hd.ekooralive.com Open in urlscan Pro
2607:f8b0:4006:824::2013 Public Scan

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:36 GMT
an-x-request-uuid: c4ba69e2-b297-4d83-bb2b-6aaa869b51c7
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODg1NzcxNDE5NjI3ODA0MTE0MQ%3D%3D
x-proxy-origin: 38.132.118.68; 38.132.118.68; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 236B 0
0 97ms
97ms Fetch
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C03CJtde1ZcDwNoSOvPIPk9UJwbrf3XLByrOxvBG-gNOFojkQASCA76MvYMmGgIDco8QQoAGNlIeyAcgBBagDAaoEqwJP0M36JymGnTP7Bjm6bDl9uJvnAp4R5yFYPC5F-DfrR0aVpxGKa9IrUaqZdJvB1zW01vsdoPATF1_zkqFwG2Z-AKopW3T7zuXlQlS3Q5JkDLGOxWKHJTC0ScTl5cytu-9mPd-z-4Gu-00HW7hlytQMI7pLQ3renW9SOTHEvSMK8mYrekM1qUdDkF_xX3Bx-_xA8ovsHfjliEuEcKAbQSFCMPpfZqzqUuN8Z_6aqULc0BvAdAwrIh_Bw7UwC8VFmY2jeEbk-eGHk8hUxWziBWtuCeF_lsu4HDp4cjdOV013Fp74zd8OJp1Gd9WAwZ_Ls9HcXtZ6HG_R1VUW_NgOQuAa_1xzUEGDh99GobOvXNy15QV7x8H5RkcrMbgV1ESr9Qv9vQXUYVIMQAHaxsAE45vazKcE4AQDiAXw7L_RSpIFBggDEAUYHpIFBggbEAEYAZIFBggdEAQYAZIFBggdEAEYAZIFBggeEAEYAZAGAaAGdoAH2-v4zQKoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAPIHChCU9h0Y3rbe4wHSCB8IgGEQARgfMgKKAjoEgECAQEi9_cE6WNzq7JWf_4MDgAoByAsBogwIKgYKBKy6sQLaDBAKChCwzNyM1NTviHESAgEDsBPyr5IWyBPG-IPiA9gTCogUAtgUAdAVAYAXAbIXHAoaCAASFHB1Yi02MTI0OTcyNDUzNDUzNjQxGADoFwE&sigh=ODfjjO85_io&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTgAvHhf_0pL8s0gREVezxEQ3L9z3SZy0_x3IYc-iu_vz2ft-359aJzPzGfEPbxpC82uLmZIbHWQ3Y6kSXFlH1cWLuvRQeN7KxjEhn8ZKmxgB&vt=10&cbvp=2&vis=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6124972453453641&output=html&h=280&slotname=3466966124&adk=1993234961&adf=1232222165&pi=t.ma~as.3466966124&w=1000&fwrn=4&fwrnh=100&lmt=1706383639&rafmt=1&format=1000x280&url=https%3A%2F%2Fhd.ekooralive.com%2F&host=ca-host-pub-1556223355139109&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1706416053359&bpp=3&bdt=427&idt=478&shv=r20240122&mjsv=m202401250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6435881236366&frm=20&pv=1&ga_vid=963180348.1706416054&ga_sid=1706416054&ga_hid=972299190&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=300&ady=163&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31080534%2C31080697%2C95322329%2C95320891%2C95321627%2C95322163%2C95323007&oid=2&pvsid=3734680266489063&tmod=1997900759&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=483
Attribution-Reporting-Eligible: event-source
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 28 Jan 2024 04:27:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 AGSKWxXtZtjia9o6EMKFoFQ0aRDNMqu0NCZVO_bw-LZLBskQqXClhAoOB8zTjN6RHSRY26u5bRQjqiw7h4QcU0nFhk8rIYUtUOiiO9NhcURAp4sPxMwoaSeUeXLv306xJ6K2Yf1r_hFCgw== Show response
fundingchoicesmessages.google.com/f/ 10 KB
5 KB 96ms
95ms Script
application/javascript 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXtZtjia9o6EMKFoFQ0aRDNMqu0NCZVO_bw-LZLBskQqXClhAoOB8zTjN6RHSRY26u5bRQjqiw7h4QcU0nFhk8rIYUtUOiiO9NhcURAp4sPxMwoaSeUeXLv306xJ6K2Yf1r_hFCgw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA2NDE2MDU1LDYyMzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vaGQuZWtvb3JhbGl2ZS5jb20vIixudWxsLFtbOCwiWXRrdlV2cjBLaEkiXSxbOSwiZW4tVVMiXSxbMTgsIltbWzBdXV0iXSxbMTksIjIiXSxbMTcsIlswXSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4cf612aa4031c42cb5d9f5a35de6bdfc746e82014c64767c1b7cc01058f73960

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-ZziJqmfxFwWACexYF5sEgA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://hd.ekooralive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 28 Jan 2024 04:27:35 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-ZziJqmfxFwWACexYF5sEgA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjOsOoxSXFEKwhxXDe6Q7TdSC-qPKU6SYQ1zI8Y2oF4gfhz5heALGBxnMmCyAuyH7OVAHEjH9eMHECcU__S6YpQPzuy0smnq8vmSSAWAOI30m-YvoGxDt8PFjehE9n5YqYznq6YDrrZSBmq5jOygfEcXXTWfOAmG_ddFbd9dNZt5yZzroHiGOeT2dNAeLFrDNYVwPxlMAZrHOAuCUayAZip_QZrEFA_DlzButvIC67fY61DoiFeDi2r7--lk3gwOY_B5kAtPxc_Q"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/ Frame B85B 2 KB
822 B 71ms
64ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240122/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 28 Jan 2024 00:00:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16004
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 11 Feb 2024 00:00:51 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240122/r20110914/ Frame B85B 23 KB
9 KB 73ms
67ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240122/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240122/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb4fec10d8f4484b291b7c7d0de59d1b4375e000029fd1a128ad10c270d8d803

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 27 Jan 2024 23:54:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16377
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9319
x-xss-protection: 0
server: cafe
etag: 16165788300067284045
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Feb 2024 23:54:38 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/ Frame B85B 3 KB
1 KB 80ms
73ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240122/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 27 Jan 2024 23:54:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16377
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Feb 2024 23:54:38 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/ Frame B85B 20 KB
8 KB 71ms
65ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240122/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d58acf16b5e4521c9eb24fe9fd97308e5f8be1297e4b63a547e5b610611799ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 27 Jan 2024 23:54:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16377
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8492
x-xss-protection: 0
server: cafe
etag: 9878124937798820110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Feb 2024 23:54:38 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame B85B 205 KB
65 KB 201ms
186ms Script
text/javascript 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240122/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fcab795411fac2ef4fe726fc3ee3ad3192ff76a846fa3b28616b3b6e61fae83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 28 Jan 2024 04:27:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66337
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1706100845105677"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 28 Jan 2024 04:27:35 GMT

GET
H2 200 5ff8bb2821e31fbf08fa14f5007a6efe.js Show response
www.gstatic.com/mysidia/ Frame B85B 37 KB
15 KB 75ms
61ms Script
text/javascript 2607:f8b0:4006:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/5ff8bb2821e31fbf08fa14f5007a6efe.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240122/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2003 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54db8dca7039b548a0aa4e5e22fcea2a4e536b8aaec0b13a750dbc61ca3f3538

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 06:10:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 166636
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15476
x-xss-protection: 0
last-modified: Wed, 24 Jan 2024 22:40:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 25 Apr 2024 06:10:19 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 2207
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPNFzTdXdefTNWI5R9YpH0M&google_cver=1

43 B
163 B

62ms
54ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPNFzTdXdefTNWI5R9YpH0M&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNPh9QIQ8ZCY7AEYnMzscTAB&v=APEucNUFMao2p1o-7Y8OuHW4z_kfNb6EbilZb_A786n_q84oRNrgIavTqif4Bv1ANzXQQd35k41DIy16UyCLlIQaAn3owpA6-w
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:35 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPNFzTdXdefTNWI5R9YpH0M&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 2207
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTE3MGMxMGMtYzNmYy0yZjQzLWMwMzAtODNhN2NjNTc2ODJh

170 B
243 B

78ms
77ms

Image
image/png

142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTE3MGMxMGMtYzNmYy0yZjQzLWMwMzAtODNhN2NjNTc2ODJh

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNPh9QIQ8ZCY7AEYnMzscTAB&v=APEucNUFMao2p1o-7Y8OuHW4z_kfNb6EbilZb_A786n_q84oRNrgIavTqif4Bv1ANzXQQd35k41DIy16UyCLlIQaAn3owpA6-w

Protocol

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 28 Jan 2024 04:27:35 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTE3MGMxMGMtYzNmYy0yZjQzLWMwMzAtODNhN2NjNTc2ODJh
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

um
sync.teads.tv/ Frame 2207
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEAXtOChotymhSVmog50YWkM&google_cver=1

23 B
278 B

145ms
76ms

Image
image/gif

23.51.57.155
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEAXtOChotymhSVmog50YWkM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNPh9QIQ8ZCY7AEYnMzscTAB&v=APEucNUFMao2p1o-7Y8OuHW4z_kfNb6EbilZb_A786n_q84oRNrgIavTqif4Bv1ANzXQQd35k41DIy16UyCLlIQaAn3owpA6-w
Protocol: H2
Server: 23.51.57.155 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-155.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sun, 28 Jan 2024 04:27:35 GMT
pragma: no-cache
date: Sun, 28 Jan 2024 04:27:35 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEAXtOChotymhSVmog50YWkM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2207
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YmJkNmZkYjEtMmQ1YS00MjUyLWEyYzEtYzI4NDJkNTc4YWI3

170 B
188 B

81ms
79ms

Image
image/png

142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YmJkNmZkYjEtMmQ1YS00MjUyLWEyYzEtYzI4NDJkNTc4YWI3

Requested by

Protocol

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:35 GMT
server: pekko-http/1.0.0
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YmJkNmZkYjEtMmQ1YS00MjUyLWEyYzEtYzI4NDJkNTc4YWI3
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Sun, 28 Jan 2024 04:27:35 GMT

GET
H3 200 IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js Show response
pagead2.googlesyndication.com/bg/ Frame 90D4 39 KB
15 KB 68ms
65ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 06:10:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 166620
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15219
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Jan 2025 06:10:35 GMT

GET
H2

200

sync
partners.tremorhub.com/ Frame C988
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=tremor_video_dbm&google_cm&google_dbm
https://partners.tremorhub.com/sync?UIGL=CAESEF22jngyqRadOvnjvKTivCY&google_cver=1

43 B
175 B

257ms
60ms

Image
image/gif

2600:1f18:612b:4232:de7c:f9e0:289e:271b
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIGL=CAESEF22jngyqRadOvnjvKTivCY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNPh9QIQ8ZCY7AEY7cfscTAB&v=APEucNXA1vyiTa8wBGXNHdN2VrYAl3X7E_du6IbKUyzEeDiqYpOt-dIZxhGwp-2Zo8762D0B35ckl4wgy_ZzULPq0oX7nQ7Vrw
Protocol: H2
Server: 2600:1f18:612b:4232:de7c:f9e0:289e:271b Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Sun, 28 Jan 2024 04:27:36 GMT
server: nginx
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://partners.tremorhub.com/sync?UIGL=CAESEF22jngyqRadOvnjvKTivCY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 283
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET

partner
sync.search.spotxchange.com/ Frame C988
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEC03hi4GpgXw-0EGGhbngkU&google_cver=1

0
0

GET partner
sync.search.spotxchange.com/ Frame C988 0
0

GET
H3 206 file.mp4
r3---sn-q4fl6n6d.c.2mdn.net/videoplayback/id/211fe929b7ed04a0/itag/22/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1737952055/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,... Frame 236B 8 MB
8 MB 154ms
88ms Media
video/mp4 2607:f8b0:4000:8::8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4000:8::8 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Range: bytes=0-

Response headers

expires: Sun, 28 Jan 2024 04:27:35 GMT
date: Sun, 28 Jan 2024 04:27:35 GMT
x-content-type-options: nosniff
Content-Range: bytes 0-8058437/8058438
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 8058438
last-modified: Thu, 16 Mar 2023 20:06:01 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
access-control-allow-origin: https://googleads.g.doubleclick.net
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://googleads.g.doubleclick.net
client-protocol: quic

GET
H3 206 file.mp4
r3---sn-q4fl6n6d.c.2mdn.net/videoplayback/id/211fe929b7ed04a0/itag/22/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1737952055/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,... Frame 3143 1000 KB
0 151ms
87ms Media
video/mp4 2607:f8b0:4000:8::8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r3---sn-q4fl6n6d.c.2mdn.net/videoplayback/id/211fe929b7ed04a0/itag/22/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1737952055/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/44CFDCFC2F7D26BD9D373CD498BDE1E87B9BBF8F.220E4A97BD57F8A79AA0A441D05D6FC96A589F45/key/cms1/cms_redirect/yes/mh/kI/mip/2001:550:1d05:1::13/mm/42/mn/sn-q4fl6n6d/ms/onc/mt/1706415134/mv/u/mvi/3/pl/48/file/file.mp4

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6124972453453641&output=html&h=280&slotname=3466966124&adk=3264321726&adf=2541834245&pi=t.ma~as.3466966124&w=1000&fwrn=4&fwrnh=100&lmt=1706383639&rafmt=1&format=1000x280&url=https%3A%2F%2Fhd.ekooralive.com%2F&host=ca-host-pub-1556223355139109&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1706416053362&bpp=2&bdt=430&idt=491&shv=r20240122&mjsv=m202401250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1000x280&nras=1&correlator=6435881236366&frm=20&pv=1&ga_vid=963180348.1706416054&ga_sid=1706416054&ga_hid=972299190&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=300&ady=1505&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31080534%2C31080697%2C95322329%2C95320891%2C95321627%2C95322163%2C95323007&oid=2&pvsid=3734680266489063&tmod=1997900759&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=495

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4000:8::8 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Range: bytes=0-

Response headers

expires: Sun, 28 Jan 2024 04:27:35 GMT
date: Sun, 28 Jan 2024 04:27:35 GMT
x-content-type-options: nosniff
Content-Range: bytes 0-8058437/8058438
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 8058438
last-modified: Thu, 16 Mar 2023 20:06:01 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
access-control-allow-origin: https://googleads.g.doubleclick.net
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://googleads.g.doubleclick.net
client-protocol: quic

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame A3F0 38 KB
13 KB 73ms
70ms Document
text/html 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 167652
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 26 Jan 2024 05:53:23 GMT
expires: Sat, 25 Jan 2025 05:53:23 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js Show response
pagead2.googlesyndication.com/bg/ Frame 2D28 39 KB
15 KB 66ms
65ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 06:10:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 166620
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15219
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Jan 2025 06:10:35 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame E0CD 38 KB
13 KB 78ms
77ms Document
text/html 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 167652
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 26 Jan 2024 05:53:23 GMT
expires: Sat, 25 Jan 2025 05:53:23 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame D8C6 207 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9e2efe40c11811d6d5f0fc6dce5843d4f5cdf2849c9d1970b2f757f94df41f0a

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 85EB 38 KB
13 KB 83ms
80ms Document
text/html 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 167652
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 26 Jan 2024 05:53:23 GMT
expires: Sat, 25 Jan 2025 05:53:23 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 n_one_vway_bahia-principe-es_np.js Show response
bucket.cdnwebcloud.com/ Frame CFE9 1 KB
977 B 252ms
59ms Script
application/javascript 54.230.163.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bucket.cdnwebcloud.com/n_one_vway_bahia-principe-es_np.js?n_o_nu=not&n_o_aut_tc=275849625&ord=2142529278
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-76.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 74130e91791cf3496d353724953e6466d3240ea308838a482dff16cd6c119aa0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 27 Jan 2024 14:54:27 GMT
content-encoding: gzip
via: 1.1 8726e9cde2774d888ce72f8ebf7f8d30.cloudfront.net (CloudFront)
last-modified: Fri, 20 Dec 2019 13:03:10 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C3
age: 52866
etag: W/"9748fb959a7ee41d8aebb52473ace3d2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: vBq2Q0ZTzgiSKu-pvUSknWRgp82ANPSH8AOdMQ_KHRCkiI0SgXd2Sg==

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/9845278200317499338/ Frame D492 206 KB
31 KB 259ms
106ms Document
text/html 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=uUBsAVlIWR&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46ee61be0b2b806f4f1f7a2f5083d88982599787022c337811f1a97983f9fe13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sun, 28 Jan 2024 04:27:36 GMT
expires: Mon, 27 Jan 2025 04:27:36 GMT
last-modified: Thu, 25 Nov 2021 15:49:03 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame CFE9 0
0 274ms
101ms Fetch
image/gif 142.251.41.6
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjss-IbZUX87NXm52MX3kMJOkzEryMVK1Nu-cVs4wzkJfBF_7rKeE0QrpOeoBqy75Q9tFVqMLiXkMrJaHvlMHZZAZtGhEUI_ioEc5VZy0VqaDxE6CWUKW_vwG3AYCfPlwpB5JkH-HGLP6en2XYFDE92IMuvkbNEL_8ZjaxDheLPGI9JbGPjuL6uCin_KrAigEwAoywBHzjhsqSo8nmW-7pGbw60SDxnfqleSEEF3VRcktee89DWOFoUVvGLISeBS27F58xErJK9p8t1o-iK3Vie4Oy2AUqjAPIymjg7Vhu3k7KSkqFeRrAyc_xk-bi2c6ssXu3lZPG2V3Sd1xjIvSe-iaDOqt1TDtREZFFEDp0vGtLaSxqgfI2lgG9rnQUOjcgvTqjjSW1dal8mV0N72xF1nawNlvDZzXPE6SzyB4nyHMttXQLwZj6OzNTZzbar5efMrodiwuILZwT9m37KADPAu7xEN6ITbSSJ2rExQEZVoWf0grW_sffJFCK-wWt2Fankie9xdrrKwW1FTSul-diB9NGiO4cmYh_f4k5XFgQr3TN8g2Mv2IWZOnBbhBrydwOYn6uxtOSvacnygEZRQfth-h2Gd4IXyXlPL7fIfOzs6NxArw-p0INLvm-YB6ElkJ2diG54yAgwZDdMnwoT7BWqDowrQ2SMLpKKlyNzU01-t-bNU-wVzIWm5NsnlmUmLN0A03dW7mMsIIu84_ERaf3CeR84i3wwSnIO6iOtImzfiqS6FN1us0J2oYhh8PzPSoe2T5tUGUqRiv2sXSBxo5TMmoMyhSITw5h2c6wIB-I7JK31YmDw5HoMgIwKJrGGHF5Kxo1ZNqkxtRfZMzwxWL8v1MvrOwfD8EHM0iAVnrOFKWmrKtUZ5heQL8tN4ibf4X7kNaVqxlrtu48G57z7gf9tsqHTfT5r0QNDMZAvdG1_JsymAswJTdp925Jj0XGodCEedodKKzYHnoKoo20iYqYoPKcD7KqySUsk_QdJ0b1o7tsOzUJIneppAviG3G2hidTQBCThI7jfZbqooTgJSSSE0RFQGL4vVFXBgBchVyskFjwT052ujWnGjblJdQp5KHrWguDD-g3Sazw1cfnBhz9Gn4p7n75tJUUc5doeCS5b3vf4nkPfAovrxneOB0UaZDTQnkAjLhZc82Z2VjOpUtOCEsDJxrlE-tDY2LodAsi18QRW7GbsqZbBpKX8CSP2RGI2MbBSMcvqALzrD6VD8yvSrtQsqRd46szQcDtjjP0Ubn8xywEx6AaAIlcvk-4413q4LjXbE35vgd0-_7GTTxZwOHFMV2wQ-TUb2FefrU7VOWK0_22_USGBo2qNPdtyqZve1ikDBeIHd9ysxriNfswPI7qguFi_NCH1EkrvgehBJYGdyylMPK8L5Ua83KRVXvpMZSTuJz7vfxKjpXGiBZAE1DLpt2KxsMgJG67s3akGv_py0Srsqjvw&sai=AMfl-YR0HmDSqCzN6QMmnUyX-jd20xg966DbuIGav-ctW-s-VKs_hkJNa3jcVNR6r4qqzGAD9Zy0IRT6t0zOob4XnRXBRJkyfZ7Qc-UBBWPzDGt0Yq8taozF7dcIejHkqGT6L5xvypu7RWZ0GOfGpFRDiwf3xa9ghIKGytjlsEUAuUrlEJrW-oDNoBN8tMc6Gyar2GtC9rlKnPTxPCzgl6Jsq2WduLNaqij8zPmxfcVX_3HUXE5h4gi6ZU2HgOh108oVKsQ9EEaLDj6c-VW1Vf2WSPulGRre5rTn_GHjGVmBKVTAdrJvwD11glEq5dHg2sfNrTFOfijBcChlHgWe70Gvg-phY13EvVSZyIFVkS35OcC1XXHCRONM6-mxw9vjbbKK1TEo9hWWBJA7HmMvcA8RkJDkcXH2yhZ-WbPE4gOvordhG_Qkdfv8HdljR6sk_JJ1ntKO-lyc6bx1UV4gkDOBvvm-492aLx9BqC6c0K0yKLwMhlOmuYdQtRpGwNOuOI-nYaSvVso&sig=Cg0ArKJSzIa1xpRAAQqsEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9iYWhpYS1wcmluY2lwZS5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=641&cbvp=1&cstd=624&cisv=r20240122.42275&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 28 Jan 2024 04:27:36 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 n_one_vway_bahia-principe-es_np.js
bucket.cdnwebcloud.com/ Frame CFE9 1 KB
1 KB 232ms
60ms Image
application/javascript 54.230.163.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bucket.cdnwebcloud.com/n_one_vway_bahia-principe-es_np.js?n_o_nu=not&n_o_aut_tc=275849625&ord=2142529278
Requested by: Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-76.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 27 Jan 2024 14:54:27 GMT
content-encoding: gzip
via: 1.1 8726e9cde2774d888ce72f8ebf7f8d30.cloudfront.net (CloudFront)
last-modified: Fri, 20 Dec 2019 13:03:10 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C3
age: 52866
etag: W/"9748fb959a7ee41d8aebb52473ace3d2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: 2R3b5lvPDkva5JAVL8GAyeRfVRo0Cit9xJTXWIt8FFwV9WkY1wuSLw==

GET
H2 200 n_one_vway_bahia-principe-es_np.js Show response
bucket.cdnwebcloud.com/ Frame D8C6 1 KB
975 B 215ms
61ms Script
application/javascript 54.230.163.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bucket.cdnwebcloud.com/n_one_vway_bahia-principe-es_np.js?n_o_nu=not&n_o_aut_tc=275490374&ord=4288566407
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-76.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 74130e91791cf3496d353724953e6466d3240ea308838a482dff16cd6c119aa0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 27 Jan 2024 14:54:27 GMT
content-encoding: gzip
via: 1.1 8726e9cde2774d888ce72f8ebf7f8d30.cloudfront.net (CloudFront)
last-modified: Fri, 20 Dec 2019 13:03:10 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C3
age: 52866
etag: W/"9748fb959a7ee41d8aebb52473ace3d2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: yqtxgg9H_gwrHj4ZgoaikT2TS8PfjGL13S6f-eYDZCLn1TbbREMxuA==

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/11938805746972946677/ Frame A89C 209 KB
31 KB 249ms
134ms Document
text/html 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11938805746972946677/index.html?e=69&leftOffset=0&topOffset=0&c=WebmI0wejj&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61d101801c1f9fdd8dddd032ea43c62fe911ddc06914c77ac8928b603f34c2e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sun, 28 Jan 2024 04:27:36 GMT
expires: Mon, 27 Jan 2025 04:27:36 GMT
last-modified: Thu, 25 Nov 2021 15:49:14 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame D8C6 0
0 241ms
100ms Fetch
image/gif 142.251.41.6
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssa4H_cy0Gh-G-TwHKZIdfBSM-k84Mua1KcB20qc2sB7Jgk6jD5A2k52dzTqVzmAbD_aPj1RLbmajXDxoa9ObXbUtfW7mw7EUjnt00Zz6kr0Xv-kN3oHOTL3lXyjkKfL_QsZ4eIkhczWSnDR5G-4yndWEof5_-rb1TjsEhZGxHI0Y1cjMgc63kOga3OtgWK5C4UBqcexyaGguPcuh_un4cvxrmPam7FqJ1KQH3dR3L9sn1tCxzqH6JnyK8kX7jsJa6rxdz68hUftmZJnr44VCrLiMsFf103VroNQvdjwX70LJntOn84eIwjSv-xRFKOcPPj47OYjez80WwAfxRQ-aDOSLX2Xkr5Eo4QudCPgm_TnulGJL_DYW0g8zjOc9VuerpCzBvCmkw8BLYdyvErbe2xBY6pkjvJc4I2hSYxIGCFLxn9ldfOXD3ABKFwhr_v81oN7I05OLFKFgpWarTxI6PZ6ZXyAx0pXUlcdmL-CeENdA0Hdhjsc70o85VU9VJ3zvmH-gJa9fyPiTPTyDb_R62A85ZjEG-rWlYQXlMr6GIq7594ajNcUHzTwUQYACPRGqCCgyEpqAsROqIPSiTvY7GmXJF4YPqpZjbSMRbWH9DqXLfrY4pRZqPMccWFfAqZwlO1S4Xgrc_Div242sV22AGACpzTiP1l7j-x6r1uw3Bgo5ikqbYyK_8xLw22GEM4du7__YV1S3s9BZabH1KHcJkaB-DY8SqLFLUk6oCdlsj7bbL35v8UpaivsoToHBA8uoJQhUBywdaY1oVUueGaluxvlfo5eq1owF7Y8ch-Vo4YwDKR-MI6dXqlHhWNu3Z7ugiyMUqqoZ7rohD2Cgdwo_OAlPjtlUUVVwCqRb8pyMtsdsIuM4hcL7q8WV5Vsxr-7L5hrFSvQZpk8wLyv5cgAIWu-b1QNOAKAxA0AfYmikzA0B82TfMw7xNi8q9YI6h3bOgnY7MZ0_RQkNYunKSqfQWHstVCqSTZr7hmTiwXP-vCse4PsPYxINgkzyfUG1pvKR2zEPjjtFz1HfNdZBCR9J8m1JScbklkeI0Lnvvv4Rdzh92cmBFRyVu3pUzKHWLd5mIUvK0SuzZozYXHbi-J8S57s2f30y2xJ_qKCCsuFmN69w8vAJouCU5eZNrgmv2CpjiHv_p7v4ZRo3ndOJWWZjia8JnbW42FaW-XKt9v0In9PoK9lYWYPwlYY72XNg93LY5IRoqu8g37ND3qeqQhDJ4bGUDMbz7RADZPgv6e2QpJYbSeN2Zwk-vcjGJ8Iahk7gO5asCMORGbt7EZ8WVyY3yqUzA05ywSRIDGIwR1J6eJZ51v30oVI1EQGWXYEkJhhvYGuNgXzIgvqxOApRaRRgA0-a6NDKrWND66ySmU68a3aAV_FfLAIKwNtMB_4y2j9NADN0SmhvrxZBsJP-tUszjWn3kjCsYlIutR1kn9kMb8RZ9qDSPLYUrm&sai=AMfl-YQf3oT8GbJKMZ-UXRsr4CfI2vBcXqwVMR_tzMN_HueNUDDoDR5T879sMV5S1yx0beK3TbCXdg1-Kbtw8wv2zva71nb6zFXsdoIt-ejTrJ6LzH9N9Jq-BCKyjH__lUOWPxefvFINwviYPgNzbgdndU5c57KTs6PP54u31NfBwZpO22JScTLqVKgQuFW_2fSvCfISrIqkTTBhkkbzqKDF459df3gt-7-LOLovO8BCsL9aYqN4EbJgLigGgZyYEZz3GXE4fF4zYKusZPbHKSFioQpvuDRrT6LoKm_qHxALowf_Dz0jlTW1Rl9Sg0M4VC2TgrFfnf1D2uefdKr5zfIDxf2ebEbd0VQ0EtpFD88uTLkkFgtAqoIszaeDOZ58Lc6bF2nI-dr23Bes7JtCB0fXrm4FUL3_1DJPcCbPIYXrCvQgZc0QRFJrXWiNOnhYSYwj2jFpgeyZViNNuguPki9SRabas1cns3ce8nsWReM4c5l1um3yIrVfmwRsucV0XWeyQ6uLf-k&sig=Cg0ArKJSzPjmqIvZiC6YEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9iYWhpYS1wcmluY2lwZS5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=517&cbvp=1&cstd=507&cisv=r20240122.45268&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 28 Jan 2024 04:27:36 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 n_one_vway_bahia-principe-es_np.js
bucket.cdnwebcloud.com/ Frame D8C6 1 KB
1 KB 202ms
62ms Image
application/javascript 54.230.163.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bucket.cdnwebcloud.com/n_one_vway_bahia-principe-es_np.js?n_o_nu=not&n_o_aut_tc=275490374&ord=4288566407
Requested by: Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-76.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 27 Jan 2024 14:54:27 GMT
content-encoding: gzip
via: 1.1 8726e9cde2774d888ce72f8ebf7f8d30.cloudfront.net (CloudFront)
last-modified: Fri, 20 Dec 2019 13:03:10 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C3
age: 52866
etag: W/"9748fb959a7ee41d8aebb52473ace3d2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: EQK5nRfSqMZKppjuOTNC2yEXd2seWVhrhZrXz2T3k0iyfpDucDkn5w==

GET
H2 200 n_one_vway_bahia-principe-es_np.js Show response
bucket.cdnwebcloud.com/ Frame 2404 1 KB
976 B 193ms
63ms Script
application/javascript 54.230.163.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bucket.cdnwebcloud.com/n_one_vway_bahia-principe-es_np.js?n_o_nu=not&n_o_aut_tc=275849625&ord=187372865
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-76.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 74130e91791cf3496d353724953e6466d3240ea308838a482dff16cd6c119aa0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 27 Jan 2024 14:54:27 GMT
content-encoding: gzip
via: 1.1 8726e9cde2774d888ce72f8ebf7f8d30.cloudfront.net (CloudFront)
last-modified: Fri, 20 Dec 2019 13:03:10 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C3
age: 52866
etag: W/"9748fb959a7ee41d8aebb52473ace3d2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: ShvdXcF0TxF8RwBWh0wFDyQ2jaYLF-oqjKWANJZbYA_2GQ0gEWBG2w==

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/9845278200317499338/ Frame C9B0 206 KB
31 KB 172ms
79ms Document
text/html 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=UuoD9x2i0q&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46ee61be0b2b806f4f1f7a2f5083d88982599787022c337811f1a97983f9fe13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sun, 28 Jan 2024 04:27:36 GMT
expires: Mon, 27 Jan 2025 04:27:36 GMT
last-modified: Thu, 25 Nov 2021 15:49:03 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 2404 0
0 222ms
101ms Fetch
image/gif 142.251.41.6
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjstKadlM9E9XSixRsdTelSxtfXMELQyqOOhHyXE3jmxv_Xzgl7Z1xGvQzlnORpIkoTlr8i20BFEBBcmB1v0b5FIRHugP8nld2sgWThByhI-XIicBVGBZ5mJScUbsjow8WbslUIVicPVbdRAsmvew5BPHG18hguGXI37_z1Y7Huud1BCHzal_pHNvGP9j_cdq9ZTAM1HAooP2LIHoPuNAfnJIQBXiy4sz5YJ0W-wB7k_iyEa_pOmFTxvUkWd3amzP0iz8I30iGPTH9-O0j6jFl_pgYkhMKY_KLZOwT2JeQy-PbPffreJmYENgaJ69_PjST97nKyOlDhZnHIY3MiK8gK0iPrnXhd-U1487HmbVGpbZDoGAh8-qK6bKPRYKIpCW7DPq66pj-eounX2rDThqpjlppROt8ycMvEq6EUkrGG38FEo2D_nR3WU6gOSE7VMvAd4xbL_mm2WRTZnyMJvBCn47OEywKWV6HI6f4DmO8DCfnKslJRPs5qtJ8cxUztq2ZiNHhEkRywpSiM6_o3MRSaH19R3wctTsSb4yPTvXgqruxFUAz_RZqTkN5r-Uax9Exreus1beVC2yLGuNt9v-sO-yYRw4G5K6p3-ZHunWQmgvK9AHVFOc-FOJLN1nrOmeOMvCrT113nitE9XxAyMkj2QhHiDFXMoKkamJ83LHwEm7pxJSisviyeDZZw0gvjiigKUxyISRZT4sMXGr7bCckxX-TKFijraRtuntm2BuaxG6JrTfOzP1wFPYr0zDL1CpG6Ngiyw_ZONAPTiFNxL1NaRjk3vTmoKcPErV0IGBe6Cc-Td_hxssVoD50uNKP3-7CTBKtnZT_so7e2E2j4hXRiwwGx2-SisVNXpqAAX0AtbpDptGWK8a1fTyi2Xe__v8ANK5DP9H28gGnTg4cGQjuq6GGbrW0lp1FryjYKvV6RXRrNdIy_gCG9rDzI35WY8563K_iPMriiWVpfartCjrKoqczUjBhEzEV3GThBoGZSLrwdBr6M6ERQYAXBCOFPmgD37g5pyYJnOk2h8O6-PhLUcv7-ZRXMZHMHUOJPTKt5Begis_lx7kv0ZoKfd59E6EFpGit-O5LBF-ezaMkP55Rypd8wx9jIIorHzzyYj9auGHsM1WW5iJe7mnCN_eDxi5HHNgDcsLKMWbpbrSOur_TmTslEunAs31yHfosj-5YKvHh1qorSZIhkNp-V7l8akj1ifSLHuP9K1nimg_TsB77IFU92O3iAiFT56-HhUk9YLwXryzZh7sK-w5sr1KL_obYujDLeB550NmjOmVvvTCT3Qk-mCetcEY5CQKLitA46ouftwpdLVtURQG6c5QquqVNFYGIlo92b_g-DKt9ZQCXMV2gStq4lyFN0MhZSW_9kv-1UOkUbuMxsl4uon75cxoFM60nBQ4-8jEmN9DvKsqkAMp-RMCG8fEILLJ2ZOOAfUyv9IJTIbFjg&sai=AMfl-YSiDvTO6_gKeyaYcZK8jOGoc3BiTvFR7ideE9qIkrI9HL6y08XykKq5f71eaAhDubo6qB4kepOIfUJBDKtzEAHK0xvKynaXTYpxghxPxi0wEB7nD66WidVkWa3dwR3ll-BPB056V3yucGYvPpq0CHRbToJcp8qNxDozze4eHBNfgULiS6AFA9pn8rUalIN22pgI4sSIKnFjg9iRsxzO2ogSvh-z-hgJzgbPpsZKZzsiwM6W6JHOkfwpggmRhSgDhJN7whpfzb3EdbED-4P6LydibG4qFuuxPRYIWefK_KTy_WC-V5fTnKTOpLyBdQ4D0fPaEWcjr50k7I4XGWZv2RiTS8VDVnGxmca0wIe6Cwu_CAe9Ksihzr5Jr0BCsBqfEzHl2q618B72JIGszrPZq-6OUL_AkJnYs_uc8vWxp4USc0WeukcWXfzxqPtjJbVwb9QCqn0iaHbzNamgM_HMEE-ARdttrck_fB56R4WZ2nq5LLKXgGAClBX3dXz-76Lf12YtjBs&sig=Cg0ArKJSzHOo_S-S0LfKEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9iYWhpYS1wcmluY2lwZS5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=605&cbvp=1&cstd=596&cisv=r20240122.53732&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 28 Jan 2024 04:27:36 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Sun, 28 Jan 2024 04:27:36 GMT

GET
H2 200 n_one_vway_bahia-principe-es_np.js
bucket.cdnwebcloud.com/ Frame 2404 1 KB
1 KB 182ms
62ms Image
application/javascript 54.230.163.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bucket.cdnwebcloud.com/n_one_vway_bahia-principe-es_np.js?n_o_nu=not&n_o_aut_tc=275849625&ord=187372865
Requested by: Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-76.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 27 Jan 2024 14:54:27 GMT
content-encoding: gzip
via: 1.1 8726e9cde2774d888ce72f8ebf7f8d30.cloudfront.net (CloudFront)
last-modified: Fri, 20 Dec 2019 13:03:10 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C3
age: 52866
etag: W/"9748fb959a7ee41d8aebb52473ace3d2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: y4C7VPhQAqA7NCpRveC7yIol75gbjJYH0clWXs_CUqWdPf2GUhe52A==

GET
H3 200 IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js Show response
pagead2.googlesyndication.com/bg/ Frame A3F0 39 KB
15 KB 83ms
82ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 06:10:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 166621
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15219
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Jan 2025 06:10:35 GMT

GET
H3 200 IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js Show response
pagead2.googlesyndication.com/bg/ Frame E0CD 39 KB
15 KB 64ms
64ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 06:10:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 166621
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15219
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Jan 2025 06:10:35 GMT

GET
H3 200 IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js Show response
pagead2.googlesyndication.com/bg/ Frame 85EB 39 KB
15 KB 67ms
64ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 06:10:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 166621
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15219
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Jan 2025 06:10:35 GMT

GET
H3 200 P1hqgBmkkNDwT9zug75Po3J06KDKU0QoOZK6hiZMV2E.js Show response
pagead2.googlesyndication.com/bg/ Frame CD2D 51 KB
19 KB 78ms
73ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/P1hqgBmkkNDwT9zug75Po3J06KDKU0QoOZK6hiZMV2E.js

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3f586a8019a490d0f04fdcee83be4fa37274e8a0ca5344283992ba86264c5761

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 28 Jan 2024 03:01:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5145
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19859
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 27 Jan 2025 03:01:51 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame A89C 118 KB
40 KB 68ms
67ms Script
text/javascript 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11938805746972946677/index.html?e=69&leftOffset=0&topOffset=0&c=WebmI0wejj&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11938805746972946677/index.html?e=69&leftOffset=0&topOffset=0&c=WebmI0wejj&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 27 Jan 2024 12:10:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58615
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 28 Jan 2024 12:10:41 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame C9B0 118 KB
40 KB 77ms
76ms Script
text/javascript 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=UuoD9x2i0q&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=UuoD9x2i0q&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 27 Jan 2024 12:10:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58615
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 28 Jan 2024 12:10:41 GMT

GET
H2 200 noah.min.js Show response
bucket.cdnwebcloud.com/ Frame CFE9 19 KB
7 KB 79ms
76ms Script
application/javascript 54.230.163.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bucket.cdnwebcloud.com/noah.min.js?1706416056521
Requested by: Host: bucket.cdnwebcloud.com
URL: https://bucket.cdnwebcloud.com/n_one_vway_bahia-principe-es_np.js?n_o_nu=not&n_o_aut_tc=275849625&ord=2142529278
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-76.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3949bc357609db6e9bc5796a30a25a1865ba837e2cada69a1832b03e0814a51d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 27 Jan 2024 17:08:04 GMT
content-encoding: gzip
via: 1.1 8726e9cde2774d888ce72f8ebf7f8d30.cloudfront.net (CloudFront)
last-modified: Mon, 04 Sep 2023 14:02:49 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C3
age: 47044
x-amz-server-side-encryption: AES256
etag: W/"3c5a63b88b693279fc4d9dcff91d29c1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: AnNE1OjUGhIicrhQ3S3osU4uSadnCx90fm_N6dj0q7J2Mr6F2BT2gg==

GET
H2 200 noah.min.js Show response
bucket.cdnwebcloud.com/ Frame D8C6 19 KB
7 KB 80ms
78ms Script
application/javascript 54.230.163.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bucket.cdnwebcloud.com/noah.min.js?1706416056522
Requested by: Host: bucket.cdnwebcloud.com
URL: https://bucket.cdnwebcloud.com/n_one_vway_bahia-principe-es_np.js?n_o_nu=not&n_o_aut_tc=275490374&ord=4288566407
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-76.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3949bc357609db6e9bc5796a30a25a1865ba837e2cada69a1832b03e0814a51d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 27 Jan 2024 17:08:04 GMT
content-encoding: gzip
via: 1.1 8726e9cde2774d888ce72f8ebf7f8d30.cloudfront.net (CloudFront)
last-modified: Mon, 04 Sep 2023 14:02:49 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C3
age: 47044
x-amz-server-side-encryption: AES256
etag: W/"3c5a63b88b693279fc4d9dcff91d29c1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: J2cZMzrSkzZ200WeaBPOX5V650h32q5mxG0AZorZpVZbFs5CoN430Q==

GET
H2 200 noah.min.js Show response
bucket.cdnwebcloud.com/ Frame 2404 19 KB
7 KB 83ms
81ms Script
application/javascript 54.230.163.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bucket.cdnwebcloud.com/noah.min.js?1706416056523
Requested by: Host: bucket.cdnwebcloud.com
URL: https://bucket.cdnwebcloud.com/n_one_vway_bahia-principe-es_np.js?n_o_nu=not&n_o_aut_tc=275849625&ord=187372865
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-76.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3949bc357609db6e9bc5796a30a25a1865ba837e2cada69a1832b03e0814a51d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 27 Jan 2024 17:08:04 GMT
content-encoding: gzip
via: 1.1 8726e9cde2774d888ce72f8ebf7f8d30.cloudfront.net (CloudFront)
last-modified: Mon, 04 Sep 2023 14:02:49 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C3
age: 47044
x-amz-server-side-encryption: AES256
etag: W/"3c5a63b88b693279fc4d9dcff91d29c1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: B1GTBsVZHD9sDeoiYtSlpuZY56vVbDIO1b2id3u2EhR-81pLF-IM8w==

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame D492 118 KB
40 KB 72ms
72ms Script
text/javascript 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=uUBsAVlIWR&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=uUBsAVlIWR&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 27 Jan 2024 12:10:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58615
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 28 Jan 2024 12:10:41 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 3143 0
0 98ms
97ms Fetch
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CLYjbtde1ZczsN477xtYPmfK2gA3But_dcsHKs7G8Eb6A04WiORABIIDvoy9gyYaAgNyjxBCgAY2Uh7IByAEFqAMBqgSlAk_QRYqhOKxby0nQbboU5CMWJH52__Y-O6D842Z3dOLxYDjZpctq9IHC03tFQuZqRAEFcDTWKrIOypv-oA0p9gM-o0kX9zHn16ZOXsWHU294TOH4hXgBL5t7d_-gNmJa91XKPuN3CpHZd1HoVpRyc0xH8r2_zNmNrYMG06Wt5g0iR1bwOddZum1q15uIwo_LMquT-L1_rsFWyQ9AhQ0DvQ_6PGOnSsXWPYjZ5nPJSopBnKUCaaJAtaQ0alu0QrvS54F5f976B9kYUV3jARtNFcRPxXhtCxGSjKlbOgOks-rJm6XHXrTZd-HAXBzu1iky_L0DCPlaNmrLPJ8Nr3hjtkC48zxNVQaaIaG_cCwCmXjcYSB3Od-kw4QVz1jaHXVPSWJ0NLjAwATjm9rMpwTgBAOIBfDsv9FKkgUGCAMQBRgekgUGCBsQARgBkgUGCB0QBBgBkgUGCB0QARgBkgUGCB4QARgBkAYBoAZ2gAfb6_jNAqgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcA8gcKELj_CRjett7jAdIIHwiAYRABGB8yAooCOgSAQIBASL39wTpY3OXtlZ__gwOACgHICwGiDAgqBgoErLqxAtoMEQoLEKCdj_Sr44emwgESAgEDsBPyr5IWyBPG-IPiA9gTCogUAtgUAdAVAYAXAbIXHAoaCAASFHB1Yi02MTI0OTcyNDUzNDUzNjQxGADoFwGyGAQSAqJe&sigh=31kWGtTCI1I&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTgAvHhf_1pSxRbIhsHKLlJWfGfbAy6Go0lnKv1gAp_tKFDSUfaM1rCSnucEahK8eRi0-wEJX2wtU7P0MyWqIiEvMiVA9UNCrS3JKFx_oHBgB&vt=10&cbvp=2&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6124972453453641&output=html&h=280&slotname=3466966124&adk=3264321726&adf=2541834245&pi=t.ma~as.3466966124&w=1000&fwrn=4&fwrnh=100&lmt=1706383639&rafmt=1&format=1000x280&url=https%3A%2F%2Fhd.ekooralive.com%2F&host=ca-host-pub-1556223355139109&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1706416053362&bpp=2&bdt=430&idt=491&shv=r20240122&mjsv=m202401250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1000x280&nras=1&correlator=6435881236366&frm=20&pv=1&ga_vid=963180348.1706416054&ga_sid=1706416054&ga_hid=972299190&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=300&ady=1505&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31080534%2C31080697%2C95322329%2C95320891%2C95321627%2C95322163%2C95323007&oid=2&pvsid=3734680266489063&tmod=1997900759&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=495

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6124972453453641&output=html&h=280&slotname=3466966124&adk=3264321726&adf=2541834245&pi=t.ma~as.3466966124&w=1000&fwrn=4&fwrnh=100&lmt=1706383639&rafmt=1&format=1000x280&url=https%3A%2F%2Fhd.ekooralive.com%2F&host=ca-host-pub-1556223355139109&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1706416053362&bpp=2&bdt=430&idt=491&shv=r20240122&mjsv=m202401250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1000x280&nras=1&correlator=6435881236366&frm=20&pv=1&ga_vid=963180348.1706416054&ga_sid=1706416054&ga_hid=972299190&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=300&ady=1505&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31080534%2C31080697%2C95322329%2C95320891%2C95321627%2C95322163%2C95323007&oid=2&pvsid=3734680266489063&tmod=1997900759&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=495
Attribution-Reporting-Eligible: event-source
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 28 Jan 2024 04:27:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 dc_oe=ChMIs5ewlp__gwMVRCpoCB1wAgzPEAAYACDItJNaQhMIgJ_tlZ__gwMVBAdPCB2TagIA;dc_eps=AHas8cDH6oLeL2OFsiMjTylUaPrJP7vpVJXsdwdXUPdwJ57Mm6z1NzOXoQ6q8s3mVvl2uFywridZ145hQA;met=1;acvw=sv%3D960%26v%3D202401...
ade.googlesyndication.com/ddm/activity/ Frame 236B 42 B
401 B 512ms
99ms Image
image/gif 142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIs5ewlp__gwMVRCpoCB1wAgzPEAAYACDItJNaQhMIgJ_tlZ__gwMVBAdPCB2TagIA;dc_eps=AHas8cDH6oLeL2OFsiMjTylUaPrJP7vpVJXsdwdXUPdwJ57Mm6z1NzOXoQ6q8s3mVvl2uFywridZ145hQA;met=1;acvw=sv%3D960%26v%3D20240117%26cb%3Dout%26e%3D0%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D30122%26vmtime%3D122%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D33554450%26i0%3D33554450%26ic%3D0%26cs%3D33554450%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D536690281%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1706416056640;dc_rfl=%5BURL_SIGNALS%5D;ecn1=1;etm1=0;eid1=11;

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 236B 42 B
64 B 104ms
98ms Image
image/gif 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CbYt8tde1ZcDwNoSOvPIPk9UJwbrf3XLByrOxvBG-gNOFojkQASCA76MvYMmGgIDco8QQoAGNlIeyAcgBBagDAcgDmwSqBK4CT9DN-icphp0z-wY5umw5fbib5wKeEechWDwuRfg360dGlacRimvSK1GqmXSbwdc1tNb7HaDwExdf85KhcBtmfgCqKVt0-87l5UJUt0OSZAyxjsVihyUwtEnE5eXMrbvvZj3fs_uBrvtNB1u4ZcrUDCO6S0N63p1vUjkxxL0jCvJmK3pDNalHQ5Bf8V9wcfv8QPKL7B345YhLhHCgG0EhQjD6X2as6lLjfGf-mqlC3NAbwHQMKyIfwcO1MAvFRZmNo3hG5Pnhh5PIVMVs4gVrbgnhf5bLuBw6eHI3TldNdxae-M3fDiadRnfV2MAtobv7PGxE6-Kk1QKeL2JhCeNZBmrSVcfns6LV5auat-lvI8OS11Tu117pq5C_tE_thtkTbnbW0LZshClu6YuaQonABOOb2synBOAEA4gF8Oy_0UqQBgGgBnaAB9vr-M0CqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiAYRABGB8yAooCOgSAQIBASL39wTpY3OrslZ__gwOACgHICwHgCwGADAGiDAgqBgoErLqxAqoNAlVTsBPyr5IW2BMKiBQC2BQB0BUB-BYBgBcB6BcB&sigh=pRmmDgYti5M&label=part2viewed&ad_mt=123&acvw=sv%3D960%26v%3D20240117%26cb%3Dout%26e%3D0%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D30122%26vmtime%3D122%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D33554450%26i0%3D33554450%26ic%3D0%26cs%3D33554450%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D536690281%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1706416056640

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6124972453453641&output=html&h=280&slotname=3466966124&adk=1993234961&adf=1232222165&pi=t.ma~as.3466966124&w=1000&fwrn=4&fwrnh=100&lmt=1706383639&rafmt=1&format=1000x280&url=https%3A%2F%2Fhd.ekooralive.com%2F&host=ca-host-pub-1556223355139109&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1706416053359&bpp=3&bdt=427&idt=478&shv=r20240122&mjsv=m202401250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6435881236366&frm=20&pv=1&ga_vid=963180348.1706416054&ga_sid=1706416054&ga_hid=972299190&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=300&ady=163&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31080534%2C31080697%2C95322329%2C95320891%2C95321627%2C95322163%2C95323007&oid=2&pvsid=3734680266489063&tmod=1997900759&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=483
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 236B 0
674 B 561ms
146ms Image
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvyn8_YIKQFX528g7IBPhboZ1y7On_gkSAr4xtWogEVJzU35HfdCgw-Jbn2TecUTmMrslnQG-VfC6gws-dKaERo7ffZ-cnxf2vLzI69XWPhK7Dd75hFW7zrE4fZtj_ThlSWi5wGlDYPIf0QPFiBc6S2-h1C3T-1rrewyEGPpUiwzOI9ha7onRGAYINPfzREbD7lfuQzfqXLOKqdxWt5TcnWIKjNREto-Xs90BkAimAdiIe6tll5lZnuyx282mWP7m_80D_O7fXVe40Zqtgxhu3uaJupJu7zt6gUdJVChZGt-H7e-9L7G-qV_uKaT5zbR7K9AFQkFZ254FS5yzuVN6SWDt8c3b4qnGWjf1VYiIq1kof8JZ-LFCrLMscq_5LYsT00Ma-5MMceFI-9Gglz7Sta70FG3Zfuq8Fwsh8NYVvtgrH7fbSC_LKEN-OzOU_ByV3tY39DPMEciNmQWs6pa9wbKrJDciSkL0NA7F5ZFd8l_AVGjraIBt4y5CiynqHz13bfW8POFs-CTcONaO4h02aoorqhKR6cRqpMQ9fWyIVh5QMm0InB43zxmlSXN7zSTcg___euBwzh2rzQKlD4flegWun9CnliZXCgjsq8wt98b2X5kq5MJFWi6Mc5yx8ow3f0IOWOi0WfNs9RkcF_E8Fe3MqHnSH5P7HcC5rzepENRywJ0vzQowoNvKcv24Bnxe4t3qUeVngHfB9YYftI4qeQOS50346OOo3sE_Q6u0VRVO_3GeI-RKjmjW3-217hWxXGFYuSMIa1iGATHIq8p7AjaRtHYe_7-6Dwn9aJdMl1SDQ7uxFjx73pfMXNmHFRHk8DJ48fO8ViQnmKS6Onum9NS2UBrfHmF13Y4jSAGriFF42iNpUOxANO5jaLFxgFHN2tUd3MEoZVMKioyRj1VEhX7vMNizu7Py2v4fx9WPjbCnZVoYzYBvbgY7ceFlUCefQY1whgc9guIYykT-YzBSoZ1RGG4OYxQxemuIYkpfmoqIdU0DKuTi_jf173ZOR4YR00QAOD2wN7C3EHIGB3vFwA7YBbpbOg1LZY9EnpYwpz7tpsoAh0uwwIFZ1L_Dx1pvyVEqzHRLdJYVg7u3KOQlCn2KP3tnqwue0UaRhJwcexuOD44ID-vN3Z8Nu3IDwQfBhuVZ3KGxG5V_cf4L6yzNG_oDzqEbNMBwE9a8HYswcvZ13Bev-UxbFy0i1zg9KZ0tEwlfg-Bk61n9hETAXzjJDTIktObxo6BGbDZl_o9UNQASk9VxZgfDkuEi2erQGPF4MuuMHQkcj8Idqz0Uxjr5pPRfS9LrC7Gc22nnlzISSJcJTkLb0WLFSX7YNE_P9sZy_lphZIEoBoxQWtHxR-XAgAGiOvPF6FxLaEbSk3&sai=AMfl-YQLrV8_Pqyl90T86QnUkx4Av7jynFEbDci3hC-kf1Z6mL7AACpGf3ZBCp8jMgMFBOPAHpNsne5QGC5okIfDGb6-L1xsoEkDJiQC74lImGeUTuNruloEC4toogYofMCluAcXHzJy7BRB9zVp9fNxQqcqDLsoVPUVZSwOcuajZo6n1MZE-m9jZWy5dEFx4ful0lHpd04I5rjM6QlARnyBTk9C8-bkxVZLoc7BFXDs1WtVjOi2l8NpYJITGv5hMteiWaHZU8Ttiq7pF46YFlj5Yl2jT2hIFNOzy3LrzA&sig=Cg0ArKJSzOjthbPKfwC6EAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&adurl=

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 28 Jan 2024 04:27:37 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Sun, 28 Jan 2024 04:27:37 GMT

GET
H2

200

/
a2.adform.net/adfserve/ Frame 236B
Redirect Chain

https://a2.adform.net/adfserve/?bn=62668422;1x1inv=1;srctype=3;ord=[timestamp]
https://a2.adform.net/adfserve/?CC=1&bn=62668422;1x1inv=1;srctype=3;ord=[timestamp]

35 B
510 B

72ms
71ms

Image
image/gif

185.167.164.49
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a2.adform.net/adfserve/?CC=1&bn=62668422;1x1inv=1;srctype=3;ord=[timestamp]

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Server

185.167.164.49 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
content-type: image/gif
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
expires: -1

Redirect headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
content-type: text/html; charset=utf-8
location: https://a2.adform.net/adfserve/?CC=1&bn=62668422;1x1inv=1;srctype=3;ord=[timestamp]
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 236B
Redirect Chain

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJix78MCEIaqqM4CGN623uMBIAEwAQ&v=APEucNX11tJngCCIpqJfFwHPZaR27oY-FpEp-j92U9GLZviZ5MF01IUJDN9V8mq6-ZgWg3wIndngOax8GCdYBzxqrI4PuC4l3tu9FrTPzB2FoYOD4pf...
https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true
https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true&verify=true
https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1ReG5seDVKRTJ1RXZaWU52bWNBQWh0SDBsenFJRVRyOX5B

170 B
188 B

79ms
78ms

Image
image/png

142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1ReG5seDVKRTJ1RXZaWU52bWNBQWh0SDBsenFJRVRyOX5B

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1ReG5seDVKRTJ1RXZaWU52bWNBQWh0SDBsenFJRVRyOX5B
date: Sun, 28 Jan 2024 04:27:37 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 236B 0
20 B 111ms
106ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=video_impression_ping

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 236B 42 B
64 B 122ms
116ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssjD_eeee8CNCmmDgpmm0DQivY_VS6kuh6S7NRvuTyiqbHSCwbOP-naTiA2UA82-LIg6Gj25VSHhMHc2RaH44ODQQrY2Yoa7OsuWBa7HUxxcIHNbczOkSIMCNNW-t7e-xdiWbt5JkOiBvMB2-k_ypbPFr3f&sai=AMfl-YSIsCvptvWLk63b0PmPnumM-yrd9p7Z0tSsc1OJHRz_5bhrzmTUgeFKWMn7QNH_MiASzZrUh8HDjgiPv7JyMwLafg_p9-DshRdPeug0qRyCjm-HslgQEI0OKqpO71mKPF_qtZwSIw7jVAbF4iYV&sig=Cg0ArKJSzPkjgvCCvGc1EAE&cid=CAQSTgAvHhf_0pL8s0gREVezxEQ3L9z3SZy0_x3IYc-iu_vz2ft-359aJzPzGfEPbxpC82uLmZIbHWQ3Y6kSXFlH1cWLuvRQeN7KxjEhn8ZKmxgB&id=lidarv&acvw=sv%3D960%26v%3D20240117%26cb%3Dout%26e%3D15%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D30122%26vmtime%3D122%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D33554450%26ic%3D33554450%26cs%3D33554450%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D536690281%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1706416056640&avm=1

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 236B 42 B
64 B 103ms
98ms Image
image/gif 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CbYt8tde1ZcDwNoSOvPIPk9UJwbrf3XLByrOxvBG-gNOFojkQASCA76MvYMmGgIDco8QQoAGNlIeyAcgBBagDAcgDmwSqBK4CT9DN-icphp0z-wY5umw5fbib5wKeEechWDwuRfg360dGlacRimvSK1GqmXSbwdc1tNb7HaDwExdf85KhcBtmfgCqKVt0-87l5UJUt0OSZAyxjsVihyUwtEnE5eXMrbvvZj3fs_uBrvtNB1u4ZcrUDCO6S0N63p1vUjkxxL0jCvJmK3pDNalHQ5Bf8V9wcfv8QPKL7B345YhLhHCgG0EhQjD6X2as6lLjfGf-mqlC3NAbwHQMKyIfwcO1MAvFRZmNo3hG5Pnhh5PIVMVs4gVrbgnhf5bLuBw6eHI3TldNdxae-M3fDiadRnfV2MAtobv7PGxE6-Kk1QKeL2JhCeNZBmrSVcfns6LV5auat-lvI8OS11Tu117pq5C_tE_thtkTbnbW0LZshClu6YuaQonABOOb2synBOAEA4gF8Oy_0UqQBgGgBnaAB9vr-M0CqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiAYRABGB8yAooCOgSAQIBASL39wTpY3OrslZ__gwOACgHICwHgCwGADAGiDAgqBgoErLqxAqoNAlVTsBPyr5IW2BMKiBQC2BQB0BUB-BYBgBcB6BcB&sigh=pRmmDgYti5M&label=vast_creativeview&ad_mt=123&acvw=sv%3D960%26v%3D20240117%26cb%3Dout%26e%3D19%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26at%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D30122%26vmtime%3D122%26is%3D33554450%26i0%3D33554450%26cs%3D33554450%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D536690281%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26ss%3D0%26t%3D1706416056640

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6124972453453641&output=html&h=280&slotname=3466966124&adk=1993234961&adf=1232222165&pi=t.ma~as.3466966124&w=1000&fwrn=4&fwrnh=100&lmt=1706383639&rafmt=1&format=1000x280&url=https%3A%2F%2Fhd.ekooralive.com%2F&host=ca-host-pub-1556223355139109&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1706416053359&bpp=3&bdt=427&idt=478&shv=r20240122&mjsv=m202401250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6435881236366&frm=20&pv=1&ga_vid=963180348.1706416054&ga_sid=1706416054&ga_hid=972299190&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=300&ady=163&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31080534%2C31080697%2C95322329%2C95320891%2C95321627%2C95322163%2C95323007&oid=2&pvsid=3734680266489063&tmod=1997900759&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=483
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 236B 0
54 B 409ms
401ms Ping
image/gif 2404:6800:4006:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=5~lrx026uq&c=2741704149614&slotId=1370852074807&qqid=CICf7ZWf_4MDFQQHTwgdk2oCAA&fb=outstream-lima&gpm_i=9&gpm_c=9&gpm_a=9&smb=Infinity&br=1943&mt=video%2Fmp4&vs=1280x720&dm=30000&ple=0&umsem=0&event_name=first_play&asset_bytes=199993&video_bytes=300&cached_data_bytes=0&js_cached=false&css_cached=false&num_assets=10&num_assets_cached=0&num_assets_cache_validated=0&num_assets_unmeasurable=0&video_played_seconds=0.00&video_muted=true&video_seconds_loaded=0.00&met.4=vil.25o~ff.263~videopreviewstarted.265
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4006:814::2003 Sydney, Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:36 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 90D4 0
20 B 102ms
101ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.0.0.0&bgai=BIDkOtte1ZbPkPMTUoPMP8ISw-AwAAAAAOAHgBAI&bg=!XV6lXhHNAAa8BdJLnAU7ADQBe5WfOLbw88GHGoq_FocGQWubcnl-Lxw3r0v2q24UwylHQSAE47t1d8kMtv73kwBVKLOoAgAAAt5SAAAABGgBB5kC7BjLFKF-LZsLpFnJ5uEoEkpy_7cyLQjtup6kAsJgb6oEGcShEWu16sUyebQBAcsTiA9YifQfWE33sqHQHrCvfxBaORmRER21nMdH1w8P3yYMJGwAnabsjAV2hDOUcW_5LZwCIngrBjV5RgWbIIRTYkNqhZfxiRgq9lbvzQiavvAgKCLWXM2tPxMQIoqhW-3bjgaJ_Vc41fpvOwANfZ1kBThBbz1Fx8kMBEziEGvEJ-DiBHe6SzWpXvEBvv9nkoyI4R1e0BBGNVZDF4QEZcx4M2MP9wHaxxUOAUG9vjXkTQ8J3sqx4SNFneu3lDDU_McMUOepQbLko0xtYaj8B9_pLVWqydLdX75J6_QzwHLfpQTs_OOaYbU3TbNQv5m8GfrvKeXrFKZPmgiaFEDWfcTrIs44NqNf4_-BJAYhjFJNGRhxaNhN1k6VhYe2CE4j-XNvpcMAeWoA8O70vXI3mkVXTA7WN5QdpQcEdoOReXS62Jt5ipL8uRIiqWfaGUCZVIghZuDVOsX3V2N5VLxKOwT069_2pWdiY1LQUfAR6AL7_tD8wdnaiqZN6x__Pp8cPAIUXTuEIFDyaF0l02dw1O5KcIRPWbfy3Ta7W3BLluneg6Dkp-DrjELulL-I_L_9UCwbkn4G-Y3qZhgsA2T9EzDAmpBgsMcAbHBZNUlWDxlWQWp6sTVReTHcRnnNd18DT-Tyc-u3LDbBjVNsasnYga5s7OIZxFmxojb4YpgI6nErK-kBq6QJVhsDpTiIPz9-mfCj-EwL_uUV1S4n9rdAQOjEmYUzGGSy9TIT-jfDXBfcozdJn2f_fZZ_twzftIEnnLlwzfF5ADv0qMy8_JN7yJq3tupDIR3uTj17pdfqb_oyKJKwVs_p8-MPZZ_pUdfLwYrnQ0lHH9XxG5gGu_ngCCohmXfjKQehoxFfgSYb-JWB-FetosuFPieSDbbe9hXaaDMcfSnWZ6Cs1SU6k9EcjglACYMV5n49QT0oShF5slk

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Gotham-Medium.otf
s0.2mdn.net/sadbundle/11938805746972946677/ Frame A89C 126 KB
59 KB 73ms
72ms Font
font/otf 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11938805746972946677/Gotham-Medium.otf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11938805746972946677/index.html?e=69&leftOffset=0&topOffset=0&c=WebmI0wejj&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8183507b37f3df80ea253b144745ed58784f5b4465b5216fbf9e314df592d06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/11938805746972946677/index.html?e=69&leftOffset=0&topOffset=0&c=WebmI0wejj&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 06:10:13 GMT
date: Fri, 26 Jan 2024 06:10:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 166643
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60432
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:14 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/otf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 Gotham-Bold.otf
s0.2mdn.net/sadbundle/11938805746972946677/ Frame A89C 154 KB
69 KB 82ms
80ms Font
font/otf 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11938805746972946677/Gotham-Bold.otf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11938805746972946677/index.html?e=69&leftOffset=0&topOffset=0&c=WebmI0wejj&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

183be4309aa229c11d790bb79b82a6a181a3f76cd009635a145a9d65c9c80766

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/11938805746972946677/index.html?e=69&leftOffset=0&topOffset=0&c=WebmI0wejj&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 06:14:59 GMT
date: Fri, 26 Jan 2024 06:14:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 166357
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 70565
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:14 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/otf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2D28 0
20 B 99ms
98ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.0.0.0&bgai=BDHVYtte1ZY3cPPnZoPMPkJGFqAwAAAAAOAHgBAI&bg=!tLelt_jNAAa8BdJLnAU7ADQBe5WfOKWIEo43JLGn3smpNtJpuhIbH6A-LJ59HdM6EnjMuFu5AvwbdoW-Lvgmynpk1G6dAgAAApVSAAAAA2gBBwoAeL43jUNSNQgr_nwXSGlvWGnCFJghqwZYaQFBwvPiXLHIhe9ntkKO6Xj1uFQVbx7thz2dhhox2l87ouLKevSwgxtjSRHkQS8I_HrQO61L0F7ZAVQ89JnPggr8ULk_9yWSpe4iIl0kkNDtQ2hVy9mc7zEAOj8ihiq_PZkC5OdGEdBxd6RhsSq0e37GgSiFciyyW2mLWmtMs5HcwGjoDCMi5QtTcdgRhoLrPKV5RI4LC6EQZfXuu9WW4d7aE5bZ1CKAIPBFw6ioBlbPbwunby-nkj-m3Nha-2tm1rJonSW_ijy8uaOwHE-VnhBjWfK-76hGY0wcVbI8AnIIEbDQndKsI2AYdYXHFoC_3RI24wT2mMGvtQrfbCc4ppfc8afjFACY44WULZNo2tHYe-jT9BBInfhKDnUQN5ZWAjIsi4z0GXGjOquuPUE4N2paxRC5unUJMSku5mzg1ReIRafoKqktnZTxShLolu7P1GTarMkTiauODHrVAZLvAu1uWngAQB1wqNo3-s8eD6tzUlTUsl5YR424vvOaVi3T4Wjf_E6ax02BEONwkLz-098dWDnayeDw_92n0tKka4PXAlBiy8by04U7fkbHa3Q_wqJ8fxBw72UyUBdpJcXepnk2FCw6vdDPuXrSM_Qb2u0v1duqWSeUpDEZXvHnO_H2O8AmOwjoZF_3AQL2lv77nPeh-9bKcgZPbECQYO1gtBmBCEwTabQPEqWPKCat2VnCsyV1l-f9pCevJJgJ__JbomHgq2gt2WFesdh-9SaNwuRUEnRfZ59nGOLdD9tnj3vKREcJBfGt8yUoimuFKQA2bx_ZPhi1T8kp1CE878sjGiODVH0WD8fs-VCBvIdBCTfblro3oYMtQTa4YTqwOQBQg1d_Bv0Af3Hk0aYhnsK_c60WeEAeqiIfGur8ZPCP7ML3ElY9L3uXypRrXi7ORV1VcnPNJ6QrqMAYlT5-w8SMVlI_ljg4vVVsM_UFHSc2M4jr0lByFtV79S-H9reDphRGup40KHRbJv9BubTMnCMGmKcOsiScw5wU5LGLk4TrFCpVGRyCRuav1bStOpibOsKG1DBdq6Tp9QQF7nRgYKHYOOPCuPgOl94-ItgRGnvPI7B6lZ8GMrIUsyiWMRP4KUAQlTG4PecqPapE

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 getbanandfile Show response
fundingchoicesmessages.google.com/f/AGSKWxW2RuVYD1AwnRRNcVTNsDHtSOewpMYsOsbEGYNl4lo31kQoqPjkN7k9m1vOkEVtuktId0xazMlfPEt_5SabrGTsokCZYrXKxrkMbyEhzKV1cCr-Wldjmonk0dxmIlwSfwi3zlcHS2tFm7lpPBtMxXyKZFrxW... 54 B
110 B 90ms
89ms Script
application/javascript 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxW2RuVYD1AwnRRNcVTNsDHtSOewpMYsOsbEGYNl4lo31kQoqPjkN7k9m1vOkEVtuktId0xazMlfPEt_5SabrGTsokCZYrXKxrkMbyEhzKV1cCr-Wldjmonk0dxmIlwSfwi3zlcHS2tFm7lpPBtMxXyKZFrxWEWur_FJjfUzqDZVYwYgFL-8kImbDxj4/_/ggadsense./ad/getbanandfile?/tribalad./adzoneright./intelliad.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.YtkvUvr0KhI.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMxPEIo90jKXuFkWlMpFtfc2vWS8gA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c80085af986d3e67a692d88192fc1327211e99e7f15e91eb2b6380ae2cad3e6a

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-bfrNyB1TUNLDtGbMBNl-rA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://hd.ekooralive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 28 Jan 2024 04:27:36 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-bfrNyB1TUNLDtGbMBNl-rA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjOsOoxSXF4KEhxXDe6Q7TdSC-qPKU6SYQ1zI8Y2oF4gfhz5heALGBxnMmCyAuyH7OVAHEjH9eMHECcU__S6YpQPzuy0smnq8vmSSAWAOI30m-YvoGxDt8PFjehE9n5YqYznq6YDrrZSBmq5jOygfEcXXTWfOAmG_ddFbd9dNZt5yZzroHiGOeT2dNAeLFrDNYVwPxlMAZrHOAuCUayAZip_QZrEFA_DlzButvIC67fY61DoiFeDh2rL--lk1gx_OT25kBq9Fc4w"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 osd.js Show response
pagead2.googlesyndication.com/pagead/ 61 B
76 B 65ms
64ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/osd.js?fcd=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c45c8b81ccfcbc08127b74787d1b5974078756233de947986c357e28ed8f13ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://hd.ekooralive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 28 Jan 2024 03:49:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2257
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51
x-xss-protection: 0
server: cafe
etag: 16023549773543154165
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Sun, 28 Jan 2024 04:49:59 GMT

POST
H3 204 AGSKWxX7Q8lAG-LZM7HV1dt7P1nz2hk1OHrK8Q9gQBz93sSI3h4FdSQqh9M6w50SE6M8iSKBee8y5EK42JDpyJTzj88wC_erpI2gLPy0EwNGIsExKRSbRwiGtYHtfuYnlgLCFfKeCkkmTA== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 217ms
89ms XHR
text/html 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX7Q8lAG-LZM7HV1dt7P1nz2hk1OHrK8Q9gQBz93sSI3h4FdSQqh9M6w50SE6M8iSKBee8y5EK42JDpyJTzj88wC_erpI2gLPy0EwNGIsExKRSbRwiGtYHtfuYnlgLCFfKeCkkmTA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-8mJ3ue2JtopVrhLhPGNtrw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hd.ekooralive.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 28 Jan 2024 04:27:37 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-8mJ3ue2JtopVrhLhPGNtrw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctHikmII0pBiqGV4xtQKxAXZz5kqgJjxzwsmTiB-J_mK6RsQ7_DxYJkSOIN1DhA7pc9gDQHistvnWOuAWIibY-f662vZBDZ8b5ICAM7WIAs"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://hd.ekooralive.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 2404 0
0 98ms
97ms Fetch
image/gif 142.251.41.6
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjstKadlM9E9XSixRsdTelSxtfXMELQyqOOhHyXE3jmxv_Xzgl7Z1xGvQzlnORpIkoTlr8i20BFEBBcmB1v0b5FIRHugP8nld2sgWThByhI-XIicBVGBZ5mJScUbsjow8WbslUIVicPVbdRAsmvew5BPHG18hguGXI37_z1Y7Huud1BCHzal_pHNvGP9j_cdq9ZTAM1HAooP2LIHoPuNAfnJIQBXiy4sz5YJ0W-wB7k_iyEa_pOmFTxvUkWd3amzP0iz8I30iGPTH9-O0j6jFl_pgYkhMKY_KLZOwT2JeQy-PbPffreJmYENgaJ69_PjST97nKyOlDhZnHIY3MiK8gK0iPrnXhd-U1487HmbVGpbZDoGAh8-qK6bKPRYKIpCW7DPq66pj-eounX2rDThqpjlppROt8ycMvEq6EUkrGG38FEo2D_nR3WU6gOSE7VMvAd4xbL_mm2WRTZnyMJvBCn47OEywKWV6HI6f4DmO8DCfnKslJRPs5qtJ8cxUztq2ZiNHhEkRywpSiM6_o3MRSaH19R3wctTsSb4yPTvXgqruxFUAz_RZqTkN5r-Uax9Exreus1beVC2yLGuNt9v-sO-yYRw4G5K6p3-ZHunWQmgvK9AHVFOc-FOJLN1nrOmeOMvCrT113nitE9XxAyMkj2QhHiDFXMoKkamJ83LHwEm7pxJSisviyeDZZw0gvjiigKUxyISRZT4sMXGr7bCckxX-TKFijraRtuntm2BuaxG6JrTfOzP1wFPYr0zDL1CpG6Ngiyw_ZONAPTiFNxL1NaRjk3vTmoKcPErV0IGBe6Cc-Td_hxssVoD50uNKP3-7CTBKtnZT_so7e2E2j4hXRiwwGx2-SisVNXpqAAX0AtbpDptGWK8a1fTyi2Xe__v8ANK5DP9H28gGnTg4cGQjuq6GGbrW0lp1FryjYKvV6RXRrNdIy_gCG9rDzI35WY8563K_iPMriiWVpfartCjrKoqczUjBhEzEV3GThBoGZSLrwdBr6M6ERQYAXBCOFPmgD37g5pyYJnOk2h8O6-PhLUcv7-ZRXMZHMHUOJPTKt5Begis_lx7kv0ZoKfd59E6EFpGit-O5LBF-ezaMkP55Rypd8wx9jIIorHzzyYj9auGHsM1WW5iJe7mnCN_eDxi5HHNgDcsLKMWbpbrSOur_TmTslEunAs31yHfosj-5YKvHh1qorSZIhkNp-V7l8akj1ifSLHuP9K1nimg_TsB77IFU92O3iAiFT56-HhUk9YLwXryzZh7sK-w5sr1KL_obYujDLeB550NmjOmVvvTCT3Qk-mCetcEY5CQKLitA46ouftwpdLVtURQG6c5QquqVNFYGIlo92b_g-DKt9ZQCXMV2gStq4lyFN0MhZSW_9kv-1UOkUbuMxsl4uon75cxoFM60nBQ4-8jEmN9DvKsqkAMp-RMCG8fEILLJ2ZOOAfUyv9IJTIbFjg&sai=AMfl-YSiDvTO6_gKeyaYcZK8jOGoc3BiTvFR7ideE9qIkrI9HL6y08XykKq5f71eaAhDubo6qB4kepOIfUJBDKtzEAHK0xvKynaXTYpxghxPxi0wEB7nD66WidVkWa3dwR3ll-BPB056V3yucGYvPpq0CHRbToJcp8qNxDozze4eHBNfgULiS6AFA9pn8rUalIN22pgI4sSIKnFjg9iRsxzO2ogSvh-z-hgJzgbPpsZKZzsiwM6W6JHOkfwpggmRhSgDhJN7whpfzb3EdbED-4P6LydibG4qFuuxPRYIWefK_KTy_WC-V5fTnKTOpLyBdQ4D0fPaEWcjr50k7I4XGWZv2RiTS8VDVnGxmca0wIe6Cwu_CAe9Ksihzr5Jr0BCsBqfEzHl2q618B72JIGszrPZq-6OUL_AkJnYs_uc8vWxp4USc0WeukcWXfzxqPtjJbVwb9QCqn0iaHbzNamgM_HMEE-ARdttrck_fB56R4WZ2nq5LLKXgGAClBX3dXz-76Lf12YtjBs&sig=Cg0ArKJSzHOo_S-S0LfKEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9iYWhpYS1wcmluY2lwZS5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1407&vt=11&dtpt=802&dett=3&cstd=596&cisv=r20240122.53732&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 28 Jan 2024 04:27:36 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 28 Jan 2024 04:27:36 GMT

GET
H2 200 atp
neural40.cdnwebcloud.com/ Frame CFE9 74 B
323 B 463ms
143ms Image
image/png 34.255.125.46
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://neural40.cdnwebcloud.com/atp?271444145193=&n_o_aut_tc=275849625&nonhm=true&gdpr_consent=CMP_NOT_FOUND
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240122/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.255.125.46 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-255-125-46.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 01b58ddb2f86a768f91751b62f25395417f6cf526191a4aefc1ebe4f8beacdcb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sun, 28 Jan 2024 04:27:37 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 74
content-type: image/png

GET
H2 200 atp
neural40.cdnwebcloud.com/ Frame D8C6 74 B
323 B 461ms
142ms Image
image/png 34.255.125.46
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://neural40.cdnwebcloud.com/atp?1038606078535=&n_o_aut_tc=275490374&nonhm=true&gdpr_consent=CMP_NOT_FOUND
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240122/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.255.125.46 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-255-125-46.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 01b58ddb2f86a768f91751b62f25395417f6cf526191a4aefc1ebe4f8beacdcb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sun, 28 Jan 2024 04:27:37 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 74
content-type: image/png

GET
H2 200 atp
neural40.cdnwebcloud.com/ Frame 2404 74 B
323 B 452ms
141ms Image
image/png 34.255.125.46
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://neural40.cdnwebcloud.com/atp?815443707049=&n_o_aut_tc=275849625&nonhm=true&gdpr_consent=CMP_NOT_FOUND
Requested by: Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.255.125.46 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-255-125-46.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 01b58ddb2f86a768f91751b62f25395417f6cf526191a4aefc1ebe4f8beacdcb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sun, 28 Jan 2024 04:27:37 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 74
content-type: image/png

GET
DATA 200
OK truncated
/ Frame 2404 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7139c2907c7a47a4b567a0b4e4a73df6fa3fdc9e7259b6f592851ea6195cac92

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Gotham-Bold.otf
s0.2mdn.net/sadbundle/9845278200317499338/ Frame C9B0 154 KB
69 KB 68ms
67ms Font
font/otf 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9845278200317499338/Gotham-Bold.otf

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

183be4309aa229c11d790bb79b82a6a181a3f76cd009635a145a9d65c9c80766

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=UuoD9x2i0q&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 05:54:35 GMT
date: Fri, 26 Jan 2024 05:54:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 167581
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 70565
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/otf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 Gotham-Medium.otf
s0.2mdn.net/sadbundle/9845278200317499338/ Frame C9B0 126 KB
59 KB 72ms
71ms Font
font/otf 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9845278200317499338/Gotham-Medium.otf

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8183507b37f3df80ea253b144745ed58784f5b4465b5216fbf9e314df592d06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=UuoD9x2i0q&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 05:58:45 GMT
date: Fri, 26 Jan 2024 05:58:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 167331
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60432
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/otf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame D8C6 0
0 101ms
100ms Fetch
image/gif 142.251.41.6
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssa4H_cy0Gh-G-TwHKZIdfBSM-k84Mua1KcB20qc2sB7Jgk6jD5A2k52dzTqVzmAbD_aPj1RLbmajXDxoa9ObXbUtfW7mw7EUjnt00Zz6kr0Xv-kN3oHOTL3lXyjkKfL_QsZ4eIkhczWSnDR5G-4yndWEof5_-rb1TjsEhZGxHI0Y1cjMgc63kOga3OtgWK5C4UBqcexyaGguPcuh_un4cvxrmPam7FqJ1KQH3dR3L9sn1tCxzqH6JnyK8kX7jsJa6rxdz68hUftmZJnr44VCrLiMsFf103VroNQvdjwX70LJntOn84eIwjSv-xRFKOcPPj47OYjez80WwAfxRQ-aDOSLX2Xkr5Eo4QudCPgm_TnulGJL_DYW0g8zjOc9VuerpCzBvCmkw8BLYdyvErbe2xBY6pkjvJc4I2hSYxIGCFLxn9ldfOXD3ABKFwhr_v81oN7I05OLFKFgpWarTxI6PZ6ZXyAx0pXUlcdmL-CeENdA0Hdhjsc70o85VU9VJ3zvmH-gJa9fyPiTPTyDb_R62A85ZjEG-rWlYQXlMr6GIq7594ajNcUHzTwUQYACPRGqCCgyEpqAsROqIPSiTvY7GmXJF4YPqpZjbSMRbWH9DqXLfrY4pRZqPMccWFfAqZwlO1S4Xgrc_Div242sV22AGACpzTiP1l7j-x6r1uw3Bgo5ikqbYyK_8xLw22GEM4du7__YV1S3s9BZabH1KHcJkaB-DY8SqLFLUk6oCdlsj7bbL35v8UpaivsoToHBA8uoJQhUBywdaY1oVUueGaluxvlfo5eq1owF7Y8ch-Vo4YwDKR-MI6dXqlHhWNu3Z7ugiyMUqqoZ7rohD2Cgdwo_OAlPjtlUUVVwCqRb8pyMtsdsIuM4hcL7q8WV5Vsxr-7L5hrFSvQZpk8wLyv5cgAIWu-b1QNOAKAxA0AfYmikzA0B82TfMw7xNi8q9YI6h3bOgnY7MZ0_RQkNYunKSqfQWHstVCqSTZr7hmTiwXP-vCse4PsPYxINgkzyfUG1pvKR2zEPjjtFz1HfNdZBCR9J8m1JScbklkeI0Lnvvv4Rdzh92cmBFRyVu3pUzKHWLd5mIUvK0SuzZozYXHbi-J8S57s2f30y2xJ_qKCCsuFmN69w8vAJouCU5eZNrgmv2CpjiHv_p7v4ZRo3ndOJWWZjia8JnbW42FaW-XKt9v0In9PoK9lYWYPwlYY72XNg93LY5IRoqu8g37ND3qeqQhDJ4bGUDMbz7RADZPgv6e2QpJYbSeN2Zwk-vcjGJ8Iahk7gO5asCMORGbt7EZ8WVyY3yqUzA05ywSRIDGIwR1J6eJZ51v30oVI1EQGWXYEkJhhvYGuNgXzIgvqxOApRaRRgA0-a6NDKrWND66ySmU68a3aAV_FfLAIKwNtMB_4y2j9NADN0SmhvrxZBsJP-tUszjWn3kjCsYlIutR1kn9kMb8RZ9qDSPLYUrm&sai=AMfl-YQf3oT8GbJKMZ-UXRsr4CfI2vBcXqwVMR_tzMN_HueNUDDoDR5T879sMV5S1yx0beK3TbCXdg1-Kbtw8wv2zva71nb6zFXsdoIt-ejTrJ6LzH9N9Jq-BCKyjH__lUOWPxefvFINwviYPgNzbgdndU5c57KTs6PP54u31NfBwZpO22JScTLqVKgQuFW_2fSvCfISrIqkTTBhkkbzqKDF459df3gt-7-LOLovO8BCsL9aYqN4EbJgLigGgZyYEZz3GXE4fF4zYKusZPbHKSFioQpvuDRrT6LoKm_qHxALowf_Dz0jlTW1Rl9Sg0M4VC2TgrFfnf1D2uefdKr5zfIDxf2ebEbd0VQ0EtpFD88uTLkkFgtAqoIszaeDOZ58Lc6bF2nI-dr23Bes7JtCB0fXrm4FUL3_1DJPcCbPIYXrCvQgZc0QRFJrXWiNOnhYSYwj2jFpgeyZViNNuguPki9SRabas1cns3ce8nsWReM4c5l1um3yIrVfmwRsucV0XWeyQ6uLf-k&sig=Cg0ArKJSzPjmqIvZiC6YEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9iYWhpYS1wcmluY2lwZS5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1411&vt=11&dtpt=894&dett=3&cstd=507&cisv=r20240122.45268&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 28 Jan 2024 04:27:37 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame A89C 8 KB
6 KB 89ms
88ms XHR
application/json 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

998660fa21118a4d0930faeed04ddb44c9a4f84eb8ffc471f75fd3914120c4f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 28 Jan 2024 04:27:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5831
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame CFE9 0
0 103ms
102ms Fetch
image/gif 142.251.41.6
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjss-IbZUX87NXm52MX3kMJOkzEryMVK1Nu-cVs4wzkJfBF_7rKeE0QrpOeoBqy75Q9tFVqMLiXkMrJaHvlMHZZAZtGhEUI_ioEc5VZy0VqaDxE6CWUKW_vwG3AYCfPlwpB5JkH-HGLP6en2XYFDE92IMuvkbNEL_8ZjaxDheLPGI9JbGPjuL6uCin_KrAigEwAoywBHzjhsqSo8nmW-7pGbw60SDxnfqleSEEF3VRcktee89DWOFoUVvGLISeBS27F58xErJK9p8t1o-iK3Vie4Oy2AUqjAPIymjg7Vhu3k7KSkqFeRrAyc_xk-bi2c6ssXu3lZPG2V3Sd1xjIvSe-iaDOqt1TDtREZFFEDp0vGtLaSxqgfI2lgG9rnQUOjcgvTqjjSW1dal8mV0N72xF1nawNlvDZzXPE6SzyB4nyHMttXQLwZj6OzNTZzbar5efMrodiwuILZwT9m37KADPAu7xEN6ITbSSJ2rExQEZVoWf0grW_sffJFCK-wWt2Fankie9xdrrKwW1FTSul-diB9NGiO4cmYh_f4k5XFgQr3TN8g2Mv2IWZOnBbhBrydwOYn6uxtOSvacnygEZRQfth-h2Gd4IXyXlPL7fIfOzs6NxArw-p0INLvm-YB6ElkJ2diG54yAgwZDdMnwoT7BWqDowrQ2SMLpKKlyNzU01-t-bNU-wVzIWm5NsnlmUmLN0A03dW7mMsIIu84_ERaf3CeR84i3wwSnIO6iOtImzfiqS6FN1us0J2oYhh8PzPSoe2T5tUGUqRiv2sXSBxo5TMmoMyhSITw5h2c6wIB-I7JK31YmDw5HoMgIwKJrGGHF5Kxo1ZNqkxtRfZMzwxWL8v1MvrOwfD8EHM0iAVnrOFKWmrKtUZ5heQL8tN4ibf4X7kNaVqxlrtu48G57z7gf9tsqHTfT5r0QNDMZAvdG1_JsymAswJTdp925Jj0XGodCEedodKKzYHnoKoo20iYqYoPKcD7KqySUsk_QdJ0b1o7tsOzUJIneppAviG3G2hidTQBCThI7jfZbqooTgJSSSE0RFQGL4vVFXBgBchVyskFjwT052ujWnGjblJdQp5KHrWguDD-g3Sazw1cfnBhz9Gn4p7n75tJUUc5doeCS5b3vf4nkPfAovrxneOB0UaZDTQnkAjLhZc82Z2VjOpUtOCEsDJxrlE-tDY2LodAsi18QRW7GbsqZbBpKX8CSP2RGI2MbBSMcvqALzrD6VD8yvSrtQsqRd46szQcDtjjP0Ubn8xywEx6AaAIlcvk-4413q4LjXbE35vgd0-_7GTTxZwOHFMV2wQ-TUb2FefrU7VOWK0_22_USGBo2qNPdtyqZve1ikDBeIHd9ysxriNfswPI7qguFi_NCH1EkrvgehBJYGdyylMPK8L5Ua83KRVXvpMZSTuJz7vfxKjpXGiBZAE1DLpt2KxsMgJG67s3akGv_py0Srsqjvw&sai=AMfl-YR0HmDSqCzN6QMmnUyX-jd20xg966DbuIGav-ctW-s-VKs_hkJNa3jcVNR6r4qqzGAD9Zy0IRT6t0zOob4XnRXBRJkyfZ7Qc-UBBWPzDGt0Yq8taozF7dcIejHkqGT6L5xvypu7RWZ0GOfGpFRDiwf3xa9ghIKGytjlsEUAuUrlEJrW-oDNoBN8tMc6Gyar2GtC9rlKnPTxPCzgl6Jsq2WduLNaqij8zPmxfcVX_3HUXE5h4gi6ZU2HgOh108oVKsQ9EEaLDj6c-VW1Vf2WSPulGRre5rTn_GHjGVmBKVTAdrJvwD11glEq5dHg2sfNrTFOfijBcChlHgWe70Gvg-phY13EvVSZyIFVkS35OcC1XXHCRONM6-mxw9vjbbKK1TEo9hWWBJA7HmMvcA8RkJDkcXH2yhZ-WbPE4gOvordhG_Qkdfv8HdljR6sk_JJ1ntKO-lyc6bx1UV4gkDOBvvm-492aLx9BqC6c0K0yKLwMhlOmuYdQtRpGwNOuOI-nYaSvVso&sig=Cg0ArKJSzIa1xpRAAQqsEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9iYWhpYS1wcmluY2lwZS5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1594&vt=11&dtpt=953&dett=3&cstd=624&cisv=r20240122.42275&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 28 Jan 2024 04:27:37 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame C9B0 8 KB
6 KB 91ms
91ms XHR
application/json 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

40e5d63036f7a7593ef397fafc51d04ddaff860636075bf907d1f27be85887eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 28 Jan 2024 04:27:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5964
x-xss-protection: 0

GET
H2 200 avw
neural40.cdnwebcloud.com/ Frame D8C6 0
105 B 380ms
141ms Image
text/plain 34.255.125.46
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://neural40.cdnwebcloud.com/avw?952203187613&n_o_aut_tc=275490374
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240122/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.255.125.46 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-255-125-46.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sun, 28 Jan 2024 04:27:37 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame D492 8 KB
6 KB 113ms
112ms XHR
application/json 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c408ac51f598f6701609fbec8a2dabf0620fab603494cbceb2a8a0685b93e127

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 28 Jan 2024 04:27:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5852
x-xss-protection: 0

GET
H3 200 texto_logo.svg
s0.2mdn.net/sadbundle/9845278200317499338/ Frame C9B0 5 KB
2 KB 68ms
67ms Image
image/svg+xml 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9845278200317499338/texto_logo.svg

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbbd6285bb18a8c92cc59574c958877754850f795f0f4dad205c79fd21d1d467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=UuoD9x2i0q&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 05:53:17 GMT
date: Fri, 26 Jan 2024 05:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 167660
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2125
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 sol_logo.svg
s0.2mdn.net/sadbundle/9845278200317499338/ Frame C9B0 2 KB
1 KB 67ms
66ms Image
image/svg+xml 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9845278200317499338/sol_logo.svg

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08bb8bf8ea037474da111ae1a70781e3210f7a0b29ac2f61cc5e88a3e37b920d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=UuoD9x2i0q&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 06:03:52 GMT
date: Fri, 26 Jan 2024 06:03:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 167025
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1118
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 PALM.svg
s0.2mdn.net/sadbundle/9845278200317499338/ Frame C9B0 3 KB
2 KB 81ms
80ms Image
image/svg+xml 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9845278200317499338/PALM.svg

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

afcd6ebf6cf7124e138218f69982d6c9ca1820345967c9263d243dbf5631d204

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=UuoD9x2i0q&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 05:53:17 GMT
date: Fri, 26 Jan 2024 05:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 167660
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1519
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 palmera2.png
s0.2mdn.net/sadbundle/9845278200317499338/ Frame C9B0 960 KB
961 KB 74ms
73ms Image
image/png 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9845278200317499338/palmera2.png

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

73f6add564f8d8c794d4b1bd49749c1770990b44616591ea59ce7333cf05a574

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=UuoD9x2i0q&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 05:55:31 GMT
date: Fri, 26 Jan 2024 05:55:31 GMT
x-content-type-options: nosniff
age: 167526
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 983441
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:03 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 palmera.png
s0.2mdn.net/sadbundle/9845278200317499338/ Frame C9B0 941 KB
941 KB 69ms
68ms Image
image/png 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9845278200317499338/palmera.png

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

22e99768051bfffd5038e9ead749c8beab5ed5f1042a82eaa188096b2c63d4a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=UuoD9x2i0q&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 06:06:15 GMT
date: Fri, 26 Jan 2024 06:06:15 GMT
x-content-type-options: nosniff
age: 166882
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 963679
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:03 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 wintersale.jpg_1696585962342_wintersale.jpg
s0.2mdn.net/dynamic/2/10889189/s0.2mdn.net/creatives/assets/4372216/ Frame C9B0 109 KB
109 KB 77ms
76ms Image
image/jpeg 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10889189/s0.2mdn.net/creatives/assets/4372216/wintersale.jpg_1696585962342_wintersale.jpg

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be3291eb66d4513d5b162742f39c532cec84790122d5ff978db50ff2d7fc1525

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=UuoD9x2i0q&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 06:02:49 GMT
x-content-type-options: nosniff
age: 167088
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111199
x-xss-protection: 0
last-modified: Fri, 06 Oct 2023 09:52:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Jan 2025 06:02:49 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame A89C 17 KB
6 KB 88ms
88ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 28 Jan 2024 04:27:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 28 Jan 2024 04:27:37 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A3F0 0
20 B 103ms
102ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BWSxhtde1ZfeiOJWh_tMPwIWzuA8AAAAAOAHgBAI&bg=!z8ylzIPNAAa8BdJLnAU7ADQBe5WfOFYAOmb6PT7ym9jT1Knb6BsmXi-1gtn4qEmyNa6I63WkQOcm7bHHFpY7P4N2O2WrAgAAAt5SAAAABmgBB5kDDe1giGntS7g0fs4S32b60crPORXuZt-aWRedc5g3OWOcNSNVDNYm8YqyYWKOG-PR76HQHnnh2znEzem_3o1BjB_kzazo7Jlgj-wJf-YmubNxALAfZuBusxi3GPHGK7Y3LdMOBmtAdP6MBuot5Bcc5OI5eo4knNyKktbfOWh3msSLJGNCoIefTFiFEQ-vpoPDVFd7BvDooaK6jD1D3lsKR13SMcmPrQpdGYmasIrC5vBBf8N66Xceuqk93YMBcERjf1pExmQuON4M-kAkp0o60s4fbN3b5GjMb-nHR_JhsUFJKR20efwWmAOr9kXMi8bPztsJbuq0sx63EsF_Ob3ArB0JgmLkIiXUDGygTA1DiuZxDsyhPYPtah8O_Digb2I5q_rakSXB_jrTaKB3pUPMfRfNVvUHIk1G4G769dePEWp20AAYYTPRugx86l1z1nqtyC-zo5aLk2z3pr_4IXA5aIm3hdtumXhIEFJS6230Px02a46Cq_8LnAx6gtrs-tF1IKzIw-cwcbQleKMNOc-y01QgFkSqaOQfGtmr9ZfxJpxWIgQi4LLVGSAlSsQoj4fVFTl_lTJ-n5fRvyH2J4hsv-yhqKyaBQUrpIYLgZ8ugqxjBxUJIEWFFyR9IMKbJjnk98w00lKYjJ9wzKUL-aOsSEfvPcP_fzImpXooZKkIOoc_WKSS8ALrbgEW07uka4Extb8v2S4klpK-AOPii1WoXSv87Z2zKp0lGeic2iYgGPYTpE6XEsbTkmtV6dstt8LNEjsAiDKtLpk3Y4MGBn_gOOCCKcnZGnVOemWqJGSmpXljkijV_3-NsS0JnnHF9tLm3THbLP8OTAt6YrSLQoFOm59ucXM61ZgYu-ZsDZzy560StkmApq9mXUIXwxLfj1Qu5eC1aVyfxGp9WzJuvS80d0xEIVxxJ4iwuqUxcbVFl0Yhepubm2jBK5-n_gJLdqiGVwRqFjzPx8pEJd5wbTW5arkR4WVmt6sbo5j4JpGJZgQ6IbVszOGqzx8TpUqAxWv_QWebckrHGMt7_CLRlOk

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240122/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame C9B0 17 KB
6 KB 101ms
100ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 28 Jan 2024 04:27:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 28 Jan 2024 04:27:37 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame D492 17 KB
6 KB 114ms
113ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 28 Jan 2024 04:27:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 28 Jan 2024 04:27:37 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D8C6 42 B
64 B 110ms
109ms Fetch
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvOD7HTi4L21bjHJcsmrW5GjG4cTXaSBw2wnQWkg1z5SWMPVRQeYouDSA0XsAeBVjpZargLYr0qEq9mK8qWcrm1VtWbo6qc8EjMkmHqjvZck8EdpVWKYQ2VMxNVK7iIj5g_1fqDEIuTLFpshmlDusbZVR18&sai=AMfl-YTIJDsQhPXAKTyOHfueNTaXg563YXDUz5M0GmNuoXc1xWP-DQ62_YSEoZA2NhJn76OTvySd7z-u5l_XeJt_-8yEktO_XBowiQRIRpfaxlvfPv9Yp2lOLYg4GJKd6y75TShsM_2fVvEqmY-AQUg7&sig=Cg0ArKJSzGXacKIWlPhgEAE&cid=CAQSTgAvHhf_NFPsyJCMkBH4RSF6wauFJfNTNV_Mo83ulXcss9KhidlfYxMuum0QsdeaaaqKZxwA8OmVkWFvi9W3mnMwOZvte2EmpDMFpLiBFBgB&id=lidar2&mcvt=1077&p=0,0,90,728&mtos=1039,1077,1077,1077,1077&tos=1039,38,0,0,0&v=20240124&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=170641605500&rst=1706416055523&rpt=652&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxX7Q8lAG-LZM7HV1dt7P1nz2hk1OHrK8Q9gQBz93sSI3h4FdSQqh9M6w50SE6M8iSKBee8y5EK42JDpyJTzj88wC_erpI2gLPy0EwNGIsExKRSbRwiGtYHtfuYnlgLCFfKeCkkmTA== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 100ms
99ms XHR
text/html 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX7Q8lAG-LZM7HV1dt7P1nz2hk1OHrK8Q9gQBz93sSI3h4FdSQqh9M6w50SE6M8iSKBee8y5EK42JDpyJTzj88wC_erpI2gLPy0EwNGIsExKRSbRwiGtYHtfuYnlgLCFfKeCkkmTA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-XQfDgku59XWXhjVjTimCSQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hd.ekooralive.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 28 Jan 2024 04:27:37 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-XQfDgku59XWXhjVjTimCSQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctHikmJw0pBiqGV4xtQKxAXZz5kqgJjxzwsmTiB-J_mK6RsQ7_DxYJkSOIN1DhA7pc9gDQHistvnWOuAWIiHY-f662vZBD40HFzCCADrRCCP"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://hd.ekooralive.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 85EB 0
20 B 99ms
98ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BxLZKtde1ZfmiOJWh_tMPwIWzuA8AAAAAOAHgBAI&bg=!ExClEF_NAAa8BdJLnAU7ADQBe5WfOPKi01NQUGlh1T7Ru9wb560B1-K1hpyyKOxmKM815PWhG_8GU-8cjWys-Rk-0s7zAgAAAsZSAAAABGgBB5kC_riLiBb7P3zfX34KntUGum7vUkdVMmW4pZi2tSr2HUYhOEjmchB2qWkCa9hiJ80M153c68nCNqWSgSdmr4oVKVCL3ElQiKJSJQ8s2lsoIm8eaFfiK5XaW1rAKdt0XV-aALm8qYNDGdUyU_G3Rqw5OAcAmgzRQexyq-Zcko2JqbY0pWZCOHMQL_8V6OQ3WKnfM16yuuWojUsdJ6QRQx96Jga7Lct1AUXQoPSrFJCjWhkGLMtFXd7AMxRfDmz1t_rmsmbN2dF9n4MZqetZPHOQ6giOSMLiaCq1NOgCCLRqqPr2BTOtdgZYycHbzul9126Q-SAGTHaKBdcrYVCjxK3r4DFgqGDEDgCielPL6SQEK-WVB66s6I7qKhQ7LwXaNAuSNWIKtEE5M6rESaRW2_pOioQaLaZjOOWzVyjjQo5R7zA_fFXgyAwfPlTMgaAbl9Ow5uNqUvQQaovdXxSmjjNWw4oHvhJuoMUrEtxnhW7n2VuyogMWd2Djy0V5ABWvCXOtqdYDskjn2P0s8eebaUQqjgwFjEBiEh12wSXdXjQtTwh7Bf4HnKFpUE4DkovX9EbsqqWotwLzKLdGhRtTXjcV8edQMJIEyUz3-VFfTmsLwBrjMgtF1LgB-v4vSPHq-wFuXxCYCr15560oy_MQ2LtE3x0VrFCLoYNMqAOQW5hmhQcHQI2ghAZ1dChONXO3sWQ3FSmkAEjPglsqQfJa9LCKA6WadUWZJb1kyQqgjyJxxYZdQsPNL8C8NCBvjsnxGLuf_OBr6VLmAcA4glczr5DczKeRIF0RXhaHyeZMKDpJ1x21QRIFXT8xIQb1lZnmGZ04khQrkGVvDhawBqECP1sKj973UU8ztKhMI4a5NfH1mymf2X802u-WJPfu-HSgVf3h2alUP75fIgtNCt4Az8k9-eFBvm53YfZ0gU_yblhIYHPQ51La6NNwpKtrC7UFxLDOozch3ftk9mw7LSdnGaxEuf1ycZ9I-9NJSwxKE8y9sti7EA2qWccU55Ihjwg1ltM

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240122/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxX7Q8lAG-LZM7HV1dt7P1nz2hk1OHrK8Q9gQBz93sSI3h4FdSQqh9M6w50SE6M8iSKBee8y5EK42JDpyJTzj88wC_erpI2gLPy0EwNGIsExKRSbRwiGtYHtfuYnlgLCFfKeCkkmTA== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 90ms
89ms XHR
text/html 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX7Q8lAG-LZM7HV1dt7P1nz2hk1OHrK8Q9gQBz93sSI3h4FdSQqh9M6w50SE6M8iSKBee8y5EK42JDpyJTzj88wC_erpI2gLPy0EwNGIsExKRSbRwiGtYHtfuYnlgLCFfKeCkkmTA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-7gIIVx_whJ5wY8f8jQTQmA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hd.ekooralive.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 28 Jan 2024 04:27:37 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-7gIIVx_whJ5wY8f8jQTQmA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctHikmJw1pBiqGV4xtQKxAXZz5kqgJjxzwsmTiB-J_mK6RsQ7_DxYJkSOIN1DhA7pc9gDQHistvnWOuAWIiHY-f662vZBG5MuLyaEQDrniCh"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://hd.ekooralive.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxX7Q8lAG-LZM7HV1dt7P1nz2hk1OHrK8Q9gQBz93sSI3h4FdSQqh9M6w50SE6M8iSKBee8y5EK42JDpyJTzj88wC_erpI2gLPy0EwNGIsExKRSbRwiGtYHtfuYnlgLCFfKeCkkmTA== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 89ms
88ms XHR
text/html 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX7Q8lAG-LZM7HV1dt7P1nz2hk1OHrK8Q9gQBz93sSI3h4FdSQqh9M6w50SE6M8iSKBee8y5EK42JDpyJTzj88wC_erpI2gLPy0EwNGIsExKRSbRwiGtYHtfuYnlgLCFfKeCkkmTA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-EL8wHYaOFBodEx6gQZqKhg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hd.ekooralive.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 28 Jan 2024 04:27:37 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-EL8wHYaOFBodEx6gQZqKhg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctHikmJw1JBiqGV4xtQKxAXZz5kqgJjxzwsmTiB-J_mK6RsQ7_DxYJkSOIN1DhA7pc9gDQHistvnWOuAWIiHY-f662vZBFZMWrGWEQDpnSBI"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://hd.ekooralive.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxUzSZF82XNswmV2FFWTeO1GYMVTsZJzhwf-xV8QAjljCywB1drQh5id4NRemlnJGz0rQzahGoaeOuXa1bU9o3yYCkA8voGXt7aLcLnNBLxeIPpyXR1mU877s7Fwa_suAShkOpVy3g== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 97ms
97ms Script
application/javascript 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUzSZF82XNswmV2FFWTeO1GYMVTsZJzhwf-xV8QAjljCywB1drQh5id4NRemlnJGz0rQzahGoaeOuXa1bU9o3yYCkA8voGXt7aLcLnNBLxeIPpyXR1mU877s7Fwa_suAShkOpVy3g==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA2NDE2MDU3LDMxOTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9oZC5la29vcmFsaXZlLmNvbS8iLG51bGwsW1s4LCJZdGt2VXZyMEtoSSJdLFs5LCJlbi1VUyJdLFsxOCwiW1tbMF1dXSJdLFsxOSwiMiJdLFsxNywiWzBdIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

27ee7b81eb599dfe79e2d726145bf0b6aebd06329c6eb89239fb31896b39682a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-zgQ2a51KPajpYJGD6BTHgg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://hd.ekooralive.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 28 Jan 2024 04:27:37 GMT
content-security-policy: script-src 'report-sample' 'nonce-zgQ2a51KPajpYJGD6BTHgg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjOsOoxSXFEKQhxXDe6Q7TdSC-qPKU6SYQ1zI8Y2oF4gfhz5heALGBxnMmCyAuyH7OVAHEjH9eMHECcU__S6YpQPzuy0smnq8vmSSAWAOI30m-YvoGxDt8PFjehE9n5YqYznq6YDrrZSBmq5jOygfEcXXTWfOAmG_ddFbd9dNZt5yZzroHiGOeT2dNAeLFrDNYVwPxlMAZrHOAuCUayAZip_QZrEFA_DlzButvIC67fY61DoiFeDh2rr--lk3gxI63GxkBtCpc6w"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js Show response
pagead2.googlesyndication.com/bg/ Frame 36F6 39 KB
15 KB 66ms
65ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 06:10:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 166622
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15219
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Jan 2025 06:10:35 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E0CD 0
20 B 111ms
110ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BzsUHtde1ZfiiOJWh_tMPwIWzuA8AAAAAOAHgBAI&bg=!QUKlQg3NAAa8BdJLnAU7ADQBe5WfOIMQZbL8Ma-QU1pmxs9EHSqOdbFjBQY6Gzo1ZS62w4OhOLecOYcCQ1V4mt4Q-hHWAgAAA8dSAAAAA2gBB5kDAfEhfWIPvj_Wm79lo8lnKZCMvvHJY2NBT6lQIh3O6-pNjZ-xDR3CWZEKGw7xRyKob6KN8ZaNVVkqQS6L5X2Q3Ulc7RaYEgMZgy_jduTcVTkOaZGpKOkYv6-R5UC8ClTiIiwBvZRSG2H7WPqFPny2JedKNfOFMTjSAFXKraAnHEozbDl0fpzvs2GGInyOpU84XkeNs2KZfli2TCLUImbHgRvA-R3zRIqTjIgqzQNJnkZflnx60mbxTMlWhZ1V6-sM6oSe7UphA-gv1QXzufYdKcvKdKaUI-HsoryjogiZL_s4LJ2zCrzt9NQ4ZW4RF8SQDLrCvyfAbVglQS9-DdlLS7blgasv0bzbQ6lL0jcqrWfeUmk7LKRRZBt1E4geutzyzRtAU-l4lBwVgnQwCv-xYOQ48bcEtjxrwSzA8XsQW6IOjCvjDu6gVGMgHNsf-czX0dfTcvoV7GQ66-Rs64Iq6oEZgM3mC3u6BhEhLLbr79-RutX_CTm0WKVGa_DxrksLBB4PM0nJlSKADuW70BFwYwfWIwPZM7KqQLAM9hjO2V60S4kdT5xWoGgsGs68-hhpXTbSXbD4ypnBCkXrudghEW-xcOUadM89_3yp2ogKa7gfIccYhRVmdbZ_WInS_P4r6qlZyWADQY6wbYLJdBr0q3cET8CTVvwKEotn7JrX5c1xD6nGp47_I8wdNbNEHoQaaVBhaA4FesEXAY7znEJnStDqpGpPNyIEqg2BauLn5CV5_ovinapP2jBJPRCRKntXiFCdy1_TASuiNehUMbPGz4CxD7sQ9KRHsdrjnrjGT3_2rD0Uv359y4bWq_hFG3EKdN6dK0QJ8jtPp1k6V3gEKC3Wy3rMzqM3Qs4kJomwXCIed9NBVZkvlf6rU5qvbDa-nzQfRB-snA21N2uQhOj0g_DeQ3q5dk9Wu522kUgLI6L2OxPaQYploy8rrKR5z8Rsa7hDU5flnvJZBw6P_r7vec_DIhMmqXQJJ5c35gYVyJ5CW1RijD2npwLDxwT3iPlqDd4

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js Show response
pagead2.googlesyndication.com/bg/ Frame F861 39 KB
15 KB 78ms
76ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 06:10:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 166622
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15219
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Jan 2025 06:10:35 GMT

GET
H3 200 IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js Show response
pagead2.googlesyndication.com/bg/ Frame C2F6 39 KB
15 KB 64ms
63ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 06:10:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 166622
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15219
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Jan 2025 06:10:35 GMT

GET
DATA 200
OK truncated
/ Frame CFE9 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a31a1236fca2a1c33251f4c37d4c121b6e553f82745552a2d7762376d363f2ce

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 sol_logo.svg
s0.2mdn.net/sadbundle/11938805746972946677/ Frame A89C 2 KB
1 KB 74ms
65ms Image
image/svg+xml 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11938805746972946677/sol_logo.svg

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08bb8bf8ea037474da111ae1a70781e3210f7a0b29ac2f61cc5e88a3e37b920d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11938805746972946677/index.html?e=69&leftOffset=0&topOffset=0&c=WebmI0wejj&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 05:54:04 GMT
date: Fri, 26 Jan 2024 05:54:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 167613
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1118
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:14 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 texto_logo80.svg
s0.2mdn.net/sadbundle/11938805746972946677/ Frame A89C 6 KB
2 KB 77ms
69ms Image
image/svg+xml 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11938805746972946677/texto_logo80.svg

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45565342518890a25b46dee5e726ad773917bfcc17dab19f4d6455f4a4b9c722

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11938805746972946677/index.html?e=69&leftOffset=0&topOffset=0&c=WebmI0wejj&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 06:16:37 GMT
date: Fri, 26 Jan 2024 06:16:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 166260
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2164
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:14 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 palmera.png
s0.2mdn.net/sadbundle/11938805746972946677/ Frame A89C 941 KB
941 KB 75ms
68ms Image
image/png 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11938805746972946677/palmera.png

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

22e99768051bfffd5038e9ead749c8beab5ed5f1042a82eaa188096b2c63d4a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11938805746972946677/index.html?e=69&leftOffset=0&topOffset=0&c=WebmI0wejj&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 06:14:59 GMT
date: Fri, 26 Jan 2024 06:14:59 GMT
x-content-type-options: nosniff
age: 166358
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 963679
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 palmera3_1.png
s0.2mdn.net/sadbundle/11938805746972946677/ Frame A89C 490 KB
491 KB 78ms
72ms Image
image/png 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11938805746972946677/palmera3_1.png

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7316c9f4d49e26236b93f844761720c06a1e9a32de4eea83678381e3237e0947

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11938805746972946677/index.html?e=69&leftOffset=0&topOffset=0&c=WebmI0wejj&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 05:51:06 GMT
date: Fri, 26 Jan 2024 05:51:06 GMT
x-content-type-options: nosniff
age: 167791
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 502226
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 wintersale.jpg_1696585962342_wintersale.jpg
s0.2mdn.net/dynamic/2/10889189/s0.2mdn.net/creatives/assets/4372216/ Frame A89C 109 KB
109 KB 71ms
65ms Image
image/jpeg 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10889189/s0.2mdn.net/creatives/assets/4372216/wintersale.jpg_1696585962342_wintersale.jpg

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be3291eb66d4513d5b162742f39c532cec84790122d5ff978db50ff2d7fc1525

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11938805746972946677/index.html?e=69&leftOffset=0&topOffset=0&c=WebmI0wejj&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 06:02:49 GMT
x-content-type-options: nosniff
age: 167088
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111199
x-xss-protection: 0
last-modified: Fri, 06 Oct 2023 09:52:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Jan 2025 06:02:49 GMT

GET
H3 200 wintersale.jpg_1696585962342_wintersale.jpg
s0.2mdn.net/dynamic/2/10889189/s0.2mdn.net/creatives/assets/4372216/ Frame D492 109 KB
109 KB 72ms
71ms Image
image/jpeg 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10889189/s0.2mdn.net/creatives/assets/4372216/wintersale.jpg_1696585962342_wintersale.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=uUBsAVlIWR&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be3291eb66d4513d5b162742f39c532cec84790122d5ff978db50ff2d7fc1525

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=uUBsAVlIWR&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 06:02:49 GMT
x-content-type-options: nosniff
age: 167088
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111199
x-xss-protection: 0
last-modified: Fri, 06 Oct 2023 09:52:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Jan 2025 06:02:49 GMT

GET
H3 200 texto_logo.svg
s0.2mdn.net/sadbundle/9845278200317499338/ Frame D492 5 KB
2 KB 86ms
85ms Image
image/svg+xml 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9845278200317499338/texto_logo.svg

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbbd6285bb18a8c92cc59574c958877754850f795f0f4dad205c79fd21d1d467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=uUBsAVlIWR&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 05:53:17 GMT
date: Fri, 26 Jan 2024 05:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 167660
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2125
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 sol_logo.svg
s0.2mdn.net/sadbundle/9845278200317499338/ Frame D492 2 KB
1 KB 89ms
87ms Image
image/svg+xml 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9845278200317499338/sol_logo.svg

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08bb8bf8ea037474da111ae1a70781e3210f7a0b29ac2f61cc5e88a3e37b920d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=uUBsAVlIWR&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 06:03:52 GMT
date: Fri, 26 Jan 2024 06:03:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 167025
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1118
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 PALM.svg
s0.2mdn.net/sadbundle/9845278200317499338/ Frame D492 3 KB
2 KB 89ms
88ms Image
image/svg+xml 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9845278200317499338/PALM.svg

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

afcd6ebf6cf7124e138218f69982d6c9ca1820345967c9263d243dbf5631d204

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=uUBsAVlIWR&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 05:53:17 GMT
date: Fri, 26 Jan 2024 05:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 167660
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1519
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 palmera2.png
s0.2mdn.net/sadbundle/9845278200317499338/ Frame D492 960 KB
961 KB 90ms
89ms Image
image/png 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9845278200317499338/palmera2.png

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

73f6add564f8d8c794d4b1bd49749c1770990b44616591ea59ce7333cf05a574

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=uUBsAVlIWR&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 05:55:31 GMT
date: Fri, 26 Jan 2024 05:55:31 GMT
x-content-type-options: nosniff
age: 167526
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 983441
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:03 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 palmera.png
s0.2mdn.net/sadbundle/9845278200317499338/ Frame D492 941 KB
941 KB 93ms
92ms Image
image/png 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9845278200317499338/palmera.png

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

22e99768051bfffd5038e9ead749c8beab5ed5f1042a82eaa188096b2c63d4a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=uUBsAVlIWR&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 06:06:15 GMT
date: Fri, 26 Jan 2024 06:06:15 GMT
x-content-type-options: nosniff
age: 166882
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 963679
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:03 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 Gotham-Bold.otf
s0.2mdn.net/sadbundle/9845278200317499338/ Frame D492 154 KB
69 KB 71ms
70ms Font
font/otf 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9845278200317499338/Gotham-Bold.otf

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

183be4309aa229c11d790bb79b82a6a181a3f76cd009635a145a9d65c9c80766

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=uUBsAVlIWR&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 05:54:35 GMT
date: Fri, 26 Jan 2024 05:54:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 167582
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 70565
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/otf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 Gotham-Medium.otf
s0.2mdn.net/sadbundle/9845278200317499338/ Frame D492 126 KB
59 KB 72ms
71ms Font
font/otf 2607:f8b0:4006:822::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9845278200317499338/Gotham-Medium.otf

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2006 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8183507b37f3df80ea253b144745ed58784f5b4465b5216fbf9e314df592d06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9845278200317499338/index.html?e=69&leftOffset=0&topOffset=0&c=uUBsAVlIWR&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Sat, 25 Jan 2025 05:58:45 GMT
date: Fri, 26 Jan 2024 05:58:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 167332
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60432
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 15:49:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/otf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

POST
H3 204 AGSKWxViOJh9vtE0R0Ez-oWBFyns9IAN3vs6wqp6BuAli2zdVYiToqemQF6NCYvq9L7mLO5Mi2vtQELi_jhz5vh0CD1p81XrRen-lOZPdii-du847Hocs35Sa0lOT_zG5ZJmM9Pip26Q4w== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 97ms
95ms XHR
text/html 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxViOJh9vtE0R0Ez-oWBFyns9IAN3vs6wqp6BuAli2zdVYiToqemQF6NCYvq9L7mLO5Mi2vtQELi_jhz5vh0CD1p81XrRen-lOZPdii-du847Hocs35Sa0lOT_zG5ZJmM9Pip26Q4w==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-GtdVRVJ19QkZC10_2VZwHg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hd.ekooralive.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 28 Jan 2024 04:27:37 GMT
content-security-policy: script-src 'report-sample' 'nonce-GtdVRVJ19QkZC10_2VZwHg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctHikmLw05BiqGV4xtQKxAXZz5kqgJjxzwsmTiB-J_mK6RsQ7_DxYJkSOIN1DhA7pc9gDQHistvnWOuAWIiHY-f662vZBDqu7vvDCADu3yDd"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://hd.ekooralive.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxX7Q8lAG-LZM7HV1dt7P1nz2hk1OHrK8Q9gQBz93sSI3h4FdSQqh9M6w50SE6M8iSKBee8y5EK42JDpyJTzj88wC_erpI2gLPy0EwNGIsExKRSbRwiGtYHtfuYnlgLCFfKeCkkmTA== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 100ms
98ms XHR
text/html 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX7Q8lAG-LZM7HV1dt7P1nz2hk1OHrK8Q9gQBz93sSI3h4FdSQqh9M6w50SE6M8iSKBee8y5EK42JDpyJTzj88wC_erpI2gLPy0EwNGIsExKRSbRwiGtYHtfuYnlgLCFfKeCkkmTA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-TJGwklSIE8rhWcTUw15nUg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hd.ekooralive.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 28 Jan 2024 04:27:37 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-TJGwklSIE8rhWcTUw15nUg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctHikmII0pBiqGV4xtQKxAXZz5kqgJjxzwsmTiB-J_mK6RsQ7_DxYJkSOIN1DhA7pc9gDQHistvnWOuAWIiHY-f662vZBCZM6v7LCADunCB0"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://hd.ekooralive.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 3143 0
17 B 394ms
393ms Ping
image/gif 2404:6800:4006:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=4~lrx026ve&c=5700844826726&slotId=2850422413363&qqid=CIyb7pWf_4MDFY690QQdGbkN0A&fb=outstream-lima&gpm_i=9&gpm_c=9&gpm_a=9&smb=Infinity&br=1943&mt=video%2Fmp4&vs=1280x720&msm=1&aits=0%2C18%2C22%2C692%2C59%2C342%2C343%2C344%2C345%2C346%2C347&webm=0&vp9=0&vamt=video%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4&hvmf=false&vms=1&bit=22&vsrc=web_video_ads&hcn=0&met.4=arp_a_e.yy~atrd.z0~vil.250&ua_e=1&ape=1&ple=0&umsem=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4006:814::2003 Sydney, Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:37 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2404 42 B
64 B 98ms
97ms Fetch
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvDjTAY1s3lGbKm6D130QNRJlrFU0-Mo9YJq9ifDGJArMWTdGrk7hlySbBhcQuHPHGDxKwbLXsaX-pJGZwbFZoeiOvU5x2uQOW0MIuAU1X5gWqJknsUaZ0Q1v1FbJVCerVD0adHgYXcSZ-n1ukCJGMc7PGH&sai=AMfl-YSerlKsCF1EQfbODYUzngw3eF2iwRvZOVlPJExxHqS0QOa-INMaR3PmTEPEOLFpNyShLQQH_LvWWQHje6SWAPRuWiIn23V_J77TeAS_EOmCQkih9QBwmXodQ7Xcrr9SalacB0bbJyWn4JKcQeuv&sig=Cg0ArKJSzNcRmRMW0MszEAE&cid=CAQSTgAvHhf_NFPsyJCMkBH4RSF6wauFJfNTNV_Mo83ulXcss9KhidlfYxMuum0QsdeaaaqKZxwA8OmVkWFvi9W3mnMwOZvte2EmpDMFpLiBFBgB&id=lidar2&mcvt=1001&p=0,0,600,160&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20240124&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271804&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=170641605500&rst=1706416055472&rpt=701&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame CFE9 42 B
64 B 98ms
98ms Fetch
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvHR9FcaQ7EnalyUVIOTDGyFBtUJSe7B6KooFYTGj7T2OZBEK6JijywO5N6v03oYJc18_OugslHS7zz7YBOBK7-DdgUtyBTE0Icl0QVOLIwpiPcBlUfSELw0TmF0ymC-AgyhZX1D-BkvXnlr7gSUyrZ_MhP&sai=AMfl-YSi8621EKuYzstzyQn76Aldy6K5gWjjDuTXuWSyoiy-Dk_6pcVGGLeLV5vBpkmVd0v_FeJ0jOxDT2A4leOsaAV0qTf4XROIeV1tnF8Ir9ogRuHYsrDpZYduQvqVScBAlcLIIdl-nAWw8mi9S3A8&sig=Cg0ArKJSzOPRGH1rbVfyEAE&cid=CAQSTgAvHhf_NFPsyJCMkBH4RSF6wauFJfNTNV_Mo83ulXcss9KhidlfYxMuum0QsdeaaaqKZxwA8OmVkWFvi9W3mnMwOZvte2EmpDMFpLiBFBgB&id=lidar2&mcvt=1126&p=0,0,600,160&mtos=1126,1126,1126,1126,1126&tos=1126,0,0,0,0&v=20240124&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271803&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=170641605500&rst=1706416055383&rpt=803&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 236B 42 B
64 B 99ms
98ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssjD_eeee8CNCmmDgpmm0DQivY_VS6kuh6S7NRvuTyiqbHSCwbOP-naTiA2UA82-LIg6Gj25VSHhMHc2RaH44ODQQrY2Yoa7OsuWBa7HUxxcIHNbczOkSIMCNNW-t7e-xdiWbt5JkOiBvMB2-k_ypbPFr3f&sai=AMfl-YSIsCvptvWLk63b0PmPnumM-yrd9p7Z0tSsc1OJHRz_5bhrzmTUgeFKWMn7QNH_MiASzZrUh8HDjgiPv7JyMwLafg_p9-DshRdPeug0qRyCjm-HslgQEI0OKqpO71mKPF_qtZwSIw7jVAbF4iYV&sig=Cg0ArKJSzPkjgvCCvGc1EAE&cid=CAQSTgAvHhf_0pL8s0gREVezxEQ3L9z3SZy0_x3IYc-iu_vz2ft-359aJzPzGfEPbxpC82uLmZIbHWQ3Y6kSXFlH1cWLuvRQeN7KxjEhn8ZKmxgB&id=lidarv&acvw=sv%3D960%26v%3D20240117%26cb%3Dout%26e%3D9%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D7,264,273,737%26tos%3D2093,0,0,0,0%26mtos%3D2093,2093,2093,2093,2093%26amtos%3D0,0,0,0,0%26mcvt%3D2093%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D2362%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D2%26pst%3D270%26dur%3D30122%26vmtime%3D2487%26dtos%3D2093%26dtoss%3D1%26dvs%3D2093%26dfvs%3D2093%26dvpt%3D2362%26is%3D33554707%26i0%3D33554450%26ic%3D16777473%26cs%3D50331923%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D536690281%26psm%3D7%26psv%3D6%26psfv%3D6%26psa%3D0%26pngs%3D9,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,2093&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.06%26t%3D1706416056640

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMIs5ewlp__gwMVRCpoCB1wAgzPEAAYACDItJNaQhMIgJ_tlZ__gwMVBAdPCB2TagIA;dc_eps=AHas8cDH6oLeL2OFsiMjTylUaPrJP7vpVJXsdwdXUPdwJ57Mm6z1NzOXoQ6q8s3mVvl2uFywridZ145hQA;met=1;acvw=sv%3D960%26v%3D202401...
ade.googlesyndication.com/ddm/activity/ Frame 236B 42 B
107 B 97ms
95ms Image
image/gif 142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIs5ewlp__gwMVRCpoCB1wAgzPEAAYACDItJNaQhMIgJ_tlZ__gwMVBAdPCB2TagIA;dc_eps=AHas8cDH6oLeL2OFsiMjTylUaPrJP7vpVJXsdwdXUPdwJ57Mm6z1NzOXoQ6q8s3mVvl2uFywridZ145hQA;met=1;acvw=sv%3D960%26v%3D20240117%26cb%3Dout%26e%3D1%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D7,264,273,737%26tos%3D7262,0,0,0,0%26mtos%3D7262,7262,7262,7262,7262%26amtos%3D0,0,0,0,0%26mcvt%3D7262%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D7531%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D7%26pst%3D270%26dur%3D30122%26vmtime%3D7660%26dtos%3D5169%26dtoss%3D2%26dvs%3D5169%26dfvs%3D5169%26dvpt%3D5169%26is%3D33554707%26i0%3D33554450%26i1%3D33554707%26ic%3D0%26cs%3D50331923%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D7262,7262,7262,7262,7262%26qnc%3D0%26qmv%3D0%26qnv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D536690281%26psm%3D255%26psv%3D254%26psfv%3D254%26psa%3D0%26pngs%3D9s,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,7262;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.06%26t%3D1706416056640;ecn1=1;etm1=0;eid1=960584;

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:44 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 236B 42 B
64 B 87ms
87ms Image
image/gif 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CbYt8tde1ZcDwNoSOvPIPk9UJwbrf3XLByrOxvBG-gNOFojkQASCA76MvYMmGgIDco8QQoAGNlIeyAcgBBagDAcgDmwSqBK4CT9DN-icphp0z-wY5umw5fbib5wKeEechWDwuRfg360dGlacRimvSK1GqmXSbwdc1tNb7HaDwExdf85KhcBtmfgCqKVt0-87l5UJUt0OSZAyxjsVihyUwtEnE5eXMrbvvZj3fs_uBrvtNB1u4ZcrUDCO6S0N63p1vUjkxxL0jCvJmK3pDNalHQ5Bf8V9wcfv8QPKL7B345YhLhHCgG0EhQjD6X2as6lLjfGf-mqlC3NAbwHQMKyIfwcO1MAvFRZmNo3hG5Pnhh5PIVMVs4gVrbgnhf5bLuBw6eHI3TldNdxae-M3fDiadRnfV2MAtobv7PGxE6-Kk1QKeL2JhCeNZBmrSVcfns6LV5auat-lvI8OS11Tu117pq5C_tE_thtkTbnbW0LZshClu6YuaQonABOOb2synBOAEA4gF8Oy_0UqQBgGgBnaAB9vr-M0CqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiAYRABGB8yAooCOgSAQIBASL39wTpY3OrslZ__gwOACgHICwHgCwGADAGiDAgqBgoErLqxAqoNAlVTsBPyr5IW2BMKiBQC2BQB0BUB-BYBgBcB6BcB&sigh=pRmmDgYti5M&label=videoplaytime25&ad_mt=7661&acvw=sv%3D960%26v%3D20240117%26cb%3Dout%26e%3D1%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D7,264,273,737%26tos%3D7262,0,0,0,0%26mtos%3D7262,7262,7262,7262,7262%26amtos%3D0,0,0,0,0%26mcvt%3D7262%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D7531%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D7%26pst%3D270%26dur%3D30122%26vmtime%3D7660%26dtos%3D5169%26dtoss%3D2%26dvs%3D5169%26dfvs%3D5169%26dvpt%3D5169%26is%3D33554707%26i0%3D33554450%26i1%3D33554707%26ic%3D0%26cs%3D50331923%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D7262,7262,7262,7262,7262%26qnc%3D0%26qmv%3D0%26qnv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D536690281%26psm%3D255%26psv%3D254%26psfv%3D254%26psa%3D0%26pngs%3D9s,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,7262&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.06%26t%3D1706416056640

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6124972453453641&output=html&h=280&slotname=3466966124&adk=1993234961&adf=1232222165&pi=t.ma~as.3466966124&w=1000&fwrn=4&fwrnh=100&lmt=1706383639&rafmt=1&format=1000x280&url=https%3A%2F%2Fhd.ekooralive.com%2F&host=ca-host-pub-1556223355139109&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1706416053359&bpp=3&bdt=427&idt=478&shv=r20240122&mjsv=m202401250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6435881236366&frm=20&pv=1&ga_vid=963180348.1706416054&ga_sid=1706416054&ga_hid=972299190&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=300&ady=163&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31080534%2C31080697%2C95322329%2C95320891%2C95321627%2C95322163%2C95323007&oid=2&pvsid=3734680266489063&tmod=1997900759&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=483
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:44 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMIudHulZ__gwMVlZB_BB3Awgz3EAEYACDxuKtN;dc_eps=AHas8cCOY6q9Z-3ixlWTcE1Yg4wdYG7zlXkoaTXQblXX_SudQtUlBR1a7m63dCWAHP8sxIRH6xr1vJarBw;met=1;&timestamp=1706416067048;eid1=871060;ecn1=1;etm1=0;eid...
ade.googlesyndication.com/ddm/activity/ Frame D8C6 42 B
63 B 97ms
96ms Image
image/gif 142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIudHulZ__gwMVlZB_BB3Awgz3EAEYACDxuKtN;dc_eps=AHas8cCOY6q9Z-3ixlWTcE1Yg4wdYG7zlXkoaTXQblXX_SudQtUlBR1a7m63dCWAHP8sxIRH6xr1vJarBw;met=1;&timestamp=1706416067048;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMIuNHulZ__gwMVlZB_BB3Awgz3EAEYACDouKtN;dc_eps=AHas8cBlXkA4mzozm3LV7KkY1wabklSF46C1JQONh0l7m5_IvmbOFLHEOY2L736BUWbdy3GNTi5dF8Uc_w;met=1;&timestamp=1706416067068;eid1=871060;ecn1=1;etm1=0;eid...
ade.googlesyndication.com/ddm/activity/ Frame 2404 42 B
63 B 98ms
97ms Image
image/gif 142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIuNHulZ__gwMVlZB_BB3Awgz3EAEYACDouKtN;dc_eps=AHas8cBlXkA4mzozm3LV7KkY1wabklSF46C1JQONh0l7m5_IvmbOFLHEOY2L736BUWbdy3GNTi5dF8Uc_w;met=1;&timestamp=1706416067068;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMIt9HulZ__gwMVlZB_BB3Awgz3EAEYACDouKtN;dc_eps=AHas8cA2GUtT8uqCNjxj-ryp_Z8alR53iAFuj5rz3JU-1e4Gaav1qlf_9I7RDYljBB8sFCpj2sIYlK4McQ;met=1;&timestamp=1706416067105;eid1=871060;ecn1=1;etm1=0;eid...
ade.googlesyndication.com/ddm/activity/ Frame CFE9 42 B
63 B 96ms
95ms Image
image/gif 142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIt9HulZ__gwMVlZB_BB3Awgz3EAEYACDouKtN;dc_eps=AHas8cA2GUtT8uqCNjxj-ryp_Z8alR53iAFuj5rz3JU-1e4Gaav1qlf_9I7RDYljBB8sFCpj2sIYlK4McQ;met=1;&timestamp=1706416067105;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMIs5ewlp__gwMVRCpoCB1wAgzPEAAYACDItJNaQhMIgJ_tlZ__gwMVBAdPCB2TagIA;dc_eps=AHas8cDH6oLeL2OFsiMjTylUaPrJP7vpVJXsdwdXUPdwJ57Mm6z1NzOXoQ6q8s3mVvl2uFywridZ145hQA;met=1;acvw=sv%3D960%26v%3D202401...
ade.googlesyndication.com/ddm/activity/ Frame 236B 42 B
63 B 108ms
107ms Image
image/gif 142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIs5ewlp__gwMVRCpoCB1wAgzPEAAYACDItJNaQhMIgJ_tlZ__gwMVBAdPCB2TagIA;dc_eps=AHas8cDH6oLeL2OFsiMjTylUaPrJP7vpVJXsdwdXUPdwJ57Mm6z1NzOXoQ6q8s3mVvl2uFywridZ145hQA;met=1;acvw=sv%3D960%26v%3D20240117%26cb%3Dout%26e%3D2%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D7,264,273,737%26tos%3D14712,0,0,0,0%26mtos%3D14712,14712,14712,14712,14712%26amtos%3D0,0,0,0,0%26mcvt%3D14712%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D14981%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D10%26pst%3D270%26dur%3D30122%26vmtime%3D15114%26dtos%3D7450%26dtoss%3D3%26dvs%3D7450%26dfvs%3D7450%26dvpt%3D7450%26is%3D33554707%26i0%3D33554450%26i1%3D33554707%26i2%3D33554707%26ic%3D512%26cs%3D50332435%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D7450,7450,7450,7450,7450%26qnc%3D1%26qmv%3D0%26qnv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D536690281%26psm%3D65535%26psv%3D65534%26psfv%3D65534%26psa%3D0%26pngs%3D9s,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,14712;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.06%26t%3D1706416056640;ecn1=1;etm1=0;eid1=18;

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 236B 42 B
64 B 96ms
95ms Image
image/gif 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CbYt8tde1ZcDwNoSOvPIPk9UJwbrf3XLByrOxvBG-gNOFojkQASCA76MvYMmGgIDco8QQoAGNlIeyAcgBBagDAcgDmwSqBK4CT9DN-icphp0z-wY5umw5fbib5wKeEechWDwuRfg360dGlacRimvSK1GqmXSbwdc1tNb7HaDwExdf85KhcBtmfgCqKVt0-87l5UJUt0OSZAyxjsVihyUwtEnE5eXMrbvvZj3fs_uBrvtNB1u4ZcrUDCO6S0N63p1vUjkxxL0jCvJmK3pDNalHQ5Bf8V9wcfv8QPKL7B345YhLhHCgG0EhQjD6X2as6lLjfGf-mqlC3NAbwHQMKyIfwcO1MAvFRZmNo3hG5Pnhh5PIVMVs4gVrbgnhf5bLuBw6eHI3TldNdxae-M3fDiadRnfV2MAtobv7PGxE6-Kk1QKeL2JhCeNZBmrSVcfns6LV5auat-lvI8OS11Tu117pq5C_tE_thtkTbnbW0LZshClu6YuaQonABOOb2synBOAEA4gF8Oy_0UqQBgGgBnaAB9vr-M0CqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiAYRABGB8yAooCOgSAQIBASL39wTpY3OrslZ__gwOACgHICwHgCwGADAGiDAgqBgoErLqxAqoNAlVTsBPyr5IW2BMKiBQC2BQB0BUB-BYBgBcB6BcB&sigh=pRmmDgYti5M&label=videoplaytime50&ad_mt=15114&acvw=sv%3D960%26v%3D20240117%26cb%3Dout%26e%3D2%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D7,264,273,737%26tos%3D14712,0,0,0,0%26mtos%3D14712,14712,14712,14712,14712%26amtos%3D0,0,0,0,0%26mcvt%3D14712%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D14981%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D10%26pst%3D270%26dur%3D30122%26vmtime%3D15114%26dtos%3D7450%26dtoss%3D3%26dvs%3D7450%26dfvs%3D7450%26dvpt%3D7450%26is%3D33554707%26i0%3D33554450%26i1%3D33554707%26i2%3D33554707%26ic%3D512%26cs%3D50332435%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D7450,7450,7450,7450,7450%26qnc%3D1%26qmv%3D0%26qnv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D536690281%26psm%3D65535%26psv%3D65534%26psfv%3D65534%26psa%3D0%26pngs%3D9s,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,14712&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.06%26t%3D1706416056640

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6124972453453641&output=html&h=280&slotname=3466966124&adk=1993234961&adf=1232222165&pi=t.ma~as.3466966124&w=1000&fwrn=4&fwrnh=100&lmt=1706383639&rafmt=1&format=1000x280&url=https%3A%2F%2Fhd.ekooralive.com%2F&host=ca-host-pub-1556223355139109&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1706416053359&bpp=3&bdt=427&idt=478&shv=r20240122&mjsv=m202401250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6435881236366&frm=20&pv=1&ga_vid=963180348.1706416054&ga_sid=1706416054&ga_hid=972299190&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=300&ady=163&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31080534%2C31080697%2C95322329%2C95320891%2C95321627%2C95322163%2C95323007&oid=2&pvsid=3734680266489063&tmod=1997900759&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=483
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMIudHulZ__gwMVlZB_BB3Awgz3EAEYACDxuKtN;dc_eps=AHas8cCOY6q9Z-3ixlWTcE1Yg4wdYG7zlXkoaTXQblXX_SudQtUlBR1a7m63dCWAHP8sxIRH6xr1vJarBw;met=1;&timestamp=1706416077041;eid1=2;ecn1=0;etm1=10;
ade.googlesyndication.com/ddm/activity/ Frame D8C6 42 B
63 B 96ms
96ms Image
image/gif 142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMIuNHulZ__gwMVlZB_BB3Awgz3EAEYACDouKtN;dc_eps=AHas8cBlXkA4mzozm3LV7KkY1wabklSF46C1JQONh0l7m5_IvmbOFLHEOY2L736BUWbdy3GNTi5dF8Uc_w;met=1;&timestamp=1706416077068;eid1=2;ecn1=0;etm1=10;
ade.googlesyndication.com/ddm/activity/ Frame 2404 42 B
63 B 96ms
96ms Image
image/gif 142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMIt9HulZ__gwMVlZB_BB3Awgz3EAEYACDouKtN;dc_eps=AHas8cA2GUtT8uqCNjxj-ryp_Z8alR53iAFuj5rz3JU-1e4Gaav1qlf_9I7RDYljBB8sFCpj2sIYlK4McQ;met=1;&timestamp=1706416077105;eid1=2;ecn1=0;etm1=10;
ade.googlesyndication.com/ddm/activity/ Frame CFE9 42 B
63 B 96ms
95ms Image
image/gif 142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 28 Jan 2024 04:27:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIs5ewlp__gwMVRCpoCB1wAgzPEAAYACDItJNaQhMIgJ_tlZ__gwMVBAdPCB2TagIA;dc_eps=AHas8cDH6oLeL2OFsiMjTylUaPrJP7vpVJXsdwdXUPdwJ57Mm6z1NzOXoQ6q8s3mVvl2uFywridZ145hQA;met=1;acvw=sv%3D960%26v%3D20240117%26cb%3Dout%26e%3D3%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D7,264,273,737%26tos%3D22141,0,0,0,0%26mtos%3D22141,22141,22141,22141,22141%26amtos%3D0,0,0,0,0%26mcvt%3D22141%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D22410%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D19%26pst%3D270%26dur%3D30122%26vmtime%3D22550%26dtos%3D7429%26dtoss%3D4%26dvs%3D7429%26dfvs%3D7429%26dvpt%3D7429%26is%3D33554707%26i0%3D33554450%26i1%3D33554707%26i2%3D33554707%26i3%3D33554707%26ic%3D0%26cs%3D50332435%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D7429,7429,7429,7429,7429%26qnc%3D1%26qmv%3D0%26qnv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D536690281%26psm%3D8388607%26psv%3D8388606%26psfv%3D8388606%26psa%3D0%26pngs%3D9s,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,22141;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.06%26t%3D1706416056640;ecn1=1;etm1=0;eid1=960585;

Requested by

Host: hd.ekooralive.com
URL: https://hd.ekooralive.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS