127580_20201112200842599_Communications%20IT%20Intelligence_300x250px.jpg

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a60c536bc3cf452e17655cd63d31b07b6bca1a16a3d5ec80cc2c8d763c02458

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5217957964584845312/index.html?e=69&leftOffset=0&topOffset=0&c=2o7GEcRwl4&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 22:23:39 GMT
x-content-type-options: nosniff
age: 25691
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 156244
x-xss-protection: 0
last-modified: Fri, 13 Nov 2020 04:08:42 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 12 Sep 2022 22:23:39 GMT

GET
H3 200 arrow_2x.png
s0.2mdn.net/sadbundle/5217957964584845312/ Frame BA0E 1 KB
1 KB 184ms
184ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5217957964584845312/arrow_2x.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f30048af37a864454ad6d882e6ca382904b22e2de2b7ed49514461e75aecf5b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5217957964584845312/index.html?e=69&leftOffset=0&topOffset=0&c=2o7GEcRwl4&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 18:26:50 GMT
x-content-type-options: nosniff
age: 126300
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1148
x-xss-protection: 0
last-modified: Thu, 03 Jun 2021 10:36:05 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Sep 2023 18:26:50 GMT

GET
H3 200 logo2.png
s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/ Frame D802 3 KB
3 KB 181ms
180ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/logo2.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42f8a385dd4c8c80c251f76e55c952317a27af4ead9dd143aca271c9652c1eee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:39:17 GMT
x-content-type-options: nosniff
age: 21153
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2567
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:39:17 GMT

GET
H3 200 logo2.png
s0.2mdn.net/sadbundle/13099338561793074780/300x250/images/ Frame 10DB 3 KB
3 KB 184ms
184ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/images/logo2.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42f8a385dd4c8c80c251f76e55c952317a27af4ead9dd143aca271c9652c1eee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 13:50:40 GMT
x-content-type-options: nosniff
age: 56470
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2567
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:47:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 13:50:40 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 73F0 43 B
215 B 290ms
290ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=e7bb50e7-2c26-f33c-60dd-a6e4e3070ad3&tv=%7Bc:nYx2DI,time:1925,type:e,im:%7Bpci:%7Btdr:1875%7D%7D,es:1,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:1925,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1919~0%5D,as:%5B1126~0.0,793~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:299,fm:thc9EK2+11%7C12%7C13.1102537-64448508%7C131%7C132%7C133%7C134%7C141%7C142%7C151%7C152%7C16.1133689-65389534%7C161%7C162%7C163%7C171%7C172%7C18%7C19.1102537-64448505%7C191%7C192%7C193%7C194%7C1a.1102537-64448504%7C1a1%7C1a2%7C1a3%7C1b%7C1c%7C1d*.1102537-64448508%7C1d1%7C1d2,idMap:1d*,rmeas:1,rend:1,renddet:XIFRAME.qs.dr%7D&br=c
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:50 GMT
x-server-name: dt13.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0DD0 43 B
215 B 290ms
290ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=448f140b-7a05-9ebc-3cc9-516fb1a4642d&tv=%7Bc:nYx2Es,pingTime:-10,time:2402,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8V2luMzJ8fEdlY2tvfHwyMDAzMDEwN3x8MHx8TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzg5LjAuNDM4OS43MiBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1662960709724%7C%7C26e036bb728a8b0cc3d3c35e4684b558%7C%7Cf34e96995ddf3ff5eb1bfde138cfe29c%7C%7C587b7d4cc6586893e1357a4d73eac653%7C%7Cca608db009a6a9eb3c676763fedbc365%7C%7Cb6faa6d969df7f6a256aaac9961407d1%7C%7C1910643425aadf9208060b7d6625ce7e%7C%7C8fe07e8a25cc7fb91b72bf1540cf249c%7C%7C1629390669,sca:%7Bspg:2554d9b5-3795-e4d7-d4de-80446e76c5b9%7D%7D
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:50 GMT
x-server-name: dt15.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 logo2.png
s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/ Frame 41C8 3 KB
3 KB 177ms
177ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/logo2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42f8a385dd4c8c80c251f76e55c952317a27af4ead9dd143aca271c9652c1eee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:39:17 GMT
x-content-type-options: nosniff
age: 21153
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2567
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:39:17 GMT

GET
H3 200 kv2a.jpg
s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/ Frame 807F 18 KB
18 KB 179ms
178ms Image
image/jpeg 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/kv2a.jpg

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

14146568ef5376e873a140da8e29f5999d8330452b45ee1207a7e81f97bd67fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:53:22 GMT
x-content-type-options: nosniff
age: 67108
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18034
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 10:53:22 GMT

GET
H3 200 txt1.png
s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/ Frame D802 2 KB
2 KB 178ms
178ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/txt1.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7675cadf5df50edef9b251b9928f8f7b33392ed6ac9436830583adfaeb0985a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:39:17 GMT
x-content-type-options: nosniff
age: 21153
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2147
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:39:17 GMT

GET
H3 200 txt1.png
s0.2mdn.net/sadbundle/13099338561793074780/300x250/images/ Frame 10DB 2 KB
2 KB 177ms
177ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/images/txt1.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a63990b575ea954ce81610b911ce35c895b8980f852f801ff0fd9d9a231987d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 13:50:40 GMT
x-content-type-options: nosniff
age: 56470
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2238
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:47:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 13:50:40 GMT

GET
H3 200 txt1.png
s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/ Frame 41C8 2 KB
2 KB 178ms
177ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/txt1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7675cadf5df50edef9b251b9928f8f7b33392ed6ac9436830583adfaeb0985a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:39:17 GMT
x-content-type-options: nosniff
age: 21153
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2147
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:39:17 GMT

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/ Frame 807F 3 KB
3 KB 178ms
177ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/logo.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13d8fd874e8861425cfd2211577bb8da51622bd2a22cd90c403e11210b9cd5ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:32:08 GMT
x-content-type-options: nosniff
age: 21582
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3088
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:32:08 GMT

GET
H3 200 JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js Show response
pagead2.googlesyndication.com/bg/ Frame A879 36 KB
16 KB 181ms
180ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2510ed81c525ffb3948c9e103bc6d56f036e45346a0d4c6e481602c223c74ba5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 11:24:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65231
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15893
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 11 Sep 2023 11:24:39 GMT

GET
H3 200 JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js Show response
pagead2.googlesyndication.com/bg/ Frame 299B 36 KB
16 KB 180ms
180ms Script
text/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2510ed81c525ffb3948c9e103bc6d56f036e45346a0d4c6e481602c223c74ba5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 11:24:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65231
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15893
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 11 Sep 2023 11:24:39 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 302A 43 B
215 B 291ms
290ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1102537&asId=ca6d7a58-60c0-4dc7-4382-be8eee886ee1&tv=%7Bc:nYx2IS,pingTime:-10,time:2296,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8V2luMzJ8fEdlY2tvfHwyMDAzMDEwN3x8MHx8TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzg5LjAuNDM4OS43MiBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1662960709724%7C%7C26e036bb728a8b0cc3d3c35e4684b558%7C%7Cf34e96995ddf3ff5eb1bfde138cfe29c%7C%7C587b7d4cc6586893e1357a4d73eac653%7C%7Cca608db009a6a9eb3c676763fedbc365%7C%7Cb6faa6d969df7f6a256aaac9961407d1%7C%7C1910643425aadf9208060b7d6625ce7e%7C%7C8fe07e8a25cc7fb91b72bf1540cf249c%7C%7C1629390669,sca:%7Bspg:2554d9b5-3795-e4d7-d4de-80446e76c5b9%7D%7D
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:50 GMT
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 txt2.png
s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/ Frame D802 3 KB
3 KB 178ms
178ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/txt2.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84097067cfcf04084ccd93551d8692cbd3c2096f41b8b2e058f13e9de3b6e5c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:39:17 GMT
x-content-type-options: nosniff
age: 21153
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2983
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:39:17 GMT

GET
H3 200 txt2.png
s0.2mdn.net/sadbundle/13099338561793074780/300x250/images/ Frame 10DB 3 KB
3 KB 177ms
177ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/images/txt2.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9de7830ba3293de37f049ef1df41fa1534f896617da6d0fcd6aa556fe5780c55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 13:50:40 GMT
x-content-type-options: nosniff
age: 56470
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3146
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:47:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 13:50:40 GMT

GET
H3 200 txt2.png
s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/ Frame 41C8 3 KB
3 KB 177ms
177ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/txt2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84097067cfcf04084ccd93551d8692cbd3c2096f41b8b2e058f13e9de3b6e5c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:39:17 GMT
x-content-type-options: nosniff
age: 21153
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2983
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:39:17 GMT

GET
H3 200 path.png
s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/ Frame 807F 2 KB
2 KB 178ms
177ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/path.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84e3ed253e27b53d9141abbba76c49c7b6871a90df176fc10be3a5eaf6089e63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:32:08 GMT
x-content-type-options: nosniff
age: 21582
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2121
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:32:08 GMT

GET
H3 200 txt3.png
s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/ Frame D802 5 KB
5 KB 178ms
178ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/txt3.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b64ecb82b58a474139dfa8101727ca198a463a5409635db22d64720edd4f6ab9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:39:17 GMT
x-content-type-options: nosniff
age: 21153
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5421
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:39:17 GMT

GET
H3 200 txt3.png
s0.2mdn.net/sadbundle/13099338561793074780/300x250/images/ Frame 10DB 5 KB
5 KB 177ms
177ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/images/txt3.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b64ecb82b58a474139dfa8101727ca198a463a5409635db22d64720edd4f6ab9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13099338561793074780/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 13:50:40 GMT
x-content-type-options: nosniff
age: 56470
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5421
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:47:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 13:50:40 GMT

GET
H3 200 txt3.png
s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/ Frame 41C8 5 KB
5 KB 178ms
177ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/images/txt3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b64ecb82b58a474139dfa8101727ca198a463a5409635db22d64720edd4f6ab9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2863677302136658033/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 23:39:17 GMT
x-content-type-options: nosniff
age: 21153
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5421
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 23:39:17 GMT

GET
H3 200 pin.png
s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/ Frame 807F 4 KB
4 KB 178ms
178ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/pin.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bdb4807621e24114043a1aeb075fd292c388f5cf36f2e15821d867afa2c1b556

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:53:22 GMT
x-content-type-options: nosniff
age: 67108
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4018
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 10:53:22 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 04A2 43 B
215 B 291ms
291ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1133689&asId=2554d9b5-3795-e4d7-d4de-80446e76c5b9&tv=%7Bc:nYx2Oo,pingTime:1,time:3254,type:p,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:24%7D,%7Bpiv:100,vs:i,r:,t:2253%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:1001,o:2253,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:24,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B2248~0,0~100%5D,as:%5B2248~300.250%5D%7D%7D,%7Bsl:i,t:2253,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1001~100%5D,as:%5B1001~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:296,fm:thc9EK2+11%7C12%7C13.1102537-64448508%7C131%7C141%7C151%7C16*.1133689-65389534%7C161%7C162%7C171%7C18%7C19.1102537-64448505%7C191%7C1a.1102537-64448504%7C1a1%7C1b%7C1c%7C1d.1102537-64448508%7C1d1,idMap:16*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=c
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:51 GMT
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 04A2 43 B
215 B 290ms
289ms Image
image/gif 3.222.76.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1133689&asId=2554d9b5-3795-e4d7-d4de-80446e76c5b9&tv=%7Bc:nYx2Op,pingTime:1,time:3255,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:24%7D,%7Bpiv:100,vs:i,r:,t:2253%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:1002,o:2253,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:24,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B2248~0,0~100%5D,as:%5B2248~300.250%5D%7D%7D,%7Bsl:i,t:2253,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1001~100%5D,as:%5B1001~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:296,fm:thc9EK2+11%7C12%7C13.1102537-64448508%7C131%7C141%7C151%7C16*.1133689-65389534%7C161%7C162%7C171%7C18%7C19.1102537-64448505%7C191%7C1a.1102537-64448504%7C1a1%7C1b%7C1c%7C1d.1102537-64448508%7C1d1,idMap:16*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=c
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.76.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-76-138.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://379e5540e76457ec74ab0223da95f23b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:51 GMT
x-server-name: dt09.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 txt1.png
s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/ Frame 807F 4 KB
4 KB 178ms
177ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/txt1.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc368c2cea20aebf90e07b36dbe41d74c55bb00175612f9e5616cb2fd0dd98b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:53:22 GMT
x-content-type-options: nosniff
age: 67109
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3699
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 10:53:22 GMT

GET
H3 200 txt2.png
s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/ Frame 807F 3 KB
3 KB 178ms
178ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/txt2.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea6f1f2efe75fa75e936e15344381aed159299258f3f178721cff61fd0d3ff06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:53:22 GMT
x-content-type-options: nosniff
age: 67109
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2577
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 10:53:22 GMT

GET
H3 200 txt3.png
s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/ Frame 807F 2 KB
2 KB 178ms
177ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/txt3.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

084377c069a363bd635c3562360b7c90f2ea1011707e6b52f72018a9b8ea23cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:53:23 GMT
x-content-type-options: nosniff
age: 67108
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2234
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 10:53:23 GMT

GET
H2

200

setuid
prebid-server.rubiconproject.com/
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dgrid%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26uid%3D%24%7BBSW_UUID%7D?gdpr=&f=i&gdpr_c...
https://prebid-server.rubiconproject.com/setuid?bidder=grid&gdpr=&gdpr_consent=&us_privacy=1---&uid=581216dc-757a-4ba2-b89a-452fcfb34d99

86 B
917 B

241ms
240ms

Image
image/png

52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-server.rubiconproject.com/setuid?bidder=grid&gdpr=&gdpr_consent=&us_privacy=1---&uid=581216dc-757a-4ba2-b89a-452fcfb34d99
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:51 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/png
content-encoding: gzip
expires: 0

Redirect headers

Location: https://prebid-server.rubiconproject.com/setuid?bidder=grid&gdpr=&gdpr_consent=&us_privacy=1---&uid=581216dc-757a-4ba2-b89a-452fcfb34d99
Date: Mon, 12 Sep 2022 05:31:51 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3 200 txt6.png
s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/ Frame 807F 4 KB
4 KB 178ms
177ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/images/txt6.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

afd90b7fad462d024b070a5117465c454b2069d8af623ed147d7ea012422f5ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9438485774792436297/300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:53:23 GMT
x-content-type-options: nosniff
age: 67108
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3740
x-xss-protection: 0
last-modified: Wed, 13 Jul 2022 10:50:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Sep 2023 10:53:23 GMT

GET
H2

200

setuid
prebid-server.rubiconproject.com/
Redirect Chain

https://sync.colossusssp.com/pbs.gif?gdpr=&gdpr_consent=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dcolossus%26gdpr%3D%26gdpr_consent%3D%7B%7Bgdpr_cons...
https://prebid-server.rubiconproject.com/setuid?bidder=colossus&gdpr=&gdpr_consent={{gdpr_consent}&us_privacy=1---}&f=i&uid=6e977507-f2c6-475a-9e06-3f1b62bc260a

86 B
1021 B

241ms
240ms

Image
image/png

52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-server.rubiconproject.com/setuid?bidder=colossus&gdpr=&gdpr_consent={{gdpr_consent}&us_privacy=1---}&f=i&uid=6e977507-f2c6-475a-9e06-3f1b62bc260a
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:53 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/png
content-encoding: gzip
expires: 0

Redirect headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 05:31:52 GMT
Server: nginx
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Location: https://prebid-server.rubiconproject.com/setuid?bidder=colossus&gdpr=&gdpr_consent={{gdpr_consent}&us_privacy=1---}&f=i&uid=6e977507-f2c6-475a-9e06-3f1b62bc260a
Cache-Control: no-cache, no-store, must-revalidate
Transfer-Encoding: chunked
Connection: keep-alive
Expires: 0

GET
H2

200

setuid
prebid-server.rubiconproject.com/
Redirect Chain

https://sync.1rx.io/usersync2/rmphb?gdpr=&gdpr_consent=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-...
https://sync.1rx.io/usersync2/rmphb?zcc=1&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26f%3Di%26uid%3D%5BRX_UUID%...
https://sync.targeting.unrulymedia.com/csync/RX-70201f2d-e19d-4235-85c4-8b77972a1fd3-004?redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D%26gdpr_consent%3D%...
https://prebid-server.rubiconproject.com/setuid?bidder=unruly&gdpr=&gdpr_consent=&us_privacy=1---&f=i&uid=RX-70201f2d-e19d-4235-85c4-8b77972a1fd3-004

86 B
1 KB

244ms
244ms

Image
image/png

52.194.84.66
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-server.rubiconproject.com/setuid?bidder=unruly&gdpr=&gdpr_consent=&us_privacy=1---&f=i&uid=RX-70201f2d-e19d-4235-85c4-8b77972a1fd3-004
Requested by: Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/
Protocol: H2
Server: 52.194.84.66 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-84-66.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://leisurelylifestyle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 05:31:55 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/png
content-encoding: gzip
expires: 0

Redirect headers

location: https://prebid-server.rubiconproject.com/setuid?bidder=unruly&gdpr=&gdpr_consent=&us_privacy=1---&f=i&uid=RX-70201f2d-e19d-4235-85c4-8b77972a1fd3-004
date: Mon, 12 Sep 2022 05:31:54 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX70201f2de19d423585c48b77972a1fd3004
content-type: text/html

GET
H3 200 0c8367baecb3d721ad3758ae9f9d0408.png
s0.2mdn.net/sadbundle/2987880808898358456/media/ Frame 3695 480 B
517 B 180ms
179ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2987880808898358456/media/0c8367baecb3d721ad3758ae9f9d0408.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33ef89958231c1d9c57b8707fd8e393367c7100b261767ebb9229b3540e630d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 07:00:44 GMT
x-content-type-options: nosniff
age: 167469
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 480
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:44 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Sep 2023 07:00:44 GMT

GET
H3 200 403a34b838ec0b76591357930d76a8be.png
s0.2mdn.net/sadbundle/2987880808898358456/media/ Frame 3695 1 KB
1 KB 179ms
178ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2987880808898358456/media/403a34b838ec0b76591357930d76a8be.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bf8cbbe743efbdba940e50f0e29b8bdcfd134ab8df75852c720a5cee81cd3087

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2987880808898358456/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 07:00:44 GMT
x-content-type-options: nosniff
age: 167469
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1254
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:44 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Sep 2023 07:00:44 GMT

GET
H3 200 dc35d9c4db8d8f30c2fdeb93c4180122.png
s0.2mdn.net/sadbundle/7704509421823420664/media/ Frame 99E8 49 KB
49 KB 177ms
177ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7704509421823420664/media/dc35d9c4db8d8f30c2fdeb93c4180122.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dc05f3e1df406dd8f872ebb06545bdb16bd0ef613bc3d63b9d8c651d1e97cada

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7704509421823420664/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Sep 2022 12:09:53 GMT
x-content-type-options: nosniff
age: 408120
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49715
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 04:07:54 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 07 Sep 2023 12:09:53 GMT

GET
H3 200 9a7b2ae67432127c94292ea1df521951.png
s0.2mdn.net/sadbundle/7704509421823420664/media/ Frame 99E8 4 KB
4 KB 182ms
181ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7704509421823420664/media/9a7b2ae67432127c94292ea1df521951.png

Requested by

Host: leisurelylifestyle.com
URL: https://leisurelylifestyle.com/hot-springs-in-california/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS