ehfmc-com.ngontinh24.com Open in urlscan Pro
2606:4700:3031::6815:28fa Public Scan

Software

nginx/1.21.3 /

Resource Hash

ff6344a229ac5cd680b941dd372a2af853d266b342f4826512c524d763106b91

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
an-x-request-uuid: 0a83b89b-434b-4cc2-8646-c27a3e8656d3
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 143
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 v2 Show response
e.serverbid.com/api/ 16 B
202 B 97ms
49ms XHR
application/json 159.89.246.130
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://e.serverbid.com/api/v2
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 159.89.246.130 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:47 GMT
content-encoding: gzip
access-control-max-age: 10080
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept
content-length: 42

POST
H2 204 637e6546decb82d45236f0f8 Show response
prebid.cootlogix.com/prebid/multi/ 0
945 B 393ms
347ms XHR
text/plain 157.245.128.131
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.cootlogix.com/prebid/multi/637e6546decb82d45236f0f8
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 157.245.128.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:48 GMT
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
content-length: 0

GET
H2 204 prebid Show response
ads.yieldmo.com/exchange/ 0
231 B 167ms
147ms XHR
text/plain 54.167.233.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebid?pbav=7.54.2&p=%5B%7B%22placement_id%22%3A%22mmt-26c15b8e-8080-4986-924e-050c0f0222d6_1_1_ad%22%2C%22callback_id%22%3A%2230de22ca7738ba1%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B160%2C600%5D%2C%5B300%2C600%5D%5D%2C%22ym_placement_id%22%3A%223076949134012260636%22%2C%22gpid%22%3A%22%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDR.D%23pillar-4%22%2C%22tid%22%3A%225365df0b-b2f6-44de-b243-d5ab3c0684a6%22%2C%22auctionId%22%3A%224c32b460-310c-4b68-9165-e92aa4ed30c2%22%7D%5D&page_url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&bust=1690461468210&dnt=false&description=Ehfmc%20is%20a%20website%20that%20writes%20about%20many%20topics%20of%20interest%20to%20you%2C%20it%27s%20a%20blog%20that%20shares%20knowledge%20and%20insights%20useful%20to%20everyone%20in%20many%20fields.&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%2C%22gpp%22%3A%22%22%2C%22gpp_sid%22%3A%5B%5D%7D&us_privacy=1---&pr=&scrd=1&title=Ehfmc%20-%20A%20General%20Blog&w=1600&h=1200&pubcid=8217a596-e105-4814-9f40-7d0549462d31&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22monumetric.com%22%2C%22sid%22%3A%22fdd82422-8575-448e-84fe-fa092518ca2d%22%2C%22hp%22%3A1%7D%5D%7D&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%228217a596-e105-4814-9f40-7d0549462d31%22%2C%22atype%22%3A1%7D%5D%7D%5D
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.167.233.116 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-167-233-116.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
access-control-allow-credentials: true
x-robots-tag: none,NOINDEX,NOFOLLOW
access-control-allow-methods: POST, GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
67 B 210ms
191ms XHR
text/plain 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:48 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 31 KB
9 KB 327ms
308ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUWWG7OK
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: abc66a0ece11419fb1bd782c80fe95d7e37e409d31d62f8ac985f08cea405ea6

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Thu, 27 Jul 2023 12:37:48 GMT

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 3 KB
2 KB 99ms
83ms XHR
application/json 35.168.216.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?lt=1690461468212&to=0&aun=mmt-26c15b8e-8080-4986-924e-050c0f0222d6_1_1_ad&pubcid=8217a596-e105-4814-9f40-7d0549462d31&gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDR.D%23pillar-4&maxw=300&maxh=600&si=490025&pi=3&bf=300x250%2C160x600%2C300x600&uspConsent=1---&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%227.54.2%22%7D&ogu=null&ns=10240
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.216.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-216-217.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 8e50f55eea2bdaf458b0a0d4fc1e633b56d7c606fb8631de2e2311ba851c9fba

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 3 KB
2 KB 109ms
94ms XHR
application/json 35.168.216.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?lt=1690461468214&to=0&aun=mmt-26c15b8e-8080-4986-924e-050c0f0222d6_1_1_ad&pubcid=8217a596-e105-4814-9f40-7d0549462d31&gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDR.D%23pillar-4&maxw=300&maxh=600&si=490027&pi=3&bf=300x250%2C160x600%2C300x600&uspConsent=1---&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%227.54.2%22%7D&ogu=null&ns=10240
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.216.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-216-217.compute-1.amazonaws.com
Software: nginx /
Resource Hash: d2627d6d51f6d603492d1f281aa25b809da4572269705d5bde894e66ffe2f9a8

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 3 KB
2 KB 80ms
65ms XHR
application/json 35.168.216.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?lt=1690461468215&to=0&aun=mmt-26c15b8e-8080-4986-924e-050c0f0222d6_1_1_ad&pubcid=8217a596-e105-4814-9f40-7d0549462d31&gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDR.D%23pillar-4&maxw=300&maxh=600&si=490028&pi=3&bf=300x250%2C160x600%2C300x600&uspConsent=1---&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%227.54.2%22%7D&ogu=null&ns=10240
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.216.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-216-217.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 45113382e3f52cab96cb365f99d414228fb083b88e2afa871667c408f251ab93

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ 771 B
1 KB 77ms
52ms XHR
application/json 69.166.1.14
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%224488f2769b0ca0d%22%3A%22dcc4cd9596e80d497120%7C300x250%2C160x600%2C300x600%7Cgpid%3D%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDR.D%23pillar-4%2Cc%3Dd%2C%22%2C%2245f7280ff0bf58f%22%3A%22177369c437c672237248%7C300x250%2C160x600%2C300x600%7Cgpid%3D%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDR.D%23pillar-4%2Cc%3Dd%2C%22%2C%2246bf40d58135267%22%3A%22d23fc2fbe929165f22f9%7C300x250%2C160x600%2C300x600%7Cgpid%3D%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDR.D%23pillar-4%2Cc%3Dd%2C%22%7D&ref=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&s=c5dbfccf-dee9-4522-9096-acd11a75efea&pv=9ad4e7ea-98fd-4147-a6b9-71e22bd44903&vp=desktop&lib_name=prebid&lib_v=7.54.2&us=5&iqid=%7B%22pcid%22%3A%229f1ce227-7a36-486b-a00e-09d1a9788223%22%2C%22pcidDate%22%3A1690461468187%7D&fpd=%7B%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22site%22%3A%7B%22domain%22%3A%22ehfmc-com.ngontinh24.com%22%2C%22publisher%22%3A%7B%22domain%22%3A%22ngontinh24.com%22%7D%2C%22page%22%3A%22https%3A%2F%2Fehfmc-com.ngontinh24.com%2F%22%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F115.0.5790.110%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%7D%7D&ius=0&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22monumetric.com%22%2C%22sid%22%3A%22fdd82422-8575-448e-84fe-fa092518ca2d%22%2C%22hp%22%3A1%7D%5D%7D&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%228217a596-e105-4814-9f40-7d0549462d31%22%2C%22atype%22%3A1%7D%5D%7D%5D&us_privacy=1---&coppa=0

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.14 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

5c0f43e6f7a2a60c9018403b60d1e13ea59675fd61d662ae26d1e4892702f258

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:48 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-9
Content-Type: application/json
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://ehfmc-com.ngontinh24.com
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Length: 469
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 536 B
1000 B 76ms
63ms XHR
application/json 195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

b491dbf1416cc36b3100f23ed3733225c73683e5a42b6f6f0ff634f912106ffb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
x-content-type-options: nosniff
p3p: CP="CAO PSA OUR"
x-envoy-upstream-service-time: 44
content-length: 536
pragma: no-cache
server: ayl-lb-usa02
access-control-max-age: 3600
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding
access-control-allow-headers: Accept-Encoding, Content-Type
expires: 0

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
130 B 34ms
24ms XHR
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4bab9b5fc3e14efb8038d145c0dda64d8703127f8503cbf9eb94bdbb0e6186c9

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

POST
H2 200 c Show response
prebid.a-mo.net/a/ 873 B
927 B 21ms
11ms XHR
application/json 147.28.146.89
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.146.89 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 88ead5d95477dab4ca164310fdf1b4e8f38845c3d5843954b10490b2d3df99a4

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:47 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 532

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 144 B
969 B 138ms
130ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

cb73db48e2366be2822a7dad0b950ac94991c311666a3d2a596c2144c7945c6d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
an-x-request-uuid: cd41e593-1276-4f8c-92d0-c8197f242c97
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 144
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 637e6546decb82d45236f0f8 Show response
prebid.cootlogix.com/prebid/multi/ 0
942 B 248ms
227ms XHR
text/plain 157.245.128.131
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.cootlogix.com/prebid/multi/637e6546decb82d45236f0f8
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 157.245.128.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:48 GMT
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
content-length: 0

POST
H2 200 v2 Show response
e.serverbid.com/api/ 16 B
397 B 32ms
11ms XHR
application/json 159.89.246.130
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://e.serverbid.com/api/v2
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 159.89.246.130 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:47 GMT
content-encoding: gzip
access-control-max-age: 10080
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept
content-length: 42

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 416 B
948 B 187ms
169ms XHR
application/json 2602:803:c002:200::113
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23852&site_id=389792&zone_id=2276222&size_id=15&alt_size_ids=9%2C10&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!monumetric.com,fdd82422-8575-448e-84fe-fa092518ca2d,1,,,&eid_pubcid.org=8217a596-e105-4814-9f40-7d0549462d31%5E1&rf=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&tg_i.domain=ehfmc-com.ngontinh24.com&tg_i.page=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&tg_i.pbadslot=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDR.D%23pillar-4&tk_flint=pbjs_lite_v7.54.2&x_source.tid=5365df0b-b2f6-44de-b243-d5ab3c0684a6&l_pb_bid_id=63f62d5134ac5a8&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=5365df0b-b2f6-44de-b243-d5ab3c0684a6&rp_maxbids=1&p_gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDR.D%23pillar-4&slots=1&rand=0.4265088879991774
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::113 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 98239732212f2cc453b4cb48cedfc61796f1c74278cc7522f4040d91177c2633

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 416
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 services.js Show response
js.gumgum.com/ 111 KB
40 KB 127ms
66ms Script
application/javascript 108.138.128.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.gumgum.com/services.js
Requested by: Host: monu.delivery
URL: https://monu.delivery/site/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-18.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 36400e85186837a4487849b0bfab215fcbfc2e904688ead9c80ef79bc9346e53

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
x-amz-version-id: IpmDg9kNrPyjlzlO5adHX0W__L4YeyVa
content-encoding: gzip
via: 1.1 0afec277ba3e75e96fa6b4c76d8e130c.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P4
x-amz-meta-version: 3.88.11
x-cache: Miss from cloudfront
x-amz-meta-access-control-allow-origin: *
x-amz-meta-timing-allow-origin: *
last-modified: Thu, 15 Jun 2023 22:24:18 GMT
server: AmazonS3
etag: W/"38127fc32dbc02a947d2dc3288256071"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=7200
x-amz-cf-id: CS7QN_DHSDipg5-_izQVGUpVzECl-KCuNT8uDomUTthSyQfe88ieqA==

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 462B 26 KB
11 KB 343ms
336ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202307200101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9b6236434cb09afbd116276bdbda8872b2dc257421bfb602e340a68a998c2d88

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 11278
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:48 GMT
expires: Thu, 27 Jul 2023 12:37:48 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ 384 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8030594b4999eca38901464b09383ca988c454a4f7ab6b963be75e6c42da011d

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 577 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d23484cf0f36a73cc699ceffc6da8f0e9ffd6b372dcb615ec942cdc287845505

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 / Show response
serv.vidcrunch.com/api/adserver/tag/ 21 KB
4 KB 133ms
23ms XHR
application/json 3.222.55.84
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://serv.vidcrunch.com/api/adserver/tag/?AV_TAGID=64243eb70d27775aa706c3e7&AV_PUBLISHERID=632d59d7b9689f25ad20b012&AV_VIDEOURL=https%3A%2F%2Fcdn.vidcrunch.com%2Fc%2F6489c024d7f4079befa5356c.mp4&AV_DURATION=60&AV_SLOTT=-2&AV_SECURED=1&AV_LANGUAGE=en&AV_URL=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&AV_CHANNELID=633af7310bd55978fc5962d8&tgt=0&AV_SUBID=&AV_CDIM1=&AV_CDIM2=&AV_CDIM3=&AV_ABT=&pce=1&npx=1&AV_DETDOMAIN=ehfmc-com.ngontinh24.com&AV_DADPOS=1&AV_OPLACEMENT=1&AV_TAG=64243eb70d27775aa706c3e7&AV_TEMPLATE=6464d9ee2a474d871d00c945&AV_GPID=/632d59d7b9689f25ad20b012/64243eb70d27775aa706c3e7/ehfmc-com.ngontinh24.com&d36=6.2.117&responsive=1&sver=4&avtoken=468438&omv=1.0.1&AV_D65=Control&AV_D66=8.4.0&clsid=ff53529a-bb2c-42a3-be01-e057ef7a8966&rando=91&AV_WIDTH=640&AV_HEIGHT=360&AV_CCPA=1---&AV_DNT=0&cb=1690461468444&wfc=1
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=632d59d7b9689f25ad20b012
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.55.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-55-84.compute-1.amazonaws.com
Software: /
Resource Hash: 2360280204e347912df7889d30e2fe7145cf91d127d432ea948da53625a219b4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
x-bamboo-c-skst: 1
content-encoding: gzip
x-bamboo-c-skfe: 1
x-bamboo-c-s: BYPASS
access-control-max-age: 1728000
vary: Accept-Encoding
access-control-allow-methods: GET, POST, DELETE, PUT, OPTIONS, INDEX
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
content-type: application/json
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Authorization,X-Bamboo-Token,Event-Id,X-Requested-With
expires: Sat, 15 Jul 2023 22:51:08 GMT

GET
H2 200 track
servt.vidcrunch.com/ 0
98 B 12ms
12ms Image
text/plain 50.16.166.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.vidcrunch.com/track?r=ehfmc-com.ngontinh24.com&sn=&ic=0&tgt=0&app=&wi=355&he=200&test=&d36=6.2.117&apppkg=&fv=1&proto=https&d65=Control&d66=8.4.0&clsid=ff53529a-bb2c-42a3-be01-e057ef7a8966&rando=91&pid=632d59d7b9689f25ad20b012&cid=633af7310bd55978fc5962d8&stagid=64243eb70d27775aa706c3e7&stplid=6464d9ee2a474d871d00c945&e=inventory&vi=100&cb=1690461468442
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.166.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-166-217.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H3 200 2467328122925482687
tpc.googlesyndication.com/simgad/ Frame 10EE 14 KB
14 KB 14ms
12ms Image
image/png 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/2467328122925482687?w=600&h=314

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

816daff7390907cc5ecd854e99753e13a96822119425827d6f9bf585ee80021c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 04:17:15 GMT
x-content-type-options: nosniff
age: 30033
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13977
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 21:58:53 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 26 Jul 2024 04:17:15 GMT

GET
DATA 200
OK truncated
/ Frame 10EE 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 10EE 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 843245d38197c1ae733406b6faeda0f9b53376d8853df5d513a880489c822166

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9323 26 KB
11 KB 522ms
520ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=2294626326&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466970&bpp=1&bdt=495&idt=1510&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&fsb=1&xpc=hDyHm3Dgx6&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1515

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202307200101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0cdeab125a1b5d1755fd76ac39dbbc1d4abe702ed51be02c51ba787f6ff56f77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 11077
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:49 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 / Show response
serv.vidcrunch.com/api/adserver/tag/ 21 KB
4 KB 64ms
26ms XHR
application/json 3.222.55.84
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://serv.vidcrunch.com/api/adserver/tag/?AV_DNTCHECK=1&AV_VIDEOURL=https%3A%2F%2Fcdn.vidcrunch.com%2Fintegrations%2F633173711c14411825a5a732%2F633173e11c14419a7ba5a735%2F368933fb7d4feb0da6596857886b4b97.mp4%3FchannelId&veid=5b12b88b12c1f7a73c2d94d7b1ce2553&AV_SLOTT=-2&AV_SECURED=1&AV_LANGUAGE=en&AV_URL=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&AV_PUBLISHERID=632d59d7b9689f25ad20b012&AV_CHANNELID=633172fb22e9a25a4645a127&tgt=0&AV_SUBID=&AV_CDIM1=&AV_CDIM2=&AV_CDIM3=&AV_ABT=&pce=1&npx=1&AV_DETDOMAIN=ehfmc-com.ngontinh24.com&AV_DADPOS=1&AV_OPLACEMENT=1&AV_GPID=/632d59d7b9689f25ad20b012/633172fb22e9a25a4645a127/ehfmc-com.ngontinh24.com&d36=6.2.117&responsive=1&sver=4&avtoken=468516&omv=1.0.1&AV_D66=8.2.12&clsid=3622485a-fc24-4fac-a881-ce82c2a13f16&rando=42&AV_WIDTH=300&AV_HEIGHT=250&AV_CCPA=1---&AV_DNT=0&cb=1690461468517&wfc=1
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=632d59d7b9689f25ad20b012
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.55.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-55-84.compute-1.amazonaws.com
Software: /
Resource Hash: 392b85414db0ec73d037302b3cc0b2dd7fac33650b80c0401e6e27817723ac8b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
x-bamboo-c-skst: 1
content-encoding: gzip
x-bamboo-c-skfe: 1
x-bamboo-c-s: BYPASS
access-control-max-age: 1728000
vary: Accept-Encoding
access-control-allow-methods: GET, POST, DELETE, PUT, OPTIONS, INDEX
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
content-type: application/json
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Authorization,X-Bamboo-Token,Event-Id,X-Requested-With
expires: Sat, 15 Jul 2023 22:51:08 GMT

GET
H2 200 track
servt.vidcrunch.com/ 0
98 B 15ms
14ms Image
text/plain 50.16.166.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.vidcrunch.com/track?r=ehfmc-com.ngontinh24.com&sn=&ic=0&tgt=0&app=&wi=300&he=250&test=&d36=6.2.117&apppkg=&fv=1&proto=https&d66=8.2.12&clsid=3622485a-fc24-4fac-a881-ce82c2a13f16&rando=42&pid=632d59d7b9689f25ad20b012&cid=633172fb22e9a25a4645a127&stagid=&stplid=&e=inventory&vi=100&cb=1690461468517
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.166.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-166-217.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H3 200 11778604948800383788
tpc.googlesyndication.com/simgad/ Frame A3EC 13 KB
13 KB 42ms
18ms Image
image/png 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11778604948800383788?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkAaLVHOOPz_bastxbvDcE70OBe7Q

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=1663128080&adf=743467531&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466964&bpp=1&bdt=490&idt=272&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=584&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=h3JYZEuvl9&p=https%3A//ehfmc-com.ngontinh24.com&dtd=281

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d2ec1c907004fb1a0d9ade9e9f5d3b19efb55a0319dbaadaea734d86cb5e4c66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 04:00:20 GMT
x-content-type-options: nosniff
age: 31048
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13781
x-xss-protection: 0
last-modified: Tue, 17 May 2022 14:15:49 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 26 Jul 2024 04:00:20 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/ Frame A3EC 23 KB
9 KB 40ms
15ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=1663128080&adf=743467531&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466964&bpp=1&bdt=490&idt=272&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=584&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=h3JYZEuvl9&p=https%3A//ehfmc-com.ngontinh24.com&dtd=281

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93028274da1d373cd41165f6a442568ddd482370e8093e45d14a4ad0f6981f19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78220
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9132
x-xss-protection: 0
server: cafe
etag: 17712579318771444318
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame A3EC 3 KB
1 KB 22ms
14ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=1663128080&adf=743467531&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466964&bpp=1&bdt=490&idt=272&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=584&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=h3JYZEuvl9&p=https%3A//ehfmc-com.ngontinh24.com&dtd=281

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:40:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57455
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:40:13 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame A3EC 20 KB
8 KB 21ms
14ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=1663128080&adf=743467531&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466964&bpp=1&bdt=490&idt=272&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=584&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=h3JYZEuvl9&p=https%3A//ehfmc-com.ngontinh24.com&dtd=281

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ecb4fb492aee0a820dfc4a395fb80e2ac2e864bbf38aa1ae28d6d70fb9e6da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78220
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A3EC 179 KB
56 KB 66ms
37ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=1663128080&adf=743467531&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466964&bpp=1&bdt=490&idt=272&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=584&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=h3JYZEuvl9&p=https%3A//ehfmc-com.ngontinh24.com&dtd=281

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f294f48a5bc171da79776780d32c77ae3323a508cb595a56f116ecb7578a8e7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57383
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690198756579870"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:48 GMT

GET
H3 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame A3EC 33 KB
13 KB 28ms
19ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=1663128080&adf=743467531&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466964&bpp=1&bdt=490&idt=272&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=584&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=h3JYZEuvl9&p=https%3A//ehfmc-com.ngontinh24.com&dtd=281

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4938ae629cfe26eaeb48f79a64d380e0f2f29a63b0cf0c98ef4dd19039ed3d81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:57:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78028
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13567
x-xss-protection: 0
server: cafe
etag: 2495518695802652152
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:57:20 GMT

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ 729 B
1 KB 39ms
26ms XHR
application/json 69.166.1.14
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%22650a36f2c5cc821%22%3A%224038e93c4d4c13bc38d7%7C728x90%7Cgpid%3D%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDH.A%23header-1%2Cc%3Dv%2C%22%7D&ref=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&s=773c647b-2d05-4496-bafd-826574d69b1e&pv=9ad4e7ea-98fd-4147-a6b9-71e22bd44903&vp=desktop&lib_name=prebid&lib_v=7.54.2&us=5&iqid=%7B%22pcid%22%3A%229f1ce227-7a36-486b-a00e-09d1a9788223%22%2C%22pcidDate%22%3A1690461468187%7D&fpd=%7B%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22site%22%3A%7B%22domain%22%3A%22ehfmc-com.ngontinh24.com%22%2C%22publisher%22%3A%7B%22domain%22%3A%22ngontinh24.com%22%7D%2C%22page%22%3A%22https%3A%2F%2Fehfmc-com.ngontinh24.com%2F%22%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F115.0.5790.110%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%7D%7D&ius=0&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22monumetric.com%22%2C%22sid%22%3A%22fdd82422-8575-448e-84fe-fa092518ca2d%22%2C%22hp%22%3A1%7D%5D%7D&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%228217a596-e105-4814-9f40-7d0549462d31%22%2C%22atype%22%3A1%7D%5D%7D%5D&us_privacy=1---&coppa=0

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.14 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

63cd75a5ee8e691c9622a0723a94d6b4569f75a9bdb4e6e20c2280a8978f6d52

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:48 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-9
Content-Type: application/json
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://ehfmc-com.ngontinh24.com
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Length: 440
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
132 B 67ms
11ms XHR
text/plain 3.232.158.174
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.232.158.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-158-174.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:48 GMT
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 180 B
317 B 92ms
82ms XHR
application/json 195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

8dfe5a662c9fc39b2b9192c43ea87a37de9a0cbbe2c8a47b73850ce346ad2bd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
x-content-type-options: nosniff
p3p: CP="CAO PSA OUR"
x-envoy-upstream-service-time: 75
content-length: 180
pragma: no-cache
server: ayl-lb-usa02
access-control-max-age: 3600
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding
access-control-allow-headers: Accept-Encoding, Content-Type
expires: 0

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 3 KB
2 KB 72ms
61ms XHR
application/json 35.168.216.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?lt=1690461468543&to=0&aun=mmt-df664826-5c9a-46f1-947a-56f39263c30d_1_1_ad&pubcid=8217a596-e105-4814-9f40-7d0549462d31&gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDH.A%23header-1&maxw=728&maxh=90&si=490032&pi=3&bf=728x90&uspConsent=1---&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%227.54.2%22%7D&ogu=null&ns=10240
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.216.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-216-217.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 523e1a22da1e2bf7af4f63f4fc7c74a14fc7eababc73a4a005b3baf2646545de

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
67 B 108ms
100ms XHR
text/plain 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:47 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H3 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
94 B 27ms
24ms XHR
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: f3f8343e31215b8922d0cd2615ec1a747d139540795cc146dd4dc7b408572be9

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

POST
H3 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
94 B 26ms
23ms XHR
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: f3f8343e31215b8922d0cd2615ec1a747d139540795cc146dd4dc7b408572be9

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

POST
H2 200 v2 Show response
e.serverbid.com/api/ 16 B
226 B 15ms
8ms XHR
application/json 159.89.246.130
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://e.serverbid.com/api/v2
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 159.89.246.130 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
access-control-max-age: 10080
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept
content-length: 42

GET
H2 204 prebid Show response
ads.yieldmo.com/exchange/ 0
231 B 151ms
145ms XHR
text/plain 54.167.233.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebid?pbav=7.54.2&p=%5B%7B%22placement_id%22%3A%22mmt-df664826-5c9a-46f1-947a-56f39263c30d_1_1_ad%22%2C%22callback_id%22%3A%22819e1e389bd8c84%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%5D%2C%22ym_placement_id%22%3A%223076949134012260636%22%2C%22gpid%22%3A%22%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDH.A%23header-1%22%2C%22tid%22%3A%22fc35b2e4-f5dc-451a-88b2-0bd2df6dc24b%22%2C%22auctionId%22%3A%220dfb9534-1a9a-4fe0-9dcb-75a531e67bb6%22%7D%5D&page_url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&bust=1690461468552&dnt=false&description=Ehfmc%20is%20a%20website%20that%20writes%20about%20many%20topics%20of%20interest%20to%20you%2C%20it%27s%20a%20blog%20that%20shares%20knowledge%20and%20insights%20useful%20to%20everyone%20in%20many%20fields.&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%2C%22gpp%22%3A%22%22%2C%22gpp_sid%22%3A%5B%5D%7D&us_privacy=1---&pr=&scrd=1&title=Ehfmc%20-%20A%20General%20Blog&w=1600&h=1200&pubcid=8217a596-e105-4814-9f40-7d0549462d31&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22monumetric.com%22%2C%22sid%22%3A%22fdd82422-8575-448e-84fe-fa092518ca2d%22%2C%22hp%22%3A1%7D%5D%7D&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%228217a596-e105-4814-9f40-7d0549462d31%22%2C%22atype%22%3A1%7D%5D%7D%5D
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.167.233.116 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-167-233-116.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
access-control-allow-credentials: true
x-robots-tag: none,NOINDEX,NOFOLLOW
access-control-allow-methods: POST, GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

POST
H2 204 prebidvideo Show response
ads.yieldmo.com/exchange/ 0
329 B 20ms
15ms XHR
text/plain 54.167.233.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebidvideo
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.167.233.116 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-167-233-116.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 17 KB
8 KB 303ms
298ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUWWG7OK
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: d3d1b004d8b4376c4e1241a4ad5367f25a90bab847dec3041daa6b3195b19e6c

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Thu, 27 Jul 2023 12:37:48 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 393 B
427 B 181ms
177ms XHR
application/json 2602:803:c002:200::113
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23852&site_id=389792&zone_id=2276222&size_id=2&us_privacy=1---&rp_schain=1.0,1!monumetric.com,fdd82422-8575-448e-84fe-fa092518ca2d,1,,,&eid_pubcid.org=8217a596-e105-4814-9f40-7d0549462d31%5E1&rf=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&tg_i.domain=ehfmc-com.ngontinh24.com&tg_i.page=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&tg_i.pbadslot=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDH.A%23header-1&tk_flint=pbjs_lite_v7.54.2&x_source.tid=fc35b2e4-f5dc-451a-88b2-0bd2df6dc24b&l_pb_bid_id=8550e43ccf06397&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=fc35b2e4-f5dc-451a-88b2-0bd2df6dc24b&rp_maxbids=1&p_gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDH.A%23header-1&slots=1&rand=0.32035529468805435
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::113 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 9e995132580d8455ee5833a58979459458f28945ff267c7c8caa8538d1c85888

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 393
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 637e6546decb82d45236f0f8 Show response
prebid.cootlogix.com/prebid/multi/ 0
945 B 179ms
176ms XHR
text/plain 157.245.128.131
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.cootlogix.com/prebid/multi/637e6546decb82d45236f0f8
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 157.245.128.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:48 GMT
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
content-length: 0

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 144 B
968 B 152ms
150ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

b2a69eebab52ccb8ccaac45922881e25496070a6f44ef6f8cdafc63bb8ab1555

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
an-x-request-uuid: eb53c6c5-c846-4881-a5c2-fa9ba34d4e0a
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 144
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ 873 B
684 B 241ms
241ms XHR
application/json 147.28.146.89
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.146.89 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 9b3c40c9e2b87b90c008060cc143318685e8f36a91d08cc72e2aa8cc0a0c375d

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 229
content-length: 533

GET
H2 200 mmt.gif
imps.monu.delivery/ 37 B
530 B 63ms
3ms Image
image/gif 35.186.236.140
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imps.monu.delivery/mmt.gif?s=fd6252cc-2263-4692-8f56-3f75ffaf0701&a=b.r&u=4258afea-960f-419a-9cd3-d9b394374220&d=%7B%22utm%22%3A%7B%7D%7D
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.236.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.236.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2e4d08754839510a3d77ddf8205a515e51e4277c323932b10441196744ce757

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 15:29:22 GMT
age: 508106
x-guploader-uploadid: ADPycduIHy6YAHxUbCH4YY6frPAA8zQY1XelU3MQZ6pl_CxSz0ACX52Gs62UonijMozc-PKRLp_8WrhdhlUFeeiFnYvMuA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
last-modified: Wed, 12 Jul 2017 09:13:19 GMT
server: UploadServer
etag: "455005e2f4b8ecc484500fab08619f70"
x-goog-generation: 1499850799559224
x-goog-hash: crc32c=1zd0wQ==, md5=RVAF4vS47MSEUA+rCGGfcA==
content-type: image/gif
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37
accept-ranges: bytes
expires: Sat, 20 Jul 2024 15:29:22 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 694A 182 KB
47 KB 891ms
890ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202307200101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f5204c4cc7b24226ce5eb13339fcf3db4664839aab1a0787e517f4a9324687f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 48382
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:49 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 3 KB
2 KB 48ms
47ms XHR
application/json 35.168.216.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?lt=1690461468669&to=0&aun=mmt-ec27c27d-c540-4450-8b4c-9d3b869beb9f_1_1_ad&pubcid=8217a596-e105-4814-9f40-7d0549462d31&gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.A%23sidebar-1&pv=fff0983d-b165-41c1-91ef-d53851e10d5c&maxw=160&maxh=600&si=490025&pi=3&bf=160x600&uspConsent=1---&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%227.54.2%22%7D&ogu=null&ns=10240
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.216.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-216-217.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 8243bf74eb80d1e74fae02468ddb16978350eb1a0e057c0c012c295c7e5b6458

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 140 B
824 B 6ms
6ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

28e163c51ba8e3df68d331b987337d84fbe1ca5c64a690b97f9d15f11da9da57

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
an-x-request-uuid: c79f8b83-4c3d-4041-948f-80a1de93d7eb
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 140
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
67 B 115ms
113ms XHR
text/plain 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:47 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 17 KB
8 KB 112ms
112ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUWWG7OK
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 46a45a34762ed83a5df926b08e18cfffffd95d1b12492ac7cf4c4aff24e4c755

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Thu, 27 Jul 2023 12:37:48 GMT

POST
H2 204 637e6546decb82d45236f0f8 Show response
prebid.cootlogix.com/prebid/multi/ 0
945 B 114ms
114ms XHR
text/plain 157.245.128.131
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.cootlogix.com/prebid/multi/637e6546decb82d45236f0f8
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 157.245.128.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:48 GMT
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
content-length: 0

POST
H2 200 c Show response
prebid.a-mo.net/a/ 873 B
709 B 14ms
14ms XHR
application/json 147.28.146.89
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.146.89 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 2060a861327b912f5e298c0f9bb0243ac2be2e3105839c1479f4712b8205adb8

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
content-length: 534

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 181 B
318 B 36ms
36ms XHR
application/json 195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

9c0ccd5682b8bbeffa1d8aa8acbc89d92bcbb037e3ef49f2b9b9f9503f2e5742

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
x-content-type-options: nosniff
p3p: CP="CAO PSA OUR"
x-envoy-upstream-service-time: 32
content-length: 181
pragma: no-cache
server: ayl-lb-usa02
access-control-max-age: 3600
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding
access-control-allow-headers: Accept-Encoding, Content-Type
expires: 0

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 394 B
428 B 136ms
135ms XHR
application/json 2602:803:c002:200::113
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23852&site_id=389792&zone_id=2276222&size_id=9&us_privacy=1---&rp_schain=1.0,1!monumetric.com,fdd82422-8575-448e-84fe-fa092518ca2d,1,,,&eid_pubcid.org=8217a596-e105-4814-9f40-7d0549462d31%5E1&rf=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&tg_i.domain=ehfmc-com.ngontinh24.com&tg_i.page=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&tg_i.pbadslot=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.A%23sidebar-1&tk_flint=pbjs_lite_v7.54.2&x_source.tid=09480e9b-2911-453a-aacf-92fbe476b09f&l_pb_bid_id=1806a14cec3d0676&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=09480e9b-2911-453a-aacf-92fbe476b09f&rp_maxbids=1&p_gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.A%23sidebar-1&slots=1&rand=0.3039542904161814
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::113 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: c7cb56e477f33b9d445a955a66cce3d5164bc896e0827f824fd31ebee45f4c4e

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 394
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
67 B 107ms
106ms XHR
text/plain 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:48 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 139 B
823 B 5ms
5ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

3a959113b674a1b1e0634d5b3e67be2a4ab7fca1369bb55f34d2a11520ec3785

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
an-x-request-uuid: 6c64a604-5df9-42a8-8019-8b8213780d7d
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 139
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 180 B
317 B 88ms
88ms XHR
application/json 195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

127832ed8fa478aa555bd1d32bf488d8c6bcbc18b58f84b0a9ee267f11acb9f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
x-content-type-options: nosniff
p3p: CP="CAO PSA OUR"
x-envoy-upstream-service-time: 84
content-length: 180
pragma: no-cache
server: ayl-lb-usa02
access-control-max-age: 3600
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding
access-control-allow-headers: Accept-Encoding, Content-Type
expires: 0

GET
H2 200 prebid Show response
ads.yieldmo.com/exchange/ 16 KB
8 KB 282ms
272ms XHR
application/json 54.167.233.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebid?pbav=7.54.2&p=%5B%7B%22placement_id%22%3A%22mmt-0115eba8-b4ce-4839-bee5-c28a1c9b14c8_1_1_ad%22%2C%22callback_id%22%3A%22996dd339decaae6%22%2C%22sizes%22%3A%5B%5B160%2C600%5D%5D%2C%22ym_placement_id%22%3A%223076949134012260636%22%2C%22gpid%22%3A%22%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.J%23sidebar-10%22%2C%22tid%22%3A%227c538c29-6b98-4074-81e3-52c15bc802f4%22%2C%22auctionId%22%3A%2214235733-b4da-453e-b24c-c6aebef6cc87%22%7D%5D&page_url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&bust=1690461468686&dnt=false&description=Ehfmc%20is%20a%20website%20that%20writes%20about%20many%20topics%20of%20interest%20to%20you%2C%20it%27s%20a%20blog%20that%20shares%20knowledge%20and%20insights%20useful%20to%20everyone%20in%20many%20fields.&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%2C%22gpp%22%3A%22%22%2C%22gpp_sid%22%3A%5B%5D%7D&us_privacy=1---&pr=&scrd=1&title=Ehfmc%20-%20A%20General%20Blog&w=1600&h=1200&pubcid=8217a596-e105-4814-9f40-7d0549462d31&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22monumetric.com%22%2C%22sid%22%3A%22fdd82422-8575-448e-84fe-fa092518ca2d%22%2C%22hp%22%3A1%7D%5D%7D&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%228217a596-e105-4814-9f40-7d0549462d31%22%2C%22atype%22%3A1%7D%5D%7D%5D
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.167.233.116 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-167-233-116.compute-1.amazonaws.com
Software: /
Resource Hash: 606086c34bf04cc0dce9f9affe881d9a35cc7477d744c16361252e216f4a3e9c

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
vary: accept-encoding
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
access-control-request-headers: Cache-Control, Pragma

POST
H2 204 prebidvideo Show response
ads.yieldmo.com/exchange/ 0
359 B 29ms
20ms XHR
text/plain 54.167.233.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebidvideo
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.167.233.116 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-167-233-116.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

POST
H2 204 637e6546decb82d45236f0f8 Show response
prebid.cootlogix.com/prebid/multi/ 0
949 B 140ms
134ms XHR
text/plain 157.245.128.131
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.cootlogix.com/prebid/multi/637e6546decb82d45236f0f8
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 157.245.128.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:48 GMT
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
content-length: 0

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
15 B 16ms
10ms XHR
text/plain 3.232.158.174
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.232.158.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-158-174.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:48 GMT
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 3 KB
2 KB 54ms
50ms XHR
application/json 35.168.216.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?lt=1690461468689&to=0&aun=mmt-0115eba8-b4ce-4839-bee5-c28a1c9b14c8_1_1_ad&pubcid=8217a596-e105-4814-9f40-7d0549462d31&gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.J%23sidebar-10&pv=fff0983d-b165-41c1-91ef-d53851e10d5c&maxw=160&maxh=600&si=490025&pi=3&bf=160x600&uspConsent=1---&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%227.54.2%22%7D&ogu=null&ns=10240
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.216.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-216-217.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 66b5ba2b5b0785a827677972ec161498e7d0b06680c58fa8ca1dcc4842fe605c

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

POST
H3 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
94 B 48ms
46ms XHR
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: bb4265de9a59cda202be230fec19237d87a35a51af79052b21c050ed153ec89b

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

POST
H3 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
94 B 49ms
47ms XHR
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: bb4265de9a59cda202be230fec19237d87a35a51af79052b21c050ed153ec89b

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 395 B
429 B 156ms
152ms XHR
application/json 2602:803:c002:200::113
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23852&site_id=389792&zone_id=2276222&size_id=9&us_privacy=1---&rp_schain=1.0,1!monumetric.com,fdd82422-8575-448e-84fe-fa092518ca2d,1,,,&eid_pubcid.org=8217a596-e105-4814-9f40-7d0549462d31%5E1&rf=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&tg_i.domain=ehfmc-com.ngontinh24.com&tg_i.page=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&tg_i.pbadslot=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.J%23sidebar-10&tk_flint=pbjs_lite_v7.54.2&x_source.tid=7c538c29-6b98-4074-81e3-52c15bc802f4&l_pb_bid_id=10952a60f101319&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=7c538c29-6b98-4074-81e3-52c15bc802f4&rp_maxbids=1&p_gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.J%23sidebar-10&slots=1&rand=0.2428913237328043
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::113 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 260e0a3d5789ff5ba55b0e5e0c2045615bc7eb176ba2f0cffb3688ae0e8ec584

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 395
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ 873 B
681 B 14ms
12ms XHR
application/json 147.28.146.89
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.146.89 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: b68987f68a93f7ed219fcc64bd511633aae72129a0e43be7fabc230933b4421d

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:47 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 533

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 17 KB
8 KB 282ms
281ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUWWG7OK
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: a7168a2ec61bcc750b9cbe856d66ab8e5593c23d34d7302c8e1b161182d67a4c

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Thu, 27 Jul 2023 12:37:48 GMT

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ 730 B
1 KB 50ms
49ms XHR
application/json 69.166.1.14
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%221156fa6993603d5a%22%3A%22177369c437c672237248%7C160x600%7Cgpid%3D%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.J%23sidebar-10%2Cc%3Dv%2C%22%7D&ref=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&s=8bb39026-4735-4f23-af66-ceff5e823cb5&pv=9ad4e7ea-98fd-4147-a6b9-71e22bd44903&vp=desktop&lib_name=prebid&lib_v=7.54.2&us=5&iqid=%7B%22pcid%22%3A%229f1ce227-7a36-486b-a00e-09d1a9788223%22%2C%22pcidDate%22%3A1690461468187%7D&fpd=%7B%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22site%22%3A%7B%22domain%22%3A%22ehfmc-com.ngontinh24.com%22%2C%22publisher%22%3A%7B%22domain%22%3A%22ngontinh24.com%22%7D%2C%22page%22%3A%22https%3A%2F%2Fehfmc-com.ngontinh24.com%2F%22%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F115.0.5790.110%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%7D%7D&ius=0&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22monumetric.com%22%2C%22sid%22%3A%22fdd82422-8575-448e-84fe-fa092518ca2d%22%2C%22hp%22%3A1%7D%5D%7D&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%228217a596-e105-4814-9f40-7d0549462d31%22%2C%22atype%22%3A1%7D%5D%7D%5D&us_privacy=1---&coppa=0

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.14 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

6fd8281099116bf95742b944392d8c85fc1851032243f110adcc7dfdca332b49

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:48 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-9
Content-Type: application/json
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://ehfmc-com.ngontinh24.com
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Length: 441
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 wrap.js Show response
cdn.confiant-integrations.net/gptprebidnative/202307190925/ 251 KB
77 KB 40ms
15ms Script
application/javascript 2606:4700::6812:4a5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.confiant-integrations.net/gptprebidnative/202307190925/wrap.js
Requested by: Host: cdn.confiant-integrations.net
URL: https://cdn.confiant-integrations.net/OOh3bTrtb2nHyOwGk2LTO5SWo54/gpt_and_prebid/config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:4a5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e922a199c0736d84f1cb215cb5950484e8cf7c04011a35ccf28fd755aa5e7133

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 19 Jul 2023 13:26:13 GMT
server: cloudflare
x-amz-request-id: ZY5QNCWTRSZPHKYB
age: 675046
etag: W/"6c476793b39193c54a91ff561ef3a8e4"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7ed4ef93cb6c4322-EWR
alt-svc: h3=":443"; ma=86400
x-amz-id-2: XacmJfOuqNpu8Tr2F6XVVZ5iRh0xyQ9TLhI6leZnl6mJIhWNHp0Y5RY/zwr0qAicHrc190mJ/vM=

GET
H2 200 mmt.gif
imps.monu.delivery/ 37 B
99 B 8ms
7ms Image
image/gif 35.186.236.140
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imps.monu.delivery/mmt.gif?s=fd6252cc-2263-4692-8f56-3f75ffaf0701&a=b.r&u=26c15b8e-8080-4986-924e-050c0f0222d6&d=%7B%22utm%22%3A%7B%7D%7D
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.236.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.236.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2e4d08754839510a3d77ddf8205a515e51e4277c323932b10441196744ce757

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 15:29:22 GMT
age: 508106
x-guploader-uploadid: ADPycduIHy6YAHxUbCH4YY6frPAA8zQY1XelU3MQZ6pl_CxSz0ACX52Gs62UonijMozc-PKRLp_8WrhdhlUFeeiFnYvMuA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
last-modified: Wed, 12 Jul 2017 09:13:19 GMT
server: UploadServer
etag: "455005e2f4b8ecc484500fab08619f70"
x-goog-generation: 1499850799559224
x-goog-hash: crc32c=1zd0wQ==, md5=RVAF4vS47MSEUA+rCGGfcA==
content-type: image/gif
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37
accept-ranges: bytes
expires: Sat, 20 Jul 2024 15:29:22 GMT

GET
H3 200 11778604948800383788
tpc.googlesyndication.com/simgad/ Frame DA52 13 KB
13 KB 16ms
16ms Image
image/png 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11778604948800383788?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkAaLVHOOPz_bastxbvDcE70OBe7Q

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d2ec1c907004fb1a0d9ade9e9f5d3b19efb55a0319dbaadaea734d86cb5e4c66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 04:00:20 GMT
x-content-type-options: nosniff
age: 31048
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13781
x-xss-protection: 0
last-modified: Tue, 17 May 2022 14:15:49 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 26 Jul 2024 04:00:20 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/ Frame DA52 23 KB
9 KB 17ms
16ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93028274da1d373cd41165f6a442568ddd482370e8093e45d14a4ad0f6981f19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78220
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9132
x-xss-protection: 0
server: cafe
etag: 17712579318771444318
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame DA52 3 KB
1 KB 25ms
18ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:40:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57456
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:40:13 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame DA52 20 KB
8 KB 20ms
12ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ecb4fb492aee0a820dfc4a395fb80e2ac2e864bbf38aa1ae28d6d70fb9e6da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78221
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame DA52 0
0 107ms
38ms Image
text/html 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTvjtCVNhe-J_RxWK1Bd4BJIJtOPTa9wsuDAQcn6dZdyLHgZkS-IVff_pmMInxOaohZ5ZjVYcH1eKHZ_kURWSobo2vPhQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DA52 179 KB
56 KB 127ms
120ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f294f48a5bc171da79776780d32c77ae3323a508cb595a56f116ecb7578a8e7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57383
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690198756579870"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:49 GMT

GET
H3 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame DA52 33 KB
13 KB 24ms
18ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4938ae629cfe26eaeb48f79a64d380e0f2f29a63b0cf0c98ef4dd19039ed3d81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:57:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78029
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13567
x-xss-protection: 0
server: cafe
etag: 2495518695802652152
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:57:20 GMT

GET
H2 200 pwt.js Show response
ads.pubmatic.com/AdServer/js/pwt/159753/4709/1/ Frame 5574 254 KB
79 KB 192ms
6ms Script
text/javascript 184.50.204.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/pwt/159753/4709/1/pwt.js
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=632d59d7b9689f25ad20b012
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.50.204.192 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-50-204-192.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: c56fe8e86248dab9f5bd11df391c35cf45ac349aadd3b2a1df79091f4c103e90

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

unused62: 8096267
date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
last-modified: Mon, 21 Jun 2021 11:25:08 GMT
server: Apache/2.2.15 (CentOS)
etag: "1521081-3f9b9-5c544ed0518c4"
vary: Accept-Encoding
content-type: text/javascript
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=7666
accept-ranges: bytes
content-length: 80621
expires: Thu, 27 Jul 2023 14:45:35 GMT

GET
H2 200 avpb7.51.0.js Show response
player.aniview.com/script/6.1/libs/prebid/ Frame 5574 215 KB
69 KB 7ms
6ms Script
text/javascript 2600:1400:9000:2a8::2c79
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/libs/prebid/avpb7.51.0.js
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=632d59d7b9689f25ad20b012
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1400:9000:2a8::2c79 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 3dbc2be8525df2a16168708c0925d9b8451cc1dcf13ca3465d271f2561f7114f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycdsxrgwl5aUiPlUUe0aTOP-mp8M_lvyMAGqEy9KlWx_P2pFQVKZRBk9AT8FLXRQNhB4LMTafu6Aaa5xxPCliBjPdZXwczmsw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 69979
last-modified: Mon, 17 Jul 2023 12:05:23 GMT
server: UploadServer
etag: "34516a4b9a2222de3be17ddbfa74071a"
vary: Accept-Encoding
x-goog-generation: 1689595523142087
x-goog-hash: crc32c=PvKXNA==, md5=NFFqS5oiIt474X3b+nQHGg==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=600
x-goog-stored-content-length: 69979
accept-ranges: bytes
content-type: text/javascript; charset=UTF-8
expires: Thu, 27 Jul 2023 12:47:48 GMT

GET
H2 200 avpb7.51.0a0.js Show response
player.aniview.com/script/6.1/libs/prebid/ Frame 5574 68 KB
23 KB 16ms
15ms Script
text/javascript 2600:1400:9000:2a8::2c79
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/libs/prebid/avpb7.51.0a0.js
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=632d59d7b9689f25ad20b012
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1400:9000:2a8::2c79 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: b5b51d89a8486ee9a21480fef1232a4040f5362d7a13176e617a4cb6839166f4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycdvIwkIdoRP2SSlKm8BWqAQmGZMhjttDWaSXC32qTXRPSFhMcrzjJziFISPJ4a9VtfPhxuIwm-PvFyCyvjrPJRJrmJ9ybJfA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 23120
last-modified: Mon, 17 Jul 2023 12:05:23 GMT
server: UploadServer
etag: "9cf90b0b90ab4fb18f04c896f35f66b4"
vary: Accept-Encoding
x-goog-generation: 1689595523231495
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-goog-hash: crc32c=YfjNeQ==, md5=nPkLC5CrT7GPBMiW819mtA==
access-control-expose-headers: Content-Type
cache-control: public, max-age=600
x-goog-stored-content-length: 23120
accept-ranges: bytes
expires: Thu, 27 Jul 2023 12:47:48 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A67A 143 B
166 B 37ms
3ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=1663128080&adf=743467531&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466964&bpp=1&bdt=490&idt=272&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=584&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=h3JYZEuvl9&p=https%3A//ehfmc-com.ngontinh24.com&dtd=281

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=1663128080&adf=743467531&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466964&bpp=1&bdt=490&idt=272&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=584&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=h3JYZEuvl9&p=https%3A//ehfmc-com.ngontinh24.com&dtd=281
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 72
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:36:37 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 redir.html Show response
p4-gwyhc22pboc7c-4erul7yjt2qr7imo-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 7E0A 247 B
869 B 119ms
35ms Document
text/html 172.217.13.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-gwyhc22pboc7c-4erul7yjt2qr7imo-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=1663128080&adf=743467531&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466964&bpp=1&bdt=490&idt=272&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=584&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=h3JYZEuvl9&p=https%3A//ehfmc-com.ngontinh24.com&dtd=281

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f3.1e100.net

Software

sffe /

Resource Hash

193b095a6ea3eb7bc8efed638ee74c1f73805e6c8aaffd208c2ab604171ac58f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 204
content-security-policy-report-only: script-src 'nonce-08iUXnUuDW1VUaS0c6J_0Q' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:49 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
last-modified: Mon, 02 Dec 2019 20:15:00 GMT
pragma: no-cache
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 10EE 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 096b8429c20f586c65abd4b29f50de0b207adec7d1ff6a892b71d82a9f23aafc

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 mmt.gif
imps.monu.delivery/ 37 B
63 B 5ms
4ms Image
image/gif 35.186.236.140
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imps.monu.delivery/mmt.gif?s=fd6252cc-2263-4692-8f56-3f75ffaf0701&a=b.r&u=ec27c27d-c540-4450-8b4c-9d3b869beb9f&d=%7B%22utm%22%3A%7B%7D%7D
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.236.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.236.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2e4d08754839510a3d77ddf8205a515e51e4277c323932b10441196744ce757

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 02:10:33 GMT
age: 124036
x-guploader-uploadid: ADPycdtfTH7AOMIL8vASnI2SAUKO57hiMqR3KrgVyd3_EGuyzarfJLPV8txIzxbrXqaVDP4d4uU8hlF5HkVIIEB2LY4pnYBd5XPi
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
last-modified: Wed, 12 Jul 2017 09:13:19 GMT
server: UploadServer
etag: "455005e2f4b8ecc484500fab08619f70"
x-goog-generation: 1499850799559224
x-goog-hash: crc32c=1zd0wQ==, md5=RVAF4vS47MSEUA+rCGGfcA==
content-type: image/gif
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37
accept-ranges: bytes
expires: Thu, 25 Jul 2024 02:10:33 GMT

GET
H3 200 mmt.gif
imps.monu.delivery/ 37 B
63 B 26ms
6ms Image
image/gif 35.186.236.140
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imps.monu.delivery/mmt.gif?s=fd6252cc-2263-4692-8f56-3f75ffaf0701&a=b.r&u=df664826-5c9a-46f1-947a-56f39263c30d&d=%7B%22utm%22%3A%7B%7D%7D
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.236.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.236.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2e4d08754839510a3d77ddf8205a515e51e4277c323932b10441196744ce757

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 02:10:33 GMT
age: 124036
x-guploader-uploadid: ADPycdtfTH7AOMIL8vASnI2SAUKO57hiMqR3KrgVyd3_EGuyzarfJLPV8txIzxbrXqaVDP4d4uU8hlF5HkVIIEB2LY4pnYBd5XPi
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
last-modified: Wed, 12 Jul 2017 09:13:19 GMT
server: UploadServer
etag: "455005e2f4b8ecc484500fab08619f70"
x-goog-generation: 1499850799559224
x-goog-hash: crc32c=1zd0wQ==, md5=RVAF4vS47MSEUA+rCGGfcA==
content-type: image/gif
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37
accept-ranges: bytes
expires: Thu, 25 Jul 2024 02:10:33 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202307200101/ 154 KB
52 KB 81ms
78ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202307200101/reactive_library_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202307200101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8e11553f90799677e4e27678ce17f354c3cdb3bfa2968bbba32edaa08d6ccb4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53515
x-xss-protection: 0
server: cafe
etag: 3353127637891269429
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:49 GMT

GET
H3 200 ca-pub-7109864259348938 Show response
fundingchoicesmessages.google.com/i/ 150 KB
49 KB 71ms
68ms Script
application/javascript 2607:f8b0:4020:804::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/ca-pub-7109864259348938?ers=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202307200101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a23e6191360eb19e8201092866f47f56efc566c1b2fbb28caa9b3654ff05561e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-tEbhCDIqJ8ArOSiLw4uf4w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
content-security-policy: script-src 'report-sample' 'nonce-tEbhCDIqJ8ArOSiLw4uf4w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame DA52 0
0 42ms
36ms Fetch
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CiVbFG2XCZNnaO8GPhQat36DICrSI3Z1xwfevt9MQsJAfEAEgjdXeJGDJxqmLwKTYD6AB9-KbtCjIAQKoAwHIA8kEqgTXAU_Qq_-m7AVzdPpD_2cdLcTJ-ZN_1UOBjOYpT9q291qpvA1uvBW5C8waswm-vbc0MLs7NehEIKkA6nd8731KIHOoAsBzgdiN_m5tpq6SWZERIz96pFuK81eIyAZWeOIgO5LRFWsDaui18TPe-PC0Bnmf0dxmCXZKl7bBgPSpq4qGnUlaDvKAZFPwEMl42-NHh5zezR_Z9r06FBCo-agUcjUYyq_5Dw_2ueHjPG6fBkgDC6wRdZlIrA5KiIOPgfdIYE4xy82R_zTKGgtxMJ4IwpQgNCKjO-WBwATh9_fhgQSSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGAoAH95rskwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBD60AXSCBQIgGEQARgfMgKKAjoCgEBIvf3BOoAKAcgLAdgTDdAVAYAXAbIXHAoaCAASFHB1Yi03MTA5ODY0MjU5MzQ4OTM4GAA&sigh=0v0E_CA6EYo&uach_m=[UACH]&cid=CAQSKQBpAlJWfXlHOd8qqEaCk2cThXHWi0aTDWPSolxA8JLeRn2LM3sk3IroGAE

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 27 Jul 2023 12:37:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 3 KB
2 KB 73ms
52ms XHR
application/json 35.168.216.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?lt=1690461469151&to=0&aun=mmt-c4152799-e894-4662-a2a4-a42d312d81f7_1_1_ad&pubcid=8217a596-e105-4814-9f40-7d0549462d31&gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.A%23sidebar-1&pv=fff0983d-b165-41c1-91ef-d53851e10d5c&maxw=300&maxh=250&si=490027&pi=3&bf=300x250&uspConsent=1---&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%227.54.2%22%7D&ogu=null&ns=10240
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.216.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-216-217.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 7482d6f1948ce59d19e8da76859bf91790f93e966564bbf6ecf34030445da377

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

POST
H2 200 c Show response
prebid.a-mo.net/a/ 873 B
683 B 24ms
6ms XHR
application/json 147.28.146.89
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.146.89 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: b529495558db507e7d9a420160aefa6558eda8c5d484f600543567fe280b4ce5

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 535

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
67 B 118ms
99ms XHR
text/plain 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:49 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 204 637e6546decb82d45236f0f8 Show response
prebid.cootlogix.com/prebid/multi/ 0
942 B 123ms
105ms XHR
text/plain 157.245.128.131
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.cootlogix.com/prebid/multi/637e6546decb82d45236f0f8
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 157.245.128.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:49 GMT
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
content-length: 0

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 395 B
453 B 89ms
66ms XHR
application/json 2602:803:c002:200::113
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23852&site_id=389792&zone_id=2276222&size_id=15&us_privacy=1---&rp_schain=1.0,1!monumetric.com,fdd82422-8575-448e-84fe-fa092518ca2d,1,,,&eid_pubcid.org=8217a596-e105-4814-9f40-7d0549462d31%5E1&rf=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&tg_i.domain=ehfmc-com.ngontinh24.com&tg_i.page=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&tg_i.pbadslot=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.A%23sidebar-1&tk_flint=pbjs_lite_v7.54.2&x_source.tid=182305a3-a286-4812-95b6-3b991a3c1d39&l_pb_bid_id=19479c94c9627337&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=182305a3-a286-4812-95b6-3b991a3c1d39&rp_maxbids=1&p_gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.A%23sidebar-1&slots=1&rand=0.5466839786506201
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::113 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 63c49dce029bbb62bb5a7f4e520dd0846beff38f873db668336cbfe923277054

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 395
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
721 B 248ms
231ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUWWG7OK
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 9ba22f19fa6b72388de6bb20183b88854be819d44de649b48cd6894168fd5bfb

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Thu, 27 Jul 2023 12:37:49 GMT

POST
H2 200 v2 Show response
e.serverbid.com/api/ 16 B
202 B 26ms
9ms XHR
application/json 159.89.246.130
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://e.serverbid.com/api/v2
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 159.89.246.130 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
access-control-max-age: 10080
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept
content-length: 42

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 181 B
343 B 87ms
71ms XHR
application/json 195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

ee1ee7bf5e070e917c961f60f13abd987027e7f0a291a85a1714c615bb83c2ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
x-content-type-options: nosniff
p3p: CP="CAO PSA OUR"
x-envoy-upstream-service-time: 65
content-length: 181
pragma: no-cache
server: ayl-lb-usa02
access-control-max-age: 3600
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding
access-control-allow-headers: Accept-Encoding, Content-Type
expires: 0

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 145 B
969 B 162ms
147ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

a3622064de31882499d29d4665f7014dabf3473a568876d7472d443220dc9bc7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
an-x-request-uuid: 0f927bf0-e0dc-449d-bc8e-e959d6119caf
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 145
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C278 645 B
254 B 33ms
30ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLjgrKEEELPcp6oEGNbPqO8BMAE&v=APEucNU--2teWVZyFnxmqVWTX_lS9QBuQ9yoKOK31RTAp_yCbScf5ue-F8gYEMbi7QL56kEPtVXkzkRbTm6JugTT1b030Q7rCQFNo4Qe0cSgvqcN56gLdVQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame E44D 85 KB
29 KB 75ms
69ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b5c05892bdce212e19d0503253b600faaeedca47fa2db97964d412c8c11934e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29781
x-xss-protection: 0
server: cafe
etag: 4315658989838864570
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:49 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame E44D 3 KB
1 KB 17ms
12ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:40:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57456
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:40:13 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame E44D 20 KB
8 KB 18ms
13ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ecb4fb492aee0a820dfc4a395fb80e2ac2e864bbf38aa1ae28d6d70fb9e6da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78221
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame E44D 0
0 47ms
41ms Image
text/html 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTkAfu0jKuS2Ug_-N0rLEedtDPk0hGc97zwkHP0XkxPX9T0pggn04eI5rTeyVuNxlBzQKPQOX4RGbDMNrc_D2_poRr82A
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E44D 179 KB
56 KB 85ms
80ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f294f48a5bc171da79776780d32c77ae3323a508cb595a56f116ecb7578a8e7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57383
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690198756579870"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:49 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E44D 42 B
63 B 55ms
51ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CnustUNYRUEcf8coLMmyxBlUyBmBeDg6GMaizUUYYRkRzWya60pngwKIORB1yS5OcuK_r_iI-uW21ZTyHT_RICNGrYVlA5ckOgsJ5h9zReVZHNb2Q

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E44D 0
20 B 56ms
52ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=3579400355349208477&x=1&ct=76

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/ 387 KB
123 KB 6ms
6ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f0328e2fb29b89099a373146e174f4ab428b91248fc8b45a42e4d7f4b4470c7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 10:37:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7225
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 125599
x-xss-protection: 0
server: cafe
etag: 16205820047413048924
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Fri, 26 Jul 2024 10:37:24 GMT

GET
H2 200 pwt.js Show response
ads.pubmatic.com/AdServer/js/pwt/159753/4709/1/ Frame EF23 254 KB
79 KB 8ms
7ms Script
text/javascript 184.50.204.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/pwt/159753/4709/1/pwt.js
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=632d59d7b9689f25ad20b012
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.50.204.192 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-50-204-192.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: c56fe8e86248dab9f5bd11df391c35cf45ac349aadd3b2a1df79091f4c103e90

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

unused62: 8096267
date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
last-modified: Mon, 21 Jun 2021 11:25:08 GMT
server: Apache/2.2.15 (CentOS)
etag: "1521081-3f9b9-5c544ed0518c4"
vary: Accept-Encoding
content-type: text/javascript
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=163223
accept-ranges: bytes
content-length: 80621
expires: Sat, 29 Jul 2023 09:58:12 GMT

GET
H2 200 avpb7.51.0.js Show response
player.aniview.com/script/6.1/libs/prebid/ Frame EF23 215 KB
69 KB 43ms
3ms Script
text/javascript 2600:1400:9000:2a8::2c79
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/libs/prebid/avpb7.51.0.js
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=632d59d7b9689f25ad20b012
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1400:9000:2a8::2c79 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 3dbc2be8525df2a16168708c0925d9b8451cc1dcf13ca3465d271f2561f7114f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycdsxrgwl5aUiPlUUe0aTOP-mp8M_lvyMAGqEy9KlWx_P2pFQVKZRBk9AT8FLXRQNhB4LMTafu6Aaa5xxPCliBjPdZXwczmsw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 69979
last-modified: Mon, 17 Jul 2023 12:05:23 GMT
server: UploadServer
etag: "34516a4b9a2222de3be17ddbfa74071a"
vary: Accept-Encoding
x-goog-generation: 1689595523142087
x-goog-hash: crc32c=PvKXNA==, md5=NFFqS5oiIt474X3b+nQHGg==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=600
x-goog-stored-content-length: 69979
accept-ranges: bytes
content-type: text/javascript; charset=UTF-8
expires: Thu, 27 Jul 2023 12:47:49 GMT

GET
H2 200 avpb7.51.0a0.js Show response
player.aniview.com/script/6.1/libs/prebid/ Frame EF23 68 KB
23 KB 36ms
0ms Script
text/javascript 2600:1400:9000:2a8::2c79
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/libs/prebid/avpb7.51.0a0.js
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=632d59d7b9689f25ad20b012
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1400:9000:2a8::2c79 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: b5b51d89a8486ee9a21480fef1232a4040f5362d7a13176e617a4cb6839166f4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycdvIwkIdoRP2SSlKm8BWqAQmGZMhjttDWaSXC32qTXRPSFhMcrzjJziFISPJ4a9VtfPhxuIwm-PvFyCyvjrPJRJrmJ9ybJfA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 23120
last-modified: Mon, 17 Jul 2023 12:05:23 GMT
server: UploadServer
etag: "9cf90b0b90ab4fb18f04c896f35f66b4"
vary: Accept-Encoding
x-goog-generation: 1689595523231495
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-goog-hash: crc32c=YfjNeQ==, md5=nPkLC5CrT7GPBMiW819mtA==
access-control-expose-headers: Content-Type
cache-control: public, max-age=600
x-goog-stored-content-length: 23120
accept-ranges: bytes
expires: Thu, 27 Jul 2023 12:47:49 GMT

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 145 B
969 B 171ms
145ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

9dfddc65239d698f2ed0a0115b61ed6e77743a63dd6ea2b3174a0bef73a4e84c

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
an-x-request-uuid: db297430-dd2f-44d1-baa9-39d7dcca94b3
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 145
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 394 B
428 B 187ms
159ms XHR
application/json 2602:803:c002:200::113
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23852&site_id=389792&zone_id=2276222&size_id=9&us_privacy=1---&rp_schain=1.0,1!monumetric.com,fdd82422-8575-448e-84fe-fa092518ca2d,1,,,&eid_pubcid.org=8217a596-e105-4814-9f40-7d0549462d31%5E1&rf=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&tg_i.domain=ehfmc-com.ngontinh24.com&tg_i.page=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&tg_i.pbadslot=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.D%23sidebar-4&tk_flint=pbjs_lite_v7.54.2&x_source.tid=73379f0a-1011-46d5-a4e9-88b49cfce169&l_pb_bid_id=119a5d65ffffac53&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=73379f0a-1011-46d5-a4e9-88b49cfce169&rp_maxbids=1&p_gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.D%23sidebar-4&slots=1&rand=0.7608329370760349
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::113 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: daaa3db07cba7c580c445ce03ed774962e6268c16736c51a60301a247d4ef8e9

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 394
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 prebid Show response
ads.yieldmo.com/exchange/ 16 KB
8 KB 159ms
135ms XHR
application/json 54.167.233.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebid?pbav=7.54.2&p=%5B%7B%22placement_id%22%3A%22mmt-827fc8e0-82ff-4690-83c3-d2380c7524bb_1_1_ad%22%2C%22callback_id%22%3A%22121106dd1efde3cb%22%2C%22sizes%22%3A%5B%5B160%2C600%5D%5D%2C%22ym_placement_id%22%3A%223076949134012260636%22%2C%22gpid%22%3A%22%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.D%23sidebar-4%22%2C%22tid%22%3A%2273379f0a-1011-46d5-a4e9-88b49cfce169%22%2C%22auctionId%22%3A%22e8350092-e66e-40ee-b240-a84db154ae4f%22%7D%5D&page_url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&bust=1690461469263&dnt=false&description=Ehfmc%20is%20a%20website%20that%20writes%20about%20many%20topics%20of%20interest%20to%20you%2C%20it%27s%20a%20blog%20that%20shares%20knowledge%20and%20insights%20useful%20to%20everyone%20in%20many%20fields.&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%2C%22gpp%22%3A%22%22%2C%22gpp_sid%22%3A%5B%5D%7D&us_privacy=1---&pr=&scrd=1&title=Ehfmc%20-%20A%20General%20Blog&w=1600&h=1200&pubcid=8217a596-e105-4814-9f40-7d0549462d31&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22monumetric.com%22%2C%22sid%22%3A%22fdd82422-8575-448e-84fe-fa092518ca2d%22%2C%22hp%22%3A1%7D%5D%7D&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%228217a596-e105-4814-9f40-7d0549462d31%22%2C%22atype%22%3A1%7D%5D%7D%5D
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.167.233.116 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-167-233-116.compute-1.amazonaws.com
Software: /
Resource Hash: d62db3f8cebf345d9cae66a01480f8af6ab1c51799410e3772ab19ea85bbcb92

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
vary: accept-encoding
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
access-control-request-headers: Cache-Control, Pragma

POST
H2 204 prebidvideo Show response
ads.yieldmo.com/exchange/ 0
359 B 44ms
21ms XHR
text/plain 54.167.233.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebidvideo
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.167.233.116 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-167-233-116.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
39 B 29ms
7ms XHR
text/plain 3.232.158.174
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.232.158.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-158-174.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:49 GMT
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 17 KB
8 KB 128ms
106ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUWWG7OK
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: b93425f2265764aec6e41e96e4ae68e67909564681eedf23c0c395b0d48ab974

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Thu, 27 Jul 2023 12:37:49 GMT

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 180 B
317 B 78ms
57ms XHR
application/json 195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

128506127341d1084817b00ced7959494b4262700b341f7571a3f068c628dd1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
x-content-type-options: nosniff
p3p: CP="CAO PSA OUR"
x-envoy-upstream-service-time: 48
content-length: 180
pragma: no-cache
server: ayl-lb-usa02
access-control-max-age: 3600
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding
access-control-allow-headers: Accept-Encoding, Content-Type
expires: 0

POST
H2 200 c Show response
prebid.a-mo.net/a/ 873 B
681 B 30ms
9ms XHR
application/json 147.28.146.89
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.146.89 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 710e0345cc95577460ebc0188f5f8c18e1a02dd79bc8706ff77a6ebdd222ef03

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 533

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 3 KB
2 KB 77ms
46ms XHR
application/json 35.168.216.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?lt=1690461469268&to=0&aun=mmt-827fc8e0-82ff-4690-83c3-d2380c7524bb_1_1_ad&pubcid=8217a596-e105-4814-9f40-7d0549462d31&gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.D%23sidebar-4&pv=58e828f0-c867-44aa-b5d9-7b959fb0e011&maxw=160&maxh=600&si=490025&pi=3&bf=160x600&uspConsent=1---&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%227.54.2%22%7D&ogu=null&ns=10240
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.216.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-216-217.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 15fcb2209a5a8e43025c7d3b493782046a56b4e8a8277106d981316548ed63e2

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

POST
H3 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
94 B 61ms
53ms XHR
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: b27e73f0f92d8b75abf70c8ff826dba0eae23a0196613c9d681e091bd3bed1a1

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

POST
H3 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
94 B 43ms
35ms XHR
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: b27e73f0f92d8b75abf70c8ff826dba0eae23a0196613c9d681e091bd3bed1a1

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ 730 B
1 KB 57ms
41ms XHR
application/json 69.166.1.14
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%22135627038a8508c2%22%3A%22177369c437c672237248%7C160x600%7Cgpid%3D%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.D%23sidebar-4%2Cc%3Dv%2C%22%7D&ref=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&s=791a9c77-5fa0-4817-9e7a-e756abcee9c8&pv=9ad4e7ea-98fd-4147-a6b9-71e22bd44903&vp=desktop&lib_name=prebid&lib_v=7.54.2&us=5&iqid=%7B%22pcid%22%3A%229f1ce227-7a36-486b-a00e-09d1a9788223%22%2C%22pcidDate%22%3A1690461468187%7D&fpd=%7B%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22site%22%3A%7B%22domain%22%3A%22ehfmc-com.ngontinh24.com%22%2C%22publisher%22%3A%7B%22domain%22%3A%22ngontinh24.com%22%7D%2C%22page%22%3A%22https%3A%2F%2Fehfmc-com.ngontinh24.com%2F%22%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F115.0.5790.110%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%7D%7D&ius=0&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22monumetric.com%22%2C%22sid%22%3A%22fdd82422-8575-448e-84fe-fa092518ca2d%22%2C%22hp%22%3A1%7D%5D%7D&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%228217a596-e105-4814-9f40-7d0549462d31%22%2C%22atype%22%3A1%7D%5D%7D%5D&us_privacy=1---&coppa=0

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.14 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

bd817d7e482f6883fe8191b75b32c71de87513b35424c4ee125e3a468c990897

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:49 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-9
Content-Type: application/json
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://ehfmc-com.ngontinh24.com
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Length: 441
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 204 637e6546decb82d45236f0f8 Show response
prebid.cootlogix.com/prebid/multi/ 0
948 B 95ms
76ms XHR
text/plain 157.245.128.131
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.cootlogix.com/prebid/multi/637e6546decb82d45236f0f8
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 157.245.128.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:49 GMT
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
content-length: 0

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
67 B 135ms
116ms XHR
text/plain 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:49 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 1 KB
2 KB 31ms
21ms XHR
application/json 108.138.107.138
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fehfmc-com.ngontinh24.com&pubid=76b6d1d8-9f58-4ac7-a92e-f3232afccc8a
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.107.138 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-107-138.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 5f5e208de2301be66592c21ead21e62dc01077dcf598198e51700ae5ec595249

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
via: 1.1 f07e3fd03d3423bceb1c6083ab62cf8a.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: JFK50-P3
x-cache: Miss from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 1290
x-amz-cf-id: RW4JUd4zy7cWL0LLkXeUZ9KxGL8FZJCbUkV7hAzVptU1PsaODE4EWw==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 177 B
623 B 505ms
291ms XHR
text/javascript 18.164.98.157
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&pid=H6WAmorw7Vcp2&cb=0&ws=1600x1200&v=23.717.1557&t=1100&slots=%5B%7B%22sd%22%3A%22mmt-4258afea-960f-419a-9cd3-d9b394374220_1_1_ad%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%22%7D%5D&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&gpp_sid=%5B-1%5D&pubid=76b6d1d8-9f58-4ac7-a92e-f3232afccc8a&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.98.157 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

23ec1263e2a15adf385123af43b556754925c404943d7c08bb8a88a2152eba13

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 1abf103face183cd8172f37e6ac30038.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: JFK50-P5
x-amz-rid: FCVV6AY2XS0VPTQ90146
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 177
x-amz-cf-id: lGYxlFLWzzYv49_7sAnLZTv-CzvW3I2SabG2MZuwhLLzGAAieNYsXA==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 177 B
623 B 400ms
199ms XHR
text/javascript 18.164.98.157
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&pid=H6WAmorw7Vcp2&cb=1&ws=1600x1200&v=23.717.1557&t=1100&slots=%5B%7B%22sd%22%3A%22mmt-26c15b8e-8080-4986-924e-050c0f0222d6_1_1_ad%22%2C%22s%22%3A%5B%22300x250%22%2C%22160x600%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%22%7D%5D&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&gpp_sid=%5B-1%5D&pubid=76b6d1d8-9f58-4ac7-a92e-f3232afccc8a&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.98.157 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

f610aff149f075e5db6073ee7c3313391381855060ec1bd86a7a268e83a30d7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 1abf103face183cd8172f37e6ac30038.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: JFK50-P5
x-amz-rid: 5R0B1KZG39HMY0AXSJ6Z
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 177
x-amz-cf-id: Znr59P0mgs-L3A4EP0gVOkyvhgfNm3ArA9ICxYK1kZLujqhmuCiVfg==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 177 B
624 B 405ms
214ms XHR
text/javascript 18.164.98.157
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&pid=H6WAmorw7Vcp2&cb=2&ws=1600x1200&v=23.717.1557&t=1100&slots=%5B%7B%22sd%22%3A%22mmt-df664826-5c9a-46f1-947a-56f39263c30d_1_1_ad%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%22%7D%5D&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&gpp_sid=%5B-1%5D&pubid=76b6d1d8-9f58-4ac7-a92e-f3232afccc8a&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.98.157 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

2cfb349eb865b42cf3ab295d44f659f88aa42c052004f7d4b37bbabfa48a167d

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 1abf103face183cd8172f37e6ac30038.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: JFK50-P5
x-amz-rid: 3C1HC6FHHGJRJVAWDKCQ
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 177
x-amz-cf-id: FCjFl7ixf7rt5YduPBTwe-tVeU64GS2qPKppZXWKg_ULsZrg5IOFwQ==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 177 B
622 B 384ms
198ms XHR
text/javascript 18.164.98.157
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&pid=H6WAmorw7Vcp2&cb=3&ws=1600x1200&v=23.717.1557&t=1100&slots=%5B%7B%22sd%22%3A%22mmt-0115eba8-b4ce-4839-bee5-c28a1c9b14c8_1_1_ad%22%2C%22s%22%3A%5B%22160x600%22%5D%2C%22sn%22%3A%22%22%7D%5D&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&gpp_sid=%5B-1%5D&pubid=76b6d1d8-9f58-4ac7-a92e-f3232afccc8a&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.98.157 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

1498f98b6f9677d66dd10401d7d833c56c0a467117787de38f00d62977cb0d6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 1abf103face183cd8172f37e6ac30038.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: JFK50-P5
x-amz-rid: 32ZFSM2H3DEDVB222T1P
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 177
x-amz-cf-id: bELtH9u0QTSrpiZ-nTJwdH2y_6dX--FEuEzrdosX0MWd9CSQMwrZ_w==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 177 B
626 B 331ms
154ms XHR
text/javascript 18.164.98.157
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&pid=H6WAmorw7Vcp2&cb=4&ws=1600x1200&v=23.717.1557&t=1100&slots=%5B%7B%22sd%22%3A%22mmt-827fc8e0-82ff-4690-83c3-d2380c7524bb_1_1_ad%22%2C%22s%22%3A%5B%22160x600%22%5D%2C%22sn%22%3A%22%22%7D%5D&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&gpp_sid=%5B-1%5D&pubid=76b6d1d8-9f58-4ac7-a92e-f3232afccc8a&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.98.157 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

95a118ef7576bbea07e904f3c3fab0d5e2f458927586e76a3a7d6cb08c502e5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 1abf103face183cd8172f37e6ac30038.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: JFK50-P5
x-amz-rid: DWMXFKBP2P4T62VT9V7C
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 177
x-amz-cf-id: AGzwTJKcHQkMhwSOLORDhGIzMANq8PqETuqUJblV3dMuN6kkPxPaLA==

GET
H2 200 %7B%22_tl%22%3A%22aps-tag%22%2C%22_type%22%3A%22featureUsage%22%2C%22src%22%3A%22kraken%22%2C%22pubid%22%3A%2276b6d1d8-9f58-4ac7-a92e-f3232afccc8a%22%2C%22p%22%3A%5B%7B%22cat%22%3A%22log%252Flibrar... Show response
aax.amazon-adsystem.com/x/px/p/PH/ 43 B
417 B 195ms
18ms Fetch
image/gif 18.164.98.157
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/x/px/p/PH/%7B%22_tl%22%3A%22aps-tag%22%2C%22_type%22%3A%22featureUsage%22%2C%22src%22%3A%22kraken%22%2C%22pubid%22%3A%2276b6d1d8-9f58-4ac7-a92e-f3232afccc8a%22%2C%22p%22%3A%5B%7B%22cat%22%3A%22log%252Flibrary%252FdidUseFeature%22%2C%22feat%22%3A%22started%22%7D%5D%2C%22u%22%3A%22https%253A%252F%252Fehfmc-com.ngontinh24.com%252F%22%2C%22lv%22%3A%2223.717.1557%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.98.157 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 5ba825173b1f7429171e730e7ae12588.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: JFK50-P5
x-amz-rid: ZPE1JMJXX1GR9PD9S1E1
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: no-cache
content-length: 43
x-amz-cf-id: TsM8AFtfmxIR8ML6bBUupBzMz-2SPH1HTu8ZTyrDApolwwhmL97FLQ==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 177 B
622 B 376ms
206ms XHR
text/javascript 18.164.98.157
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&pid=H6WAmorw7Vcp2&cb=5&ws=1600x1200&v=23.717.1557&t=1100&slots=%5B%7B%22sd%22%3A%22mmt-8ac367b4-1fc1-4e9e-90a8-296aa003810e_1_1_ad%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%22%7D%5D&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&gpp_sid=%5B-1%5D&pubid=76b6d1d8-9f58-4ac7-a92e-f3232afccc8a&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.98.157 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

6e0931413e693ec3417a7e4fc01266b2e32aee3f8b2de6bc5a77c590114f0cbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 1abf103face183cd8172f37e6ac30038.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: JFK50-P5
x-amz-rid: DA0RCTGM4AK7GV9XPRDK
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 177
x-amz-cf-id: T-etQ16tKpdn1tj6Ce83_Pl9z3kab7GmQDSkh3fFklLL2iZj3yKzBA==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 177 B
622 B 367ms
194ms XHR
text/javascript 18.164.98.157
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&pid=H6WAmorw7Vcp2&cb=6&ws=1600x1200&v=23.717.1557&t=1100&slots=%5B%7B%22sd%22%3A%22mmt-ec27c27d-c540-4450-8b4c-9d3b869beb9f_1_1_ad%22%2C%22s%22%3A%5B%22160x600%22%5D%2C%22sn%22%3A%22%22%7D%5D&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&gpp_sid=%5B-1%5D&pubid=76b6d1d8-9f58-4ac7-a92e-f3232afccc8a&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.98.157 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

2789d31fb76c21ec97233637b009ff89ad21eb082b8eda0051096e318292fa21

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 1abf103face183cd8172f37e6ac30038.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: JFK50-P5
x-amz-rid: 93XJ43RJJ5RBJZWTWP77
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 177
x-amz-cf-id: YHOp2j5j1FibDQv0YyABVTCWEg3c1udjGleSGfi-Yeso-Fliu4R8ZQ==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 177 B
623 B 334ms
171ms XHR
text/javascript 18.164.98.157
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&pid=H6WAmorw7Vcp2&cb=7&ws=1600x1200&v=23.717.1557&t=1100&slots=%5B%7B%22sd%22%3A%22mmt-c4152799-e894-4662-a2a4-a42d312d81f7_1_1_ad%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%22%7D%5D&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&gpp_sid=%5B-1%5D&pubid=76b6d1d8-9f58-4ac7-a92e-f3232afccc8a&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.98.157 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

5accbe4f09d60fd0a86f06f49eca9e83fe87af4d13781194957bb908cce79697

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 1abf103face183cd8172f37e6ac30038.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: JFK50-P5
x-amz-rid: CRCMNKK47F92GV5RX4J2
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 177
x-amz-cf-id: sntJcZ1Eex88_wiJD87N4SWzVEHKuMEbCCaY3ipNZ0eqnH8h1q8BfA==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 64ms
54ms XHR
application/javascript 108.138.107.138
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.107.138 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-107-138.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:50 GMT
x-amz-version-id: rBtfgJUMGYsy5fZuQwMAU7hSD.fVdF76
content-encoding: gzip
via: 1.1 e87e1498b0d1acb21c287e606097161a.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P3
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
last-modified: Sat, 24 Jun 2023 09:19:11 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: 9h6mYwuGShp43npIE1gs9zt2f_1thR3FRHWoqVDvq3HjZ-AKrYyd5g==

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/x/px/p/PH/%7B%22_tl%22%3A%22aps-tag%22%2C%22_type%22%3A%22featureUsage%22%2C%22src%22%3A%22kraken%22%2C%22pubid%22%3A%2276b6d1d8-9f58-4ac7-a92e-f3232afccc8a%22%2C%22p%22%3A%5B%7B%22cat%22%3A%22log%252Flibrary%252FdidUseFeature%22%2C%22feat%22%3A%22cancelled%22%7D%5D%2C%22u%22%3A%22https%253A%252F%252Fehfmc-com.ngontinh24.com%252F%22%2C%22lv%22%3A%2223.717.1557%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.98.157 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 5ba825173b1f7429171e730e7ae12588.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: JFK50-P5
x-amz-rid: GPHESZ9ZFMWQ6AK3D4ND
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: no-cache
content-length: 43
x-amz-cf-id: cb5CyTs1Oca6XEZq_5Ob8_gg91IYxePJGp04pIs2tMR-Pdkj85AE2g==

GET
H3 200 mmt.gif
imps.monu.delivery/ 37 B
63 B 6ms
6ms Image
image/gif 35.186.236.140
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imps.monu.delivery/mmt.gif?s=fd6252cc-2263-4692-8f56-3f75ffaf0701&a=b.r&u=0115eba8-b4ce-4839-bee5-c28a1c9b14c8&d=%7B%22utm%22%3A%7B%7D%7D
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.236.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.236.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2e4d08754839510a3d77ddf8205a515e51e4277c323932b10441196744ce757

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 02:10:33 GMT
age: 124036
x-guploader-uploadid: ADPycdtfTH7AOMIL8vASnI2SAUKO57hiMqR3KrgVyd3_EGuyzarfJLPV8txIzxbrXqaVDP4d4uU8hlF5HkVIIEB2LY4pnYBd5XPi
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
last-modified: Wed, 12 Jul 2017 09:13:19 GMT
server: UploadServer
etag: "455005e2f4b8ecc484500fab08619f70"
x-goog-generation: 1499850799559224
x-goog-hash: crc32c=1zd0wQ==, md5=RVAF4vS47MSEUA+rCGGfcA==
content-type: image/gif
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37
accept-ranges: bytes
expires: Thu, 25 Jul 2024 02:10:33 GMT

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 47ms
46ms Image
image/gif 2607:f8b0:4020:804::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=1&rn=1.8121363866723765

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-_ZPHzdT-AhN_olf4A2ROyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-_ZPHzdT-AhN_olf4A2ROyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 48ms
47ms Image
image/gif 2607:f8b0:4020:804::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=2&rn=4.472310014406997

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-y9qJfil7gcv9vKnoXCOTbw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-y9qJfil7gcv9vKnoXCOTbw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ctrack
track1.avplayer.com/ 0
98 B 14ms
13ms Image
text/plain 35.169.83.220
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.avplayer.com/ctrack?pt=2&d66=8.2.12&stagid=&stplid=&pid=632d59d7b9689f25ad20b012&cid=633172fb22e9a25a4645a127&r=ehfmc-com.ngontinh24.com&sn=&cd1=&cd2=&cd3=&app=&test=&cb=1690461469449&e=cpst&cvid=&cpid=&str=autostart&vi=100&wi=300&he=250
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.83.220 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-83-220.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 ctrack
track1.avplayer.com/ 0
98 B 20ms
19ms Image
text/plain 35.169.83.220
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.avplayer.com/ctrack?pt=2&d66=8.2.12&stagid=&stplid=&pid=632d59d7b9689f25ad20b012&cid=633172fb22e9a25a4645a127&r=ehfmc-com.ngontinh24.com&sn=&cd1=&cd2=&cd3=&app=&test=&cb=1690461469449&e=cply&cvid=&cpid=&str=autostart&vi=100&wi=300&he=250
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.83.220 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-83-220.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame B454 143 B
166 B 18ms
7ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 72
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:36:37 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 services Show response
g2.gumgum.com/zones/f1wmpn59/ 1 KB
961 B 35ms
17ms XHR
application/json 35.168.216.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/zones/f1wmpn59/services?dp=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&pu=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&rf=&r=3.88.11&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A2%2C%22ren%22%3A2%2C%22fc%22%3A0%2C%22ctx%22%3A%5B2%5D%2C%22jsv%22%3A%223.88.11%22%2C%22pbv%22%3A%220.0.0%22%7D&ns=10240&bf=9a7a4f54232f935deb49029bb84ef1586755ad3a&ce=true&fs=false&dpr=1&sch=1200&scw=1600&lt=1690461469539&to=0&vpii=false&vph=1200&vpw=1600&gdprApplies=0&uspConsent=1---
Requested by: Host: js.gumgum.com
URL: https://js.gumgum.com/services.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.216.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-216-217.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 04f9b2cec6ecff95221b7665476f7d7af7bb7cb295c3f9018973cc4c067fca3e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
server: nginx
etag: W/"0d4f167d80798c6eb5dd72b6a61e8eda9"
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
timing-allow-origin: *

POST
H2 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 47ms
41ms Fetch
text/html 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202307200101/show_ads_impl_fy2021.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 15 KB
6 KB 151ms
151ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

a20e500a647e328658158463523562d1ffe783d101d9216d180d27282237b3ec

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
an-x-request-uuid: 81f2edc4-cef3-4396-8e14-25ef37098afa
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 393 B
427 B 200ms
199ms XHR
application/json 2602:803:c002:200::113
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23852&site_id=389792&zone_id=2276222&size_id=2&us_privacy=1---&rp_schain=1.0,1!monumetric.com,fdd82422-8575-448e-84fe-fa092518ca2d,1,,,&eid_pubcid.org=8217a596-e105-4814-9f40-7d0549462d31%5E1&rf=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&tg_i.domain=ehfmc-com.ngontinh24.com&tg_i.page=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&tg_i.pbadslot=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDH.I%23header-9&tk_flint=pbjs_lite_v7.54.2&x_source.tid=ac37abff-6a35-4799-b6f7-86182c9d1242&l_pb_bid_id=14320933c2acb4e2&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=ac37abff-6a35-4799-b6f7-86182c9d1242&rp_maxbids=1&p_gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDH.I%23header-9&slots=1&rand=0.8469264036564152
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::113 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 70905c47c5e52c373df30aa8a494486fc894371b7e6c60be843b71ce5b1f5203

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 393
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 v2 Show response
e.serverbid.com/api/ 16 B
226 B 8ms
8ms XHR
application/json 159.89.246.130
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://e.serverbid.com/api/v2
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 159.89.246.130 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
access-control-max-age: 10080
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept
content-length: 42

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 3 KB
2 KB 47ms
47ms XHR
application/json 35.168.216.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?lt=1690461469601&to=0&aun=mmt-8ac367b4-1fc1-4e9e-90a8-296aa003810e_1_1_ad&pubcid=8217a596-e105-4814-9f40-7d0549462d31&gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDH.I%23header-9&pv=fff0983d-b165-41c1-91ef-d53851e10d5c&maxw=728&maxh=90&si=490032&pi=3&bf=728x90&uspConsent=1---&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%227.54.2%22%7D&ogu=null&ns=10240
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.216.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-216-217.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 199a6ab3134b4185187381e6484298380d8acf55343acbc50e162cb7d4fe3cf2

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

POST
H2 200 c Show response
prebid.a-mo.net/a/ 873 B
681 B 29ms
12ms XHR
application/json 147.28.146.89
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.146.89 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: d62bcb7c6fcc48a9e33e4155af3bd46e7fe30270ae26d52012d1d32d91d3985f

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:48 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 4
content-length: 531

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 181 B
318 B 91ms
87ms XHR
application/json 195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

a242c170c4f365af77590eb054683d11c218e3e239d705e14ae6ee234bc01f80

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
x-content-type-options: nosniff
p3p: CP="CAO PSA OUR"
x-envoy-upstream-service-time: 82
content-length: 181
pragma: no-cache
server: ayl-lb-usa02
access-control-max-age: 3600
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding
access-control-allow-headers: Accept-Encoding, Content-Type
expires: 0

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ 729 B
1 KB 29ms
26ms XHR
application/json 69.166.1.14
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%22153453b939b1d22%22%3A%224038e93c4d4c13bc38d7%7C728x90%7Cgpid%3D%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDH.I%23header-9%2Cc%3Dd%2C%22%7D&ref=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&s=68d6e160-211a-4930-90ea-a7f744881983&pv=9ad4e7ea-98fd-4147-a6b9-71e22bd44903&vp=desktop&lib_name=prebid&lib_v=7.54.2&us=5&iqid=%7B%22pcid%22%3A%229f1ce227-7a36-486b-a00e-09d1a9788223%22%2C%22pcidDate%22%3A1690461468187%7D&fpd=%7B%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22site%22%3A%7B%22domain%22%3A%22ehfmc-com.ngontinh24.com%22%2C%22publisher%22%3A%7B%22domain%22%3A%22ngontinh24.com%22%7D%2C%22page%22%3A%22https%3A%2F%2Fehfmc-com.ngontinh24.com%2F%22%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F115.0.5790.110%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%7D%7D&ius=0&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22monumetric.com%22%2C%22sid%22%3A%22fdd82422-8575-448e-84fe-fa092518ca2d%22%2C%22hp%22%3A1%7D%5D%7D&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%228217a596-e105-4814-9f40-7d0549462d31%22%2C%22atype%22%3A1%7D%5D%7D%5D&us_privacy=1---&coppa=0

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.14 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

5884cac6f07ec7025c1aa4f7160de939771db598f5ce883a4f55829ac515fc33

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:49 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-9
Content-Type: application/json
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://ehfmc-com.ngontinh24.com
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Length: 440
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 204 637e6546decb82d45236f0f8 Show response
prebid.cootlogix.com/prebid/multi/ 0
945 B 160ms
156ms XHR
text/plain 157.245.128.131
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.cootlogix.com/prebid/multi/637e6546decb82d45236f0f8
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 157.245.128.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:49 GMT
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
content-length: 0

POST
H3 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
94 B 53ms
51ms XHR
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: c47254c3d3cafce72f7e894e705d69d5f5be4b2457ffcaf11f82faf9a7d43cbe

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
67 B 106ms
104ms XHR
text/plain 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:49 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 17 KB
8 KB 102ms
100ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUWWG7OK
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 88cb62f733a54c7a3556cbf923ac28ac26196dfef09f246361727d16febf329c

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Thu, 27 Jul 2023 12:37:49 GMT

GET
H2 204 prebid Show response
ads.yieldmo.com/exchange/ 0
231 B 286ms
283ms XHR
text/plain 54.167.233.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebid?pbav=7.54.2&p=%5B%7B%22placement_id%22%3A%22mmt-8ac367b4-1fc1-4e9e-90a8-296aa003810e_1_1_ad%22%2C%22callback_id%22%3A%22163161a6ce8e9f77%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%5D%2C%22ym_placement_id%22%3A%223076949134012260636%22%2C%22gpid%22%3A%22%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDH.I%23header-9%22%2C%22tid%22%3A%22ac37abff-6a35-4799-b6f7-86182c9d1242%22%2C%22auctionId%22%3A%222aea0ab9-0eba-46ba-9632-38d2ab4dbe29%22%7D%5D&page_url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&bust=1690461469634&dnt=false&description=Ehfmc%20is%20a%20website%20that%20writes%20about%20many%20topics%20of%20interest%20to%20you%2C%20it%27s%20a%20blog%20that%20shares%20knowledge%20and%20insights%20useful%20to%20everyone%20in%20many%20fields.&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%2C%22gpp%22%3A%22%22%2C%22gpp_sid%22%3A%5B%5D%7D&us_privacy=1---&pr=&scrd=1&title=Ehfmc%20-%20A%20General%20Blog&w=1600&h=1200&pubcid=8217a596-e105-4814-9f40-7d0549462d31&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22monumetric.com%22%2C%22sid%22%3A%22fdd82422-8575-448e-84fe-fa092518ca2d%22%2C%22hp%22%3A1%7D%5D%7D&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%228217a596-e105-4814-9f40-7d0549462d31%22%2C%22atype%22%3A1%7D%5D%7D%5D
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.167.233.116 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-167-233-116.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
access-control-allow-credentials: true
x-robots-tag: none,NOINDEX,NOFOLLOW
access-control-allow-methods: POST, GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 177 B
623 B 193ms
193ms XHR
text/javascript 18.164.98.157
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&pid=H6WAmorw7Vcp2&cb=8&ws=1600x1200&v=23.717.1557&t=1100&slots=%5B%7B%22sd%22%3A%22mmt-3da146d5-1cf2-4be4-9079-b2f1c2c61187_1_1_ad%22%2C%22s%22%3A%5B%22300x250%22%2C%22160x600%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%22%7D%5D&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&gpp_sid=%5B-1%5D&pubid=76b6d1d8-9f58-4ac7-a92e-f3232afccc8a&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.98.157 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

d2a464d105450aefa4605df27171afd3f71047759525c4cffa3a2b86fb434ab0

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 1abf103face183cd8172f37e6ac30038.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: JFK50-P5
x-amz-rid: 7DG90SCJ1QTV8V0MFBWX
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 177
x-amz-cf-id: wy7Ehffur6oCWNx7-E0eWz7LtsT7bwzHn1HK-rNHZH1qNqP_R_ZG_g==

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame CECF 668 B
266 B 29ms
27ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLrYRBDi21gY35Tk4QEwAQ&v=APEucNWLaZ7cNoM-nyN5Ze3L0tLT_eQef-zBh8iOCPw6vF-d4zveE3R6Ioq2g9uMLludVnN2MR-g2yTJuoulVfRH9y9EnnIDuHypPqb1nvkc1tnKPXGdHrY

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=2294626326&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466970&bpp=1&bdt=495&idt=1510&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&fsb=1&xpc=hDyHm3Dgx6&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1515

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8015a89c7e50b71a6597cfc7bc2be462212ae1f57c37e40878a79e7550768ccd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=2294626326&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466970&bpp=1&bdt=495&idt=1510&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&fsb=1&xpc=hDyHm3Dgx6&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1515
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 246
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame ADD9 85 KB
29 KB 46ms
44ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=2294626326&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466970&bpp=1&bdt=495&idt=1510&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&fsb=1&xpc=hDyHm3Dgx6&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1515

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b5c05892bdce212e19d0503253b600faaeedca47fa2db97964d412c8c11934e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29781
x-xss-protection: 0
server: cafe
etag: 4315658989838864570
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:49 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame ADD9 3 KB
1 KB 13ms
11ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=2294626326&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466970&bpp=1&bdt=495&idt=1510&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&fsb=1&xpc=hDyHm3Dgx6&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1515

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:40:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57456
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:40:13 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame ADD9 20 KB
8 KB 14ms
11ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=2294626326&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466970&bpp=1&bdt=495&idt=1510&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&fsb=1&xpc=hDyHm3Dgx6&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1515

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ecb4fb492aee0a820dfc4a395fb80e2ac2e864bbf38aa1ae28d6d70fb9e6da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78221
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame ADD9 0
0 43ms
39ms Image
text/html 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTLNLSSYJqC9ea3x1dzUi8E6KMIlosCBx5OrlBzUwp485ulagJAXrq47Yaz6Fut9cnj3Nuo_6M-RCls0RT6oAYNtrqFAQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=2294626326&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466970&bpp=1&bdt=495&idt=1510&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&fsb=1&xpc=hDyHm3Dgx6&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1515
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame ADD9 179 KB
56 KB 58ms
56ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=2294626326&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466970&bpp=1&bdt=495&idt=1510&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&fsb=1&xpc=hDyHm3Dgx6&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1515

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f294f48a5bc171da79776780d32c77ae3323a508cb595a56f116ecb7578a8e7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57383
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690198756579870"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:49 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame ADD9 42 B
63 B 55ms
51ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BT8OtAloitxwiuUHk8QViNXWr7x6qX0Azku2Y33bPrrKnB5idDqGkdAhol4m9d6bMXrfNW7kks59r2raWdH-F6Y7N0GLS0RnZqBEqV1FQzul4Weo0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=2294626326&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466970&bpp=1&bdt=495&idt=1510&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&fsb=1&xpc=hDyHm3Dgx6&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1515

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame ADD9 0
20 B 54ms
50ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=9848365699106064599&x=1&ct=76

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=2294626326&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466970&bpp=1&bdt=495&idt=1510&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&fsb=1&xpc=hDyHm3Dgx6&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1515

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 10EE 33 KB
34 KB 48ms
5ms Font
font/woff2 2607:f8b0:4006:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2003 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 04:45:59 GMT
x-content-type-options: nosniff
age: 546710
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 20 Jul 2024 04:45:59 GMT

GET
DATA 200
OK truncated
/ Frame A3EC 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6e0c737295bbc366c4ec0bfceb31a242d37290bed03d48e920d2e39ea9d419ff

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C278
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKRmHiMdR8ya0votIi9suRA&google_cver=1&gdpr=0

43 B
766 B

5ms
5ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKRmHiMdR8ya0votIi9suRA&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLjgrKEEELPcp6oEGNbPqO8BMAE&v=APEucNU--2teWVZyFnxmqVWTX_lS9QBuQ9yoKOK31RTAp_yCbScf5ue-F8gYEMbi7QL56kEPtVXkzkRbTm6JugTT1b030Q7rCQFNo4Qe0cSgvqcN56gLdVQ
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:50 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKRmHiMdR8ya0votIi9suRA&google_cver=1&gdpr=0
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C278
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZMJlHrxKtywSipqqcGg9AQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKRmHiMdR8ya0votIi9suRA&google_cver=1

43 B
632 B

16ms
5ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKRmHiMdR8ya0votIi9suRA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLjgrKEEELPcp6oEGNbPqO8BMAE&v=APEucNU--2teWVZyFnxmqVWTX_lS9QBuQ9yoKOK31RTAp_yCbScf5ue-F8gYEMbi7QL56kEPtVXkzkRbTm6JugTT1b030Q7rCQFNo4Qe0cSgvqcN56gLdVQ
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:51 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKRmHiMdR8ya0votIi9suRA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame C278
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEPjZOhBh7FC2LTaa_o2t_PA&google_cver=1

43 B
841 B

5ms
4ms

Image
image/gif

68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEPjZOhBh7FC2LTaa_o2t_PA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLjgrKEEELPcp6oEGNbPqO8BMAE&v=APEucNU--2teWVZyFnxmqVWTX_lS9QBuQ9yoKOK31RTAp_yCbScf5ue-F8gYEMbi7QL56kEPtVXkzkRbTm6JugTT1b030Q7rCQFNo4Qe0cSgvqcN56gLdVQ

Protocol

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
an-x-request-uuid: 157c88bf-f2c8-4404-bdcf-308e9f6ea7d2
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEPjZOhBh7FC2LTaa_o2t_PA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C278
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzQzNzQ4MDQwODY0MjAxOTUwMg%3D%3D

170 B
188 B

40ms
39ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzQzNzQ4MDQwODY0MjAxOTUwMg%3D%3D

Requested by

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
an-x-request-uuid: 4210d88f-5fb3-4258-941c-d9e9472225fd
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzQzNzQ4MDQwODY0MjAxOTUwMg%3D%3D
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3B6D 1 KB
643 B 25ms
17ms Document
text/html 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 58801
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:17:48 GMT
etag: 48472445140208031
expires: Thu, 27 Jul 2023 20:17:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 cac0c864edda0087bf141d240f6ef92e.js Show response
www.gstatic.com/mysidia/ Frame 694A 9 KB
4 KB 18ms
11ms Script
text/javascript 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/cac0c864edda0087bf141d240f6ef92e.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6d046447e30e2ecffe5f823e770fca36fff69966f98f67b6fee1acc5c37bdb61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:51:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 56785
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3959
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 20:41:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 24 Oct 2023 20:51:24 GMT

GET
H2 200 5529604523bf1021996c9e114ecf8778.js Show response
www.gstatic.com/mysidia/ Frame 694A 138 KB
51 KB 19ms
12ms Script
text/javascript 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/5529604523bf1021996c9e114ecf8778.js?tag=video_location/web_och

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a347bd4b83684c7949b0c420f0a70d82fb84b8c2bc01b6f10086e44a960945c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 18:29:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 151727
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51995
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 20:41:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 23 Oct 2023 18:29:02 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 694A 14 KB
1 KB 48ms
41ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 27 Jul 2023 12:21:40 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 27 Jul 2023 12:37:49 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame 694A 2 KB
892 B 15ms
12ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78223
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/ Frame 694A 23 KB
9 KB 17ms
14ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93028274da1d373cd41165f6a442568ddd482370e8093e45d14a4ad0f6981f19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78223
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9132
x-xss-protection: 0
server: cafe
etag: 17712579318771444318
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame 694A 3 KB
1 KB 17ms
15ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:40:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57458
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:40:13 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame 694A 20 KB
8 KB 21ms
16ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ecb4fb492aee0a820dfc4a395fb80e2ac2e864bbf38aa1ae28d6d70fb9e6da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78221
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 694A 0
0 39ms
36ms Image
text/html 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTj1BRewg88oYYYqo4HpZax8kbgDgBVgtfuilGUFoiKCeXgaiVtyKIwASSJ7dgMT99vnILuiqRNl9G73qi_j38AJcTsPg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 694A 179 KB
56 KB 51ms
47ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f294f48a5bc171da79776780d32c77ae3323a508cb595a56f116ecb7578a8e7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57383
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690198756579870"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:51 GMT

GET
H3 200 39d4397462e2693449f221f9915f9e59.js Show response
www.gstatic.com/mysidia/ Frame 694A 33 KB
14 KB 17ms
15ms Script
text/javascript 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/39d4397462e2693449f221f9915f9e59.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

67edbe1fe2a38ebf16fc36b42cc267e37f18629ec79feae7a177178bf6e24d89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 17:55:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 153752
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14179
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 20:41:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 23 Oct 2023 17:55:19 GMT

GET
H2 200 iframe.html Show response
p4-gwyhc22pboc7c-4erul7yjt2qr7imo-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 7E0A 5 KB
2 KB 455ms
37ms Document
text/html 172.217.13.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-gwyhc22pboc7c-4erul7yjt2qr7imo-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html

Requested by

Host: p4-gwyhc22pboc7c-4erul7yjt2qr7imo-if-v6exp3-v4.metric.gstatic.com
URL: https://p4-gwyhc22pboc7c-4erul7yjt2qr7imo-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f3.1e100.net

Software

sffe /

Resource Hash

fa2a9e0b0822211208871a356755e52a76563c5589110fdb5ed2589b44ccf8ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://p4-gwyhc22pboc7c-4erul7yjt2qr7imo-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 1984
content-security-policy-report-only: script-src 'nonce-cb_uvKS3Fhi0-erN8G3HwQ' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:50 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
last-modified: Fri, 03 Feb 2023 22:38:00 GMT
pragma: no-cache
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 inscreen Show response
g2.gumgum.com/ 3 KB
1 KB 152ms
138ms XHR
application/json 35.168.216.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/inscreen?pu=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&rf=&pv=6e8c1a5e-d8c8-4379-b2f5-87bd088ff026&r=3.88.11&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A2%2C%22ren%22%3A2%2C%22fc%22%3A0%2C%22ctx%22%3A%5B2%5D%2C%22jsv%22%3A%223.88.11%22%2C%22pbv%22%3A%220.0.0%22%7D&ns=10240&bf=9a7a4f54232f935deb49029bb84ef1586755ad3a&ce=true&fs=false&dpr=1&sch=1200&scw=1600&lt=1690461469855&to=0&vpii=false&vph=1200&vpw=1600&t=f1wmpn59&gdprApplies=0&sqc=1&uspConsent=1---
Requested by: Host: js.gumgum.com
URL: https://js.gumgum.com/services.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.216.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-216-217.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e75b715344dc466bd9a52e0a01e09cc291c5e248b0463cd9f66ba05c80e57f62

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
server: nginx
etag: W/"02d1bde7723d776b0aa373f67206a1d71"
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
timing-allow-origin: *

GET
H2 400 15333
stags.bluekai.com/site/ 0
145 B 510ms
89ms Image
text/plain 23.52.164.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stags.bluekai.com/site/15333?id=u_587908ec-ee73-4995-b782-4d4a3a2a29c3
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.164.232 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-164-232.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:50 GMT
content-length: 0
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://idsync.rlcdn.com/395736.gif?partner_uid=u_587908ec-ee73-4995-b782-4d4a3a2a29c3
https://idsync.rlcdn.com/1000.gif?memo=CNiTGBIxCi0IARD6bBomdV81ODc5MDhlYy1lZTczLTQ5OTUtYjc4Mi00ZDRhM2EyYTI5YzMQABoNCJ7KiaYGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=d232794c8a2528272e698ea0d81518d96f13b073aa5aa2e03ba25ed91edb75e0791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=d232794c8a2528272e698ea0d81518d96f13b073aa5aa2e03ba25ed91edb75e0791426b5417dce21&rand=00575220
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=d232794c8a2528272e698ea0d81518d96f13b073aa5aa2e03ba25ed91edb75e0791426b5417dce21&rand=00575220&expected_cookie=4c59dab6-376e-4f09-875b-85c148695ff1

0
143 B

30ms
29ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=d232794c8a2528272e698ea0d81518d96f13b073aa5aa2e03ba25ed91edb75e0791426b5417dce21&rand=00575220&expected_cookie=4c59dab6-376e-4f09-875b-85c148695ff1
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 149D9C8273D14B058532527B0CFBB516 Ref B: EWR30EDGE1612 Ref C: 2023-07-27T12:37:52Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYBdzuRwSx2F9yCLyZURg==

Redirect headers

date: Thu, 27 Jul 2023 12:37:50 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 2683897BE4CF48FC8EF3C4D24A70B2D6 Ref B: EWR30EDGE1612 Ref C: 2023-07-27T12:37:51Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: /db_sync?pid=10339&puuid=d232794c8a2528272e698ea0d81518d96f13b073aa5aa2e03ba25ed91edb75e0791426b5417dce21&rand=00575220&expected_cookie=4c59dab6-376e-4f09-875b-85c148695ff1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYBdzuFVfGGZKWWgfG2MQ==

GET
H2

200

gdpr_consent=
bcp.crwdcntrl.net/map/ct=y/c=9217/tp=GMGM/tpid=u_587908ec-ee73-4995-b782-4d4a3a2a29c3/gdpr=0/
Redirect Chain

https://bcp.crwdcntrl.net/map/c=9217/tp=GMGM/tpid=u_587908ec-ee73-4995-b782-4d4a3a2a29c3/gdpr=0/gdpr_consent=
https://bcp.crwdcntrl.net/map/ct=y/c=9217/tp=GMGM/tpid=u_587908ec-ee73-4995-b782-4d4a3a2a29c3/gdpr=0/gdpr_consent=

49 B
738 B

29ms
25ms

Image
image/gif

54.160.214.90
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/ct=y/c=9217/tp=GMGM/tpid=u_587908ec-ee73-4995-b782-4d4a3a2a29c3/gdpr=0/gdpr_consent=
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 54.160.214.90 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-160-214-90.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.33.13
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location: https://bcp.crwdcntrl.net/map/ct=y/c=9217/tp=GMGM/tpid=u_587908ec-ee73-4995-b782-4d4a3a2a29c3/gdpr=0/gdpr_consent=
cache-control: no-cache
x-server: 10.40.47.119
content-length: 0
expires: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E44D 0
20 B 42ms
41ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7562879887687&version=m202306200101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E44D 0
20 B 54ms
49ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7562879887687&version=m202306200101&ct=76&x=1&cor=3579400355349208600

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame E44D 88 KB
37 KB 51ms
50ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AYVOp8XxK4kE5iz3c7pF-Y9lRQg7siW0j5plYjYrBJaagqJdpwvWBvs_46AZsPtRMUP69ajkUkQkCcqoa56cBXXBFkSQ&cry=1&dbm_d=AKAmf-BmJkhXXAhKJaMrajeqlBGgZ0ONWZFjfk0xsUQdNrBNhC40DYGSRXX3R9SRp0TTdYIPYjsJvCPjZNRqq_fuFqR4Pkl28e6zK9V6hbhQ_FoyzAvcopjuXAIUYOdd_FJutBQiuA2kSCu6vOfNUvwTCkEMh0ac5GazZqODdczOyBQzpjyKw9Dpg4HGFU8lmQiLO6DRLeiFpaIaE3vK3mfKlOTeoe_rNgl33e8uA4YLZddj8bkbri4VI-a4k29zM_B5U8HDeKygerNhfaAKoX3LqstYXDM-PQHgeVPn12nXayzWN7FBDmjEjJsDWtJm46WnXF4GjPNtj-NBE2J1F9hKTmIbP7oudxY5TVdE4DdY69Qu4k6ea9zt1UNcFXIhEzMawDnHy-70OvDjdkXzz9wiDJHE-3FmHrUZON9QkAlmi8eVUc1i86-M4TWTfHIw8G4j6rAe0hNRf_ZyUzL-gBGkYciXXokXAYERzzQIOFBq-5qhH-vX_1cA9BNuOe1AUS7NMqr3XamxlidbgH02KX6uei0FllrhBhZ-l3ZVabSuQeqsy90zHY_K7gWrPe0b_rpnt0_ZhBU6yXlrU1dFYFByZzH2Y84zYuhLGYKAr38yRVzRtOyvosBuOJFQqsO-TUU4clHrwTywyE9gPUT0W8l-JL7HRODr61tslaERTzo2tQMjsQGUKysYYnNzR7q7tNNnvk1zTwe4dm6FHDVuceHEpHrfOzp__D9DRmsC1y5OHdwaJ_8AZC-2_0Et_R09P8TRlFnoTNlbjqc1TaSQoLs_9iwNRqwmIwdnFIr94VRhTUgf7bgt6PsxSrQED5bROYzNst1SxX3NbfKB5oEbwytXi-Cu79YlCqTE08pZSvc-WQLkjVgp69fmcjNge6vvpJ5V9iYnPucQK7OstpuV1MWg8uBhN8NZnCLdl6xbBrcc2H7XHC_5Ef5tdBWTom4AbTCUCEx68Z1NtXCVpANKWcnR-LxZbjaM5fZNeZ8HunSPqZl48bGOoGWfwD879OX2Gv4rJ6Lw3vxp7K1peMWKTGDfLFo9NH5bUD5_rMIBZcy1hAtpCWuC3GNQq7jGzArbDW_o4C65DtAeS1J3qaglmKCM04XGzzJjGc-smFwszsY4mNyS32ex-mRDx2MgBfQoPpjYdiuWMvgyjXcUm7jzUC3tkllUcaqAvsuTfKdbJiojwkj0RvNsVZgKp9FPFy-SnSauhlemBXzI1ubAkLqgT6W0pi0gr0vJwwai0AOPlyW9wVr5nVn1qjtr89JDRtkpeb3YpQpucN-XLojATyp32gvQHfdebrjd5CfKOzWmhNczOhPCrd_v1n1oCP2NYvUapzGVfgl4aDqwUfF1mGdDHgI2NS5WQIJQC4Q7kAjBCAkthVK9pWNPBx6ak1JMHuNmQ-lAxHStKD9MdYX5Q7r_uswKRM8IVwBMB5zMC-oUYaDmW0a-QjOtCKPRsM_RKwa81bmKXx6BlrRc0X6TtaVePVLj9PmJJ3KUkFnxDqVVbfZOmk3gg8LfOW6Pqbhu4uisZveGpi0lkKvNmoVb0rizKi0O22SXtAnJYqUX29vAbyOnEFWCVo41Fc4LgCVtkLKsDYBOLCL9iPWMq27WC-lepOw8fdoqVViVv-v6nkU4jfiZv5c_yCsKODYb5ZdJ_rwY2w1Td_OGtP3-g3EINBFrjML1aFqVQrO3VQC71-AP2FEzAk83DvzifokHWnbVaWRbHb2zl5phtVvLunEF93U9oSpBEgD74lRt9O_1TOsMfnu2YO8F236WT27oJkLVKbiKcvXwXsF9twA1FXnUGlZfyQrOZgRJzAStZzkGdZywqKk7VYUl3wwm01biqP0F-KYUoUuUPBQtdwAi5W-1uzxkzg9FAGDJfzU8ObAhMp6yM5hSWZisQc3QstTUmsuATtUSlgRZRUPWeCkjwAFC2R_84IZgJE-e3naN8SKXx8RUhc5pFiudtj-dab5e7R9P0txZndlOxhZqpL3i-jlmk1iWoVwxbKbqw8kZQk_IUY7Ut8-8Lty0cL4r3iBF0LU8Fm3ugQ0O2HLc2cMRFYYA-jYdxEFRkq81tTgusWVny4qWKTQj4P6hpftxKc8tgvhsbft5o2aUa7DKzZ0qAhhcPdQQkVukZjPFYZTdoYrzsvLUOd9JBz8w_RoRWXp9S-X66_wQ0MkQk3k0ksLU3-5PKsP1SdywOv4pXUrslUzcxyhCFBsloE_5H-JI03O7TI0QvhSUZEjVYmIX5bwBw29CKcaS6P4XnI-ZSbSoN9A2J8U57m2iiXRJwJQbFzBzYUjAKhmfgoo5zEUU7ZEnCCHMLkqNMswI26LgrtsMm53qiic8uvQXC1UoOEwIqxPHVv0G5xzYTlEKM8ryO2mCvzx3OPmkD1Wpjn-7TpddHZIMp2A_5tgILT0tFwWiEVF1dwle-Dt58NgVzkxRI6SCgLCf2n4gmAHsE6B7-NfVpt5r4SsP81teQ3ct7tvyO7U8wRnBEjceo8Lb9ZvVkSYnEM0eZ_aZbH_mqRLlJFZrY7wht4bbvEMD_UTEsDU-kDMFf3MMdqMND_ehNdrZcpVbi-H5dLWvo4Md5LH1dJoD8jjnay_Fl3IqFn8jtKnVoqEHje8Y6VhzTWaLoplLTUNFclX2hhKGeM8GS-WmgGd92KLXBb0dCr4JSKbwum8OQHIvFAX7jP_ZPmqgzAi-mLuQHhdu7CDoe7v0ra8BfIFLfjG0Fd83hIF-HUQ5aW0WISpsgYU1KKo7ffb_zF1ib7sAC4wmAoF3hQh_9IMDTu5xA1OFbfg7pwU008R05ncvEyPf9dela2QwNAyndv5Yagvocv8RAH9V28rjaiopNAW2FVaz3HNJGtVARl0d9yStYq2c4OzRX6jJAJo04bY4CCbOmzyNDIddvr6m9SGEejNvuZI4r5XfY6SEygh6li1e5-St0yJ6xX2v6QUkBg-2eMQoBF8aZen1LZxeyd2i2y79XfyjQIzUUv6lhPWYsJZECbta57moTVHNDokOOGWEmNmkvKgQ4egKDLFYxc9USODbUy2_p-sEU2Rwwg0PCEdllqtQEu3kF7of8NEYKmkS2VQI3HuJ6vi9GGQ_V0GirEotfEnaIfKRoV9421IzIqSB85WqX4x3HtwG2a49Xp3mCct9LYQZ27uwVKP-lBG-kT5nh5oYsQs3nGGoECuUdhnEf3CCWC-CrQT9fTg5zBCegmSQty0cmefjH0-cyLxp8cwIUlwPXgyccqn0YLfh9PkQj_zOxoohn6-125mh14gsQiejLLJdIRj_q2wzzLgbqkCdMbfyLfEbrwsawSFvQLIP4lFGQEplBfuQIyb6d0OekWk7Q9VBzT09JPX609_GvZJ7nAoaVT45CMAML-3NLE3g88SfW8gLIvtCXYao2lBTlTbp&cid=CAQSKQBpAlJWzY0bIBzU6w2_RbHAj2CbW_j7xPxXhX1muXWicelitmPW9lwTGAE&dv3_ver=m202306200101&rfl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ds=l&xdt=1&iif=1&cor=3579400355349208600&adk=2215386029&idt=88&cac=0&dtd=55

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c1b91c46bbd709568f02afe6a6ab044894c732c850f6a1d046b5360b37ac6e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37375
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxVePXm0lc3dLSnp97HygheM6vwdhOZQ0Klsh22k2dcSzBMfETX3hrlgn7Q3Xaf-mi1hu2owsuNw6hVnwRTUF5MM18JaFgVR2EoaW6ik4ebowSqaMVt996O_8znMFy-33AGAJY4a2A== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 51ms
48ms XHR
text/html 2607:f8b0:4020:804::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVePXm0lc3dLSnp97HygheM6vwdhOZQ0Klsh22k2dcSzBMfETX3hrlgn7Q3Xaf-mi1hu2owsuNw6hVnwRTUF5MM18JaFgVR2EoaW6ik4ebowSqaMVt996O_8znMFy-33AGAJY4a2A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-0jJjcWnEV-vn0A70EVR5VA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:50 GMT
content-security-policy: script-src 'report-sample' 'nonce-0jJjcWnEV-vn0A70EVR5VA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame CECF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEG0abUQYKqKxvLgVRUV-6Lw&google_cver=1&gdpr=0

43 B
171 B

26ms
24ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEG0abUQYKqKxvLgVRUV-6Lw&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLrYRBDi21gY35Tk4QEwAQ&v=APEucNWLaZ7cNoM-nyN5Ze3L0tLT_eQef-zBh8iOCPw6vF-d4zveE3R6Ioq2g9uMLludVnN2MR-g2yTJuoulVfRH9y9EnnIDuHypPqb1nvkc1tnKPXGdHrY
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEG0abUQYKqKxvLgVRUV-6Lw&google_cver=1&gdpr=0
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 306
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CECF
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&gdpr=0&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&gdpr=0&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZDAyMTBlZjQtNjVjZS0yM2FiLWNjYTMtZjAxYzZjNDU1NDQ3

170 B
188 B

40ms
39ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZDAyMTBlZjQtNjVjZS0yM2FiLWNjYTMtZjAxYzZjNDU1NDQ3

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLrYRBDi21gY35Tk4QEwAQ&v=APEucNWLaZ7cNoM-nyN5Ze3L0tLT_eQef-zBh8iOCPw6vF-d4zveE3R6Ioq2g9uMLludVnN2MR-g2yTJuoulVfRH9y9EnnIDuHypPqb1nvkc1tnKPXGdHrY

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 27 Jul 2023 12:37:50 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZDAyMTBlZjQtNjVjZS0yM2FiLWNjYTMtZjAxYzZjNDU1NDQ3
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

um
sync.teads.tv/ Frame CECF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm&gdpr=0
https://sync.teads.tv/um?eid=3&uid=CAESEPfAn0olmzQ68qJIgwUGCdo&google_cver=1&gdpr=0

23 B
163 B

19ms
14ms

Image
image/gif

23.52.164.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEPfAn0olmzQ68qJIgwUGCdo&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLrYRBDi21gY35Tk4QEwAQ&v=APEucNWLaZ7cNoM-nyN5Ze3L0tLT_eQef-zBh8iOCPw6vF-d4zveE3R6Ioq2g9uMLludVnN2MR-g2yTJuoulVfRH9y9EnnIDuHypPqb1nvkc1tnKPXGdHrY
Protocol: H2
Server: 23.52.164.7 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-164-7.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

expires: Thu, 27 Jul 2023 12:37:50 GMT
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEPfAn0olmzQ68qJIgwUGCdo&google_cver=1&gdpr=0
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 292
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CECF
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&gdpr=0&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZDk1Yzc5MTItMjQzNC00MzgxLTg3M2MtZDdkNzMxNGY5MWQy

170 B
188 B

39ms
37ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZDk1Yzc5MTItMjQzNC00MzgxLTg3M2MtZDdkNzMxNGY5MWQy

Requested by

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
server: akka-http/10.2.10
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZDk1Yzc5MTItMjQzNC00MzgxLTg3M2MtZDdkNzMxNGY5MWQy
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Thu, 27 Jul 2023 12:37:50 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 39ms
10ms Preflight
application/json 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&domain=ehfmc-com.ngontinh24.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://ehfmc-com.ngontinh24.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 27 Jul 2023 12:37:50 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 366344
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&domain=ehfmc-com.ngontinh24.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=FLtii3xQTkd3clhPSnlBL2xKWVJPS0hRTGRNaS9GdkhlS0NwNzZOY3hRRDZSVkgzYVRoQjRzaXkzYUNzbmZ6YkMra3BrNlpKd3lhb3pUaHdtVDQ5b3N0VW1RRjlRZDNvWThiY0JNOTQ1b0lIOFp5Z1o2N2VMYVk5YkdiZ2...

357 B
648 B

28ms
9ms

XHR
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=FLtii3xQTkd3clhPSnlBL2xKWVJPS0hRTGRNaS9GdkhlS0NwNzZOY3hRRDZSVkgzYVRoQjRzaXkzYUNzbmZ6YkMra3BrNlpKd3lhb3pUaHdtVDQ5b3N0VW1RRjlRZDNvWThiY0JNOTQ1b0lIOFp5Z1o2N2VMYVk5YkdiZ2hYL3pkOTZuUmJuNXg1c0FDajhsa0duUXNOajE5R2VWWG91MkJRZ3ZNZHVTLzFoWVlhN1h5VEEySEdmblN4ditMQlNMdEtHVm1jUzhuUUFvZTBlMHdxcnZycnhqdTdyMDJNeUhuV2RtdTlyQkpUbjRZUHJUeVFBSUZDSEQ3OGxlcGxCNlNpOVdMfA&cppv=2

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

d9debd36cafa90566876623c376eb441e09b36275afbef5ffe791303bcbe89a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1023515
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
access-control-allow-methods: GET
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
location: https://mug.criteo.com/sid?cpp=FLtii3xQTkd3clhPSnlBL2xKWVJPS0hRTGRNaS9GdkhlS0NwNzZOY3hRRDZSVkgzYVRoQjRzaXkzYUNzbmZ6YkMra3BrNlpKd3lhb3pUaHdtVDQ5b3N0VW1RRjlRZDNvWThiY0JNOTQ1b0lIOFp5Z1o2N2VMYVk5YkdiZ2hYL3pkOTZuUmJuNXg1c0FDajhsa0duUXNOajE5R2VWWG91MkJRZ3ZNZHVTLzFoWVlhN1h5VEEySEdmblN4ditMQlNMdEtHVm1jUzhuUUFvZTBlMHdxcnZycnhqdTdyMDJNeUhuV2RtdTlyQkpUbjRZUHJUeVFBSUZDSEQ3OGxlcGxCNlNpOVdMfA&cppv=2
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 277401
content-length: 0
expires: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 10EE 0
19 B 43ms
42ms Image
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CWHCUG2XCZOzdD8K3hQaI8IvIAcPZhsJxks_O-PoQ2dkeEAEgjdXeJGDJxqmLwKTYD6ABiLyQzALIAQmoAwHIA8sEqgTYAU_QUJhqmrYc7WgYr_zFI2zlehnsebAj1t10JU8Qm4W6kDVsOr4AHSyz9FjnyqLNFp1a414aErw9Z-8JlqlAbeNRn78s_41rL27bTxirGtNWO5QTDuhe-5Rrsu_526_kcqFG4fgCMQ6DrF5SmqkNmKxz3n4_Fgu_Jom9jV3sUfiD8z1Y5QtAdY8uOj9SgmI3B_x9EAvNbdp3tWr-RNZqUx36a6EamEeQ0CvxL4YbnEsJzzzDwTYuGKIKMm-tKbW4Uup60MdoAsM6jEFiGHqWu4yoRidCgLOycMAEndTG_ZQEkgUECAQYAZIFBAgFGASgBi6AB-DD77MBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwQQrZUc0ggUCIBhEAEYHzICigI6AoBASL39wTqACgHICwHYEwyIFAHQFQGYFgGAFwGyFxwKGggAEhRwdWItNzEwOTg2NDI1OTM0ODkzOBgA&sigh=9L6UoAu8LVo&uach_m=[UACH]&cid=CAQSGwBpAlJWc28yCiwHH8UAp1z5HhXtRwM17Jc1XxgB&template_id=5000&cbvp=2&vis=1

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=676577707&adf=3215562993&pi=t.ma~as.3925753591&w=1200&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=1200x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466960&bpp=4&bdt=486&idt=250&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=142&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=NyFGanNH0J&p=https%3A//ehfmc-com.ngontinh24.com&dtd=267
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 27 Jul 2023 12:37:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 mmt.gif
imps.monu.delivery/ 37 B
63 B 20ms
6ms Image
image/gif 35.186.236.140
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imps.monu.delivery/mmt.gif?s=fd6252cc-2263-4692-8f56-3f75ffaf0701&a=b.r&u=827fc8e0-82ff-4690-83c3-d2380c7524bb&d=%7B%22utm%22%3A%7B%7D%7D
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.236.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.236.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2e4d08754839510a3d77ddf8205a515e51e4277c323932b10441196744ce757

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 02:10:33 GMT
age: 124037
x-guploader-uploadid: ADPycdtfTH7AOMIL8vASnI2SAUKO57hiMqR3KrgVyd3_EGuyzarfJLPV8txIzxbrXqaVDP4d4uU8hlF5HkVIIEB2LY4pnYBd5XPi
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
last-modified: Wed, 12 Jul 2017 09:13:19 GMT
server: UploadServer
etag: "455005e2f4b8ecc484500fab08619f70"
x-goog-generation: 1499850799559224
x-goog-hash: crc32c=1zd0wQ==, md5=RVAF4vS47MSEUA+rCGGfcA==
content-type: image/gif
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37
accept-ranges: bytes
expires: Thu, 25 Jul 2024 02:10:33 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 417 B
474 B 223ms
203ms XHR
application/json 2602:803:c002:200::113
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23852&site_id=389792&zone_id=2276222&size_id=15&alt_size_ids=9%2C10&us_privacy=1---&rp_schain=1.0,1!monumetric.com,fdd82422-8575-448e-84fe-fa092518ca2d,1,,,&eid_pubcid.org=8217a596-e105-4814-9f40-7d0549462d31%5E1&rf=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&tg_i.domain=ehfmc-com.ngontinh24.com&tg_i.page=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&tg_i.pbadslot=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.B%23sidebar-2&tk_flint=pbjs_lite_v7.54.2&x_source.tid=0c17ff69-39e2-4ff7-be09-48376628c470&l_pb_bid_id=206e2d6d78ac856d&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=0c17ff69-39e2-4ff7-be09-48376628c470&rp_maxbids=1&p_gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.B%23sidebar-2&slots=1&rand=0.36337780908849115
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::113 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 4bd117397d7e5468c73e81bda3af3f91e65b85bc5d2eafe1ff49d33733fb9b82

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 417
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
66 B 128ms
110ms XHR
text/plain 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:50 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 3 KB
2 KB 61ms
49ms XHR
application/json 35.168.216.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?lt=1690461470374&to=0&aun=mmt-3da146d5-1cf2-4be4-9079-b2f1c2c61187_1_1_ad&pubcid=8217a596-e105-4814-9f40-7d0549462d31&gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.B%23sidebar-2&pv=fff0983d-b165-41c1-91ef-d53851e10d5c&maxw=300&maxh=600&si=490025&pi=3&bf=300x250%2C160x600%2C300x600&uspConsent=1---&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%227.54.2%22%7D&ogu=null&ns=10240
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.216.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-216-217.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 5e6feb2406855443e21d6db8c2055341bde4e2970739dbc51d6e4995d94b4894

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 3 KB
2 KB 81ms
70ms XHR
application/json 35.168.216.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?lt=1690461470378&to=0&aun=mmt-3da146d5-1cf2-4be4-9079-b2f1c2c61187_1_1_ad&pubcid=8217a596-e105-4814-9f40-7d0549462d31&gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.B%23sidebar-2&pv=fff0983d-b165-41c1-91ef-d53851e10d5c&maxw=300&maxh=600&si=490027&pi=3&bf=300x250%2C160x600%2C300x600&uspConsent=1---&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%227.54.2%22%7D&ogu=null&ns=10240
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.216.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-216-217.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b9ae425b7b149355d4d1d47d8cd0e878765fdd4efc754e91cc2e31f28ed6310f

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 3 KB
2 KB 59ms
48ms XHR
application/json 35.168.216.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?lt=1690461470379&to=0&aun=mmt-3da146d5-1cf2-4be4-9079-b2f1c2c61187_1_1_ad&pubcid=8217a596-e105-4814-9f40-7d0549462d31&gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.B%23sidebar-2&pv=fff0983d-b165-41c1-91ef-d53851e10d5c&maxw=300&maxh=600&si=490028&pi=3&bf=300x250%2C160x600%2C300x600&uspConsent=1---&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%227.54.2%22%7D&ogu=null&ns=10240
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.216.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-216-217.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 5cd994fedfb1af79fd81c23c947b5ab2bcde38b6f0940d17d64f2ae2596911ca

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 539 B
701 B 87ms
76ms XHR
application/json 195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

6d19c9e56b33586504ec99a9a7e7a93ee77fc098831ec7466a72e351ba9d74c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:50 GMT
x-content-type-options: nosniff
p3p: CP="CAO PSA OUR"
x-envoy-upstream-service-time: 73
content-length: 539
pragma: no-cache
server: ayl-lb-usa02
access-control-max-age: 3600
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding
access-control-allow-headers: Accept-Encoding, Content-Type
expires: 0

POST
H2 200 v2 Show response
e.serverbid.com/api/ 16 B
202 B 17ms
7ms XHR
application/json 159.89.246.130
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://e.serverbid.com/api/v2
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 159.89.246.130 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:49 GMT
content-encoding: gzip
access-control-max-age: 10080
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept
content-length: 42

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 145 B
968 B 189ms
181ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

c16198bd844f1baa4590e234d7a4036a80b1194c61428b500f010945bb83c2f1

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
an-x-request-uuid: f1318b3c-fcf9-43a1-a379-9df0896307e0
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 145
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 17 KB
8 KB 131ms
126ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUWWG7OK
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: eb6da21b7aa4257385ce9cd27129c1f980bacbd6881ad7cf73b38e9b8b9ffd3c

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Thu, 27 Jul 2023 12:37:50 GMT

POST
H2 204 637e6546decb82d45236f0f8 Show response
prebid.cootlogix.com/prebid/multi/ 0
943 B 109ms
104ms XHR
text/plain 157.245.128.131
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.cootlogix.com/prebid/multi/637e6546decb82d45236f0f8
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 157.245.128.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:50 GMT
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
content-length: 0

POST
H2 200 c Show response
prebid.a-mo.net/a/ 873 B
703 B 16ms
12ms XHR
application/json 147.28.146.89
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.146.89 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 3ce3e1a38770c4333dedafa5b9d8ae12eb0f14a40e2870d2b18ec590090f8e31

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:50 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 532

GET
H2

200

tag Show response
btloader.com/
Redirect Chain

https://btloader.com/tag?aax_id=AAX8RN661&upapi=true
https://btloader.com/tag?o=5761653252554752&upapi=true

16 KB
7 KB

11ms
11ms

Script
application/javascript

2606:4700:20::ac43:4686
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://btloader.com/tag?o=5761653252554752&upapi=true
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 2606:4700:20::ac43:4686 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d1aab9fb9e35aed35daeff511cb03ab5e6d773e87cdb8385e87a724a60eac448

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 27 Jul 2023 11:52:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2567
etag: W/"ae24ed1b4e38e26654c69fe30c2201aa"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F2%2B3cJykOh5zZwczmo6067uKURiD%2FXffjBVCCfTysDKeI6DAraile0Ur3GYda6ib928NleWLrpqWda5XHjzTbcu0AFood4Q%2F1Kl87QaiOcuNloKaQGxTr%2B6AZyjy6loxpcPY0oGSBLWONA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300
cf-ray: 7ed4efa52b230f9c-EWR

Redirect headers

date: Thu, 27 Jul 2023 12:37:50 GMT
via: 1.1 google
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2566
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xVQejch%2BpeLY4WIGscxaoqnomL9SfF3AsAMKGYxeB1HYHmysK3r2Gi%2F0ROjIfTLfMENA%2FfdbnsI3Ztu59I2uVClwo9a%2FxpAyhDIXlD0fq2Fmc8rWN9FIb3woZWY%2B7PD%2F6kfJtwexJZVnFw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
location: /tag?o=5761653252554752&upapi=true
cache-control: public, max-age=3600, must-revalidate
cf-ray: 7ed4ef9e2e3e0f9c-EWR

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 101 KB
25 KB 32ms
12ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd08be9cbf5f35486ce3011abc8286e9e2f59ac1de1ff9840377332383263f19

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:50 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 22 Jun 2023 08:35:03 GMT
server: cloudflare
x-amz-request-id: F364NC7NSZSQHBYX
age: 1147
etag: W/"bb626f116ff54963039a9ea05c53620b"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7ed4ef9e2a9341ef-EWR
x-amz-id-2: 3t88lwhmRfjzGXa6aBSUuv5hXX/EY5JMQnMFLxHSCDmO7ht0Z7uCN01tpZHL/fbCQqhKlgAdjVY=

GET
H2

200

/ Show response
loadus.exelator.com/load/
Redirect Chain

https://loadus.exelator.com/load/?p=233&g=001&j=d
https://loadus.exelator.com/load/?p=233&g=001&j=d&xl8blockcheck=1

2 KB
3 KB

30ms
30ms

Script
application/x-javascript

50.16.197.56
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://loadus.exelator.com/load/?p=233&g=001&j=d&xl8blockcheck=1
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 50.16.197.56 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-197-56.compute-1.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: c0a73790d9a36c62f23cf285c2df5c694e05fdce54794eba9b7b4057ca0292b3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: application/x-javascript;charset=UTF-8
date: Thu, 27 Jul 2023 12:37:51 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA

Redirect headers

date: Thu, 27 Jul 2023 12:37:50 GMT
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location: https://loadus.exelator.com/load/?p=233&g=001&j=d&xl8blockcheck=1
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
content-length: 0

GET
H2 200 quant.js Show response
secure.quantserve.com/ Frame F52F 22 KB
9 KB 43ms
15ms Script
application/javascript 2620:116:800b:21:1456:d0e1:7db4:a56b
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800b:21:1456:d0e1:7db4:a56b , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e23decabee8464b650d1d0241283ba0c469806e14a2199efc5bb41771cb673c1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:50 GMT
content-encoding: gzip
etag: "sLp6xTjO7svFVaOemhLWUQ=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Thu, 03 Aug 2023 12:37:50 GMT

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 177 B
624 B 204ms
204ms XHR
text/javascript 18.164.98.157
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&pid=H6WAmorw7Vcp2&cb=9&ws=1600x1200&v=23.717.1557&t=1100&slots=%5B%7B%22sd%22%3A%22mmt-389c2c79-cb7d-4800-9f2c-9ee84c91dd11_1_1_ad%22%2C%22s%22%3A%5B%22300x250%22%2C%22160x600%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%22%7D%5D&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&gpp_sid=%5B-1%5D&pubid=76b6d1d8-9f58-4ac7-a92e-f3232afccc8a&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D&vm=%7B%22ids%22%3A%7B%22pubcommon%22%3A%228217a596-e105-4814-9f40-7d0549462d31%22%7D%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.98.157 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

f2ef970ed72dbe7da68a710eaf2817c8426bfc440c209c1f2fcdb5e03bae31b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:50 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 1abf103face183cd8172f37e6ac30038.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: JFK50-P5
x-amz-rid: N53SXNBKSMX3EAKJMSMQ
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 177
x-amz-cf-id: VW4CqsqYJsy7s-ZQaeJzchjl9PVjGzQPjklWJdzvniKmYNmPshzzBQ==

GET
H/1.1

200
OK

iu3 Show response
s.amazon-adsystem.com/ Frame 9CB7
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-LoopMe_n-onetag_n-simpli.fi_rbd_rx_ox-db5_smrt_an-db5_3lift_n-Outbrain
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-LoopMe_n-onetag_n-simpli.fi_rbd_rx_ox-db5_smrt_an-db5_3lift_n-Outbrain&dcc=t

347 B
1 KB

44ms
44ms

Document
text/html

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-LoopMe_n-onetag_n-simpli.fi_rbd_rx_ox-db5_smrt_an-db5_3lift_n-Outbrain&dcc=t

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

d8357e2efce1f7d48aa2454d722bfd50e2a84ca520f6229f14bc1ea3c4523094

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 347
Content-Type: text/html;charset=ISO-8859-1
Date: Thu, 27 Jul 2023 12:37:50 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: ZMXNJTZC260ST5QQJBCX

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Thu, 27 Jul 2023 12:37:50 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-LoopMe_n-onetag_n-simpli.fi_rbd_rx_ox-db5_smrt_an-db5_3lift_n-Outbrain&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: BM495P0YR5JGVYDYTJQV

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A67A
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

22ms
21ms

Document
text/html

2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=1663128080&adf=743467531&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466964&bpp=1&bdt=490&idt=272&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=584&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=h3JYZEuvl9&p=https%3A//ehfmc-com.ngontinh24.com&dtd=281

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:50 GMT
expires: Thu, 27 Jul 2023 12:37:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:50 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame ADD9 0
20 B 48ms
47ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=5574524923590&version=m202306200101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame ADD9 0
20 B 46ms
46ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=5574524923590&version=m202306200101&ct=76&x=1&cor=9848365699106064000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame ADD9 77 KB
36 KB 60ms
59ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CuPVv_nWLWVSk8KJ4NJxW5CKIJ7hvEzFF8ZZFu-4EbX-GLdhMmWiuECnkp_MBdAYqXLZbMWrEcWez76jaoN75EA6YOvw&cry=1&dbm_d=AKAmf-CSNODUmxLiLEw0wmUElcHrL8nMqgCH85QJjpHPZCYWANqCcne8VPGU2t_Ddf6iaaHBkAH-_dyqs8eYEbahrf0j2T7-5Et638a_jH4u-d8EBl8kNANbRpSgQ3kJYGmwsaXYXjiEudkMY0GLWd1NI53ChW9xHv94U_IOaIzaPZSNWlE4TJa7jXTyMlGShSpx1LdLlGkvLbwopzmOheO8_D-ddLbc2vJFB0x-uV_kKxTfXEqP1p96YQigJYm-wvJ80daqj6e6cdVXF1xTe8BVIrMmWzCQLS2fGYAwuwyVbBrostlnweJNFijgPGjCYwPuVCZTOW6Kc28gLA-6Qgx4u9QU7bgQrgcBcyo4L2V_oWSH5Jc-McXRcshYlCheSCu4OR8MVBBpsH0b-BYB6hLZhGNFYsiC2dG13qP4m73ljbiGW62BaVf52Edl-CO214QrY_2KXZziFyav0TssowSKgsLVFGGHVznzPOUG6ccec4ftZkG5T0c6fy2x_sc3hBCcC8h9J71ZvgL57hbn_5zvzBmncYSLfdK5YCJX8ebMUkTUvO5aPKGbPHiw62EYzqJ2jrSn4qsvBa2IuyVKgU8UgvNfBEQBxRQCUJg70nS_iuDOIZNHLbL_To7NNN9wfKWsWBGWBi9FW946kIKrN1q2vptnXdTuGRU0-9UPLdCaoRYY25Yd0rQifZu0DzzmFRxU0mfMojaGR3Rw6nC529RT6hxqXEQgumbIW4rGd6UwjlY-5zTezVYjiYgqrUwmzSR4XiEiYmvC_JPC5WGeHfif0xYFWvLhfML8_DMpqzNk97aMGPM3ae936qPffG6NYQVnMfKQ4DFmbnTf0eWqeV5pZhZiTXyjWJqgszYn_AKOUHNZV6MSs33MbpiXB2O4hGVEQKTMOFQjzhdQ03Dly9fnz6foLXofaGGNBNhWuhQ-Rn_F3wHCAfQKo6aSLeEKQWwuhcT6dQzyDSfqQyld7N1UOANV3kWdr_EHt8O9bHWoio0RBWcaCQBycQARAuA3tLQEF1DK9_kt7Ni6hyafg5l2K0Qy4DZy0UEc0ecIYhR4DJOTIzL5G_uJij-FuZH8Fd5otI1OG1HfNf3cvHPq9BBn_Har74i6g_sFIgKKOd5Ccq-F6NnZxuSlwNiBlSEE0kZbPliZC1NvWEKC_oec48h2CwBIm9my3HustP50pMztwcGiDWxR2B62hm_ByebrKlBGY8hQeZpb01JIDNCYIvOK-9aooI_QOG17QmHvrL4JJszgG5gchFbuPeyJy4FWuLeUrJ5nQsPkFfVcst08wz45IhMYN_cQXh8Dm6lz32l0rwXVhn3XHCZcUDwLczaTPlDgxE1xIzNhLTmUcJsSREwe7V3cKogR_PA1yX9N1kO43hKwJe8Uja8AJJfyGYasPK1HSomlW0SMmGwkDx5dWqdWcQxVKcAOkmBPGn12KYePEEVyufDWYkw9Z4-agYEj6WfgBsDdJL0BQdolc6tq9NkCi078YAVVoK6v0-yymqUBxk7HeTSE_doH7C3ewYJE3B0NVR6G0BXjMSPauJgLgSfr5IXxDKlijaHz-KaZ5FQ2EF8x65ZV0C8fAGGioJDWTa7kAXLwz0lchaRSsDEBXIMSCo6tUKkF7DlLcqq3v9jTobEMkLwJ34EQcPIoGHPZ_YD-yy7cj6t4APnt069Fh3Hs2bIyzW8brPWkbGLrRdF160dht2Km9SZFee24NWF9kZsrz6QAaHoQMIf75HuPRh7BGYR89ObAOtMyzdMsbzN0ftk1D2JhELpDodyVgQ-2z9a4y0FzDMOfyUnho5Sb3-ZfN2qcw5CZIVcS5nQCpccFnc1TPwDP1lSG6FCpFDKuMdG6hIw1guVoVe6mAegW2CmAnkuGKA_oIr8LXAhZAOnlH0CQs8Ny6CrZyPayNxbEE-iyPkl6MyV1eZW-YHWdhbMt_JpEhPNnNZn9m-sIGYDFbFWc_495zxxMq3CH3T5OpY1Dt06a_GDZERGUSqAcoTLZFoJhj9R0W2hObJZLzi1ZyIGscBLBdFu_OMJqnFNV1FWYeSc65vppoKd1MSDZP_SbBnezxwvVa6e9rVign8FNQNy7DkaEgUHj0FYLVSDfy0Ce3Jyqbq4gy359gWlf_bK-L3LQO5kYoM3re0wwzl9ByufU4qYUM6gdFNHbdjdmXPj9h1tIt0tnJY4lCWaQhRWt75Tyz59dZN6VcJv2T0DggNqOVJPjt5GT4nqWOAhqsy5fwptKRgN0peUQzPUBUcyYA9nT2VNTw14SXhQiuZkbNJnXXZvbzfBeZaaYVnxBRNBD1mSTQ1xMhx_k0vQKm4ifbOAwELUVQJao9ivHobjlwgrmn6NRhMIU-sbCMajOrmd3KGQwczpcQ_ppkY88kJZUvfxtqypxD92MTj2mUQQS-e9GO2QQIC6AD50FMdxAxHyz2BufpAGYNvgRPjg7GpGgnbXDhVm-FCxW73PMgWyEGagZhkM6wB5lF5NBU2paMo9-ciE_cPCcR469KdsTVymmZYwgN0UOAjBi04zg2oT4BQKEarzIscL5clqx4bUC4JuqyqH_oxX55FBRNcqDgrNWo1UsT_BtamlhjeXiH5ZoTqiAFXzBN7m9h2IsqZADMyoQSK7Gw7NBeNP7EwZRG2lvKkNQVsJM1qwU92R4HYVA2B9L9nZmHmwkkAbVLzpW03LSDkkGZm_B1dXU1u8wn76eIjVaDZ9DhgtNE3ylsK0Lz6bb0wpfG-STICSIYt8b1D-cReAnbATNZRaPTeHtHTbnUo2p9att7mJ8hQ0niDvisTy1jQ5agjE6-ro6PGaJaU8_fnSxkOR2CYtS7Ue-g6PLKluFvW4BopeQk26_lX6T9ZiEfflA2ZvxxkBfzSi2o3jTGfAHkueNhjByCmOG35dHO6NvEloCpMKBmd-zWu--UlPvgWyrSkr11Rka4LvvzPCITngblOo8ijcJ6dYEsMYCuVTzUqjFGW_L34Yl38mvq9vf-5m4Jo4KLuk70r8oNr8GVxR80oRIi8VsZKm2RJZMhCNnIygO1PIFTvI2pG7KC1dJjoDTT2j4oJPHPRub-7_bi9H1V7UayntVg7qGwdTsN4bkcYectCdCLODnvlLOASQ1lFjcytRF4eH0tGIDnB4jWE2ti56gjJqrI1AH1eosN2ACiwl7ArP413Ge6fEbT_b-Vn1rdxNF8phU0ZpAVzqgCd9Qws-EziRkk3ePYic39hZOlcgW4IS-1waQdczWz1_P2YzzqoTjS8BiO3mDcYwxYKTu9iflvk9GbCN3rHC2L2HHLd4fLpv6AqHF1WH5cQY1AkN305DzakaT3UJu2n-IKqkAS-HS_43A-WakrYqWmvosj-wv99WMclwmtVMrsjc4O-UyoG9o4SnQEAt8G9PrPjaLfbdEH-RbvD88CyW78Q-9AW9l-108Zpnk7jtXc1ubz1klUqpQ8kvTcvUr0cnl5TjIxhwFXfJkf7MOUQj7z34VSUFUHg&cid=CAQSOwBpAlJWWyTklgCkEywftECmZYrlhJJYnD3RJVUFPHtNTJEE3xNdhHNKUxKsqKIfF4eWJ7K0NR6PG3joGAE&dv3_ver=m202306200101&rfl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ds=l&xdt=1&iif=1&cor=9848365699106064000&adk=1215661106&idt=61&cac=0&dtd=19

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a7f385b0cb917e66cff5c1fbceab413c775128bf99b19e2dcbbdf66affab5a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=2294626326&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466970&bpp=1&bdt=495&idt=1510&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&fsb=1&xpc=hDyHm3Dgx6&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1515
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36561
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js Show response
pagead2.googlesyndication.com/bg/ Frame 4003 37 KB
14 KB 25ms
25ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4f9e4b1838819f2fdbc6eea07e712886701f71a49ff22a445a9be3d5c7d806

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:38:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57572
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14628
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jul 2024 20:38:18 GMT

GET
H3 200 mmt.gif
imps.monu.delivery/ 37 B
63 B 17ms
17ms Image
image/gif 35.186.236.140
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imps.monu.delivery/mmt.gif?s=fd6252cc-2263-4692-8f56-3f75ffaf0701&a=b.r&u=8ac367b4-1fc1-4e9e-90a8-296aa003810e&d=%7B%22utm%22%3A%7B%7D%7D
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.236.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.236.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2e4d08754839510a3d77ddf8205a515e51e4277c323932b10441196744ce757

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 02:10:33 GMT
age: 124037
x-guploader-uploadid: ADPycdtfTH7AOMIL8vASnI2SAUKO57hiMqR3KrgVyd3_EGuyzarfJLPV8txIzxbrXqaVDP4d4uU8hlF5HkVIIEB2LY4pnYBd5XPi
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
last-modified: Wed, 12 Jul 2017 09:13:19 GMT
server: UploadServer
etag: "455005e2f4b8ecc484500fab08619f70"
x-goog-generation: 1499850799559224
x-goog-hash: crc32c=1zd0wQ==, md5=RVAF4vS47MSEUA+rCGGfcA==
content-type: image/gif
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37
accept-ranges: bytes
expires: Thu, 25 Jul 2024 02:10:33 GMT

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 199ms
9ms Preflight
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 27 Jul 2023 12:37:50 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 352697
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/ Frame D15F 10 KB
4 KB 15ms
3ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202307200101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18e7a53e3b3abd7ac0242719f7f62cb56b8efe7065091585b8ad22cbc2b8c41c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 75567
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4544
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 15:38:23 GMT
etag: 12368291122986407432
expires: Wed, 09 Aug 2023 15:38:23 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/ Frame E968 10 KB
4 KB 16ms
5ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202307200101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18e7a53e3b3abd7ac0242719f7f62cb56b8efe7065091585b8ad22cbc2b8c41c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 75567
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4544
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 15:38:23 GMT
etag: 12368291122986407432
expires: Wed, 09 Aug 2023 15:38:23 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame DA52 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 943da19e351c6e69823069dd2bae9f1a80fac3a11908572cf8a455de5463f059

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200 swfIndex.php Show response
ads.stickyadstv.com/www/delivery/ 67 B
572 B 92ms
32ms XHR
application/xml 63.251.28.234
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.stickyadstv.com/www/delivery/swfIndex.php?reqType=AdsSetup&protocolVersion=4.2&zoneId=13711199&componentId=prebid&componentSubId=mustang&timestamp=1690461470794&_fw_bidfloor=0.6001&_fw_bidfloorcur=USD&pbjs_version=7.51.0&pKey=105295964&_fw_us_privacy=1---&schain=%7B%22nodes%22%3A%5B%7B%22asi%22%3A%22vidcrunch.com%22%2C%22sid%22%3A%22632d59d7b9689f25ad20b012%22%2C%22hp%22%3A1%7D%5D%2C%22ver%22%3A%221.0%22%2C%22complete%22%3A1%7D&loc=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&playerSize=640x360&video_context=instream&video_placement=3&video_plcmt=2
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb7.51.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 63.251.28.234 Secaucus, United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS
Software: nginx /
Resource Hash: b86a66f50a52eacf8ebea7e083790e4b094d740c7abd4ee07f53e139a6ff5e71

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:50 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: application/xml;charset=UTF-8
Access-Control-Allow-Origin: https://ehfmc-com.ngontinh24.com
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
x-sticky-vk: 1690461470846035-113

GET
H/1.1 200 swfIndex.php Show response
ads.stickyadstv.com/www/delivery/ 67 B
572 B 94ms
35ms XHR
application/xml 63.251.28.234
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.stickyadstv.com/www/delivery/swfIndex.php?reqType=AdsSetup&protocolVersion=4.2&zoneId=13711039&componentId=prebid&componentSubId=mustang&timestamp=1690461470797&_fw_bidfloor=0.8&_fw_bidfloorcur=USD&pbjs_version=7.51.0&pKey=160453882&_fw_us_privacy=1---&schain=%7B%22nodes%22%3A%5B%7B%22asi%22%3A%22vidcrunch.com%22%2C%22sid%22%3A%22632d59d7b9689f25ad20b012%22%2C%22hp%22%3A1%7D%5D%2C%22ver%22%3A%221.0%22%2C%22complete%22%3A1%7D&loc=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&playerSize=640x360&video_context=instream&video_placement=3&video_plcmt=2
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb7.51.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 63.251.28.234 Secaucus, United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS
Software: nginx /
Resource Hash: b86a66f50a52eacf8ebea7e083790e4b094d740c7abd4ee07f53e139a6ff5e71

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:50 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: application/xml;charset=UTF-8
Access-Control-Allow-Origin: https://ehfmc-com.ngontinh24.com
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
x-sticky-vk: 1690461470844049-135

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 142 B
995 B 177ms
176ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb7.51.0.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

eb635893550014262b16deb9548c3da8e86d00c576b4e89dc4867d59f3096307

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
an-x-request-uuid: 4df0394e-30b7-4faf-ad80-3e3e2568df71
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 142
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&domain=ehfmc-com.ngontinh24.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=LqpoY3xTeTlNRXAvNC9ManIyMWxHQjRGK0o1dUhaWk9KU1p6bldva1VERnRkeUsyZnpvcndzZHY3TTBSdC9INkVvQ3k4ditkYUJBNit2eHhSenMvUzNmYmgwcGJWbVhPYTBOL05FT3djZWw3YU5PcFk4UkdzS3Q5Y2VHbl...

357 B
648 B

11ms
9ms

XHR
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=LqpoY3xTeTlNRXAvNC9ManIyMWxHQjRGK0o1dUhaWk9KU1p6bldva1VERnRkeUsyZnpvcndzZHY3TTBSdC9INkVvQ3k4ditkYUJBNit2eHhSenMvUzNmYmgwcGJWbVhPYTBOL05FT3djZWw3YU5PcFk4UkdzS3Q5Y2VHblFxeXRtRDhzZEo5bjdOS04zY3Q5TUVIRVhLSGtCS1lyMUM4TXhPdWFjQ3NPb3JRTXhkK05qQlNCamlCU29PUFBaTHY2QVA0em9OcmtKdnJZSzJ6dnhPNWlKRkNNQWhiNlpPb0tDSUMxZmdtUkgvY256dXBNTGN3YVlXcXdNUmhnbE56ZHN3bmkvfA&cppv=2

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

0ca8b5836386d7856ff574b993df64cb8fbc9cde3a7d6e40d449525430a08704

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:51 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1010436
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:50 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
access-control-allow-methods: GET
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
location: https://mug.criteo.com/sid?cpp=LqpoY3xTeTlNRXAvNC9ManIyMWxHQjRGK0o1dUhaWk9KU1p6bldva1VERnRkeUsyZnpvcndzZHY3TTBSdC9INkVvQ3k4ditkYUJBNit2eHhSenMvUzNmYmgwcGJWbVhPYTBOL05FT3djZWw3YU5PcFk4UkdzS3Q5Y2VHblFxeXRtRDhzZEo5bjdOS04zY3Q5TUVIRVhLSGtCS1lyMUM4TXhPdWFjQ3NPb3JRTXhkK05qQlNCamlCU29PUFBaTHY2QVA0em9OcmtKdnJZSzJ6dnhPNWlKRkNNQWhiNlpPb0tDSUMxZmdtUkgvY256dXBNTGN3YVlXcXdNUmhnbE56ZHN3bmkvfA&cppv=2
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 266220
content-length: 0
expires: 0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 16ms
15ms Preflight
application/json 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&domain=ehfmc-com.ngontinh24.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://ehfmc-com.ngontinh24.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 27 Jul 2023 12:37:50 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 282445
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame B454
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

28ms
27ms

Document
text/html

2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:50 GMT
expires: Thu, 27 Jul 2023 12:37:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:50 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 mmt.gif
imps.monu.delivery/ 37 B
63 B 8ms
4ms Image
image/gif 35.186.236.140
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imps.monu.delivery/mmt.gif?s=fd6252cc-2263-4692-8f56-3f75ffaf0701&a=s.d&u=4258afea-960f-419a-9cd3-d9b394374220
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.236.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.236.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2e4d08754839510a3d77ddf8205a515e51e4277c323932b10441196744ce757

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 02:10:33 GMT
age: 124037
x-guploader-uploadid: ADPycdtfTH7AOMIL8vASnI2SAUKO57hiMqR3KrgVyd3_EGuyzarfJLPV8txIzxbrXqaVDP4d4uU8hlF5HkVIIEB2LY4pnYBd5XPi
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
last-modified: Wed, 12 Jul 2017 09:13:19 GMT
server: UploadServer
etag: "455005e2f4b8ecc484500fab08619f70"
x-goog-generation: 1499850799559224
x-goog-hash: crc32c=1zd0wQ==, md5=RVAF4vS47MSEUA+rCGGfcA==
content-type: image/gif
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37
accept-ranges: bytes
expires: Thu, 25 Jul 2024 02:10:33 GMT

GET
H3 200 mmt.gif
imps.monu.delivery/ 37 B
63 B 9ms
5ms Image
image/gif 35.186.236.140
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imps.monu.delivery/mmt.gif?s=fd6252cc-2263-4692-8f56-3f75ffaf0701&a=s.d&u=26c15b8e-8080-4986-924e-050c0f0222d6
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.236.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.236.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2e4d08754839510a3d77ddf8205a515e51e4277c323932b10441196744ce757

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 02:10:33 GMT
age: 124037
x-guploader-uploadid: ADPycdtfTH7AOMIL8vASnI2SAUKO57hiMqR3KrgVyd3_EGuyzarfJLPV8txIzxbrXqaVDP4d4uU8hlF5HkVIIEB2LY4pnYBd5XPi
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
last-modified: Wed, 12 Jul 2017 09:13:19 GMT
server: UploadServer
etag: "455005e2f4b8ecc484500fab08619f70"
x-goog-generation: 1499850799559224
x-goog-hash: crc32c=1zd0wQ==, md5=RVAF4vS47MSEUA+rCGGfcA==
content-type: image/gif
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37
accept-ranges: bytes
expires: Thu, 25 Jul 2024 02:10:33 GMT

GET
H3 200 mmt.gif
imps.monu.delivery/ 37 B
63 B 12ms
8ms Image
image/gif 35.186.236.140
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imps.monu.delivery/mmt.gif?s=fd6252cc-2263-4692-8f56-3f75ffaf0701&a=s.d&u=df664826-5c9a-46f1-947a-56f39263c30d
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.236.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.236.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2e4d08754839510a3d77ddf8205a515e51e4277c323932b10441196744ce757

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 02:10:33 GMT
age: 124037
x-guploader-uploadid: ADPycdtfTH7AOMIL8vASnI2SAUKO57hiMqR3KrgVyd3_EGuyzarfJLPV8txIzxbrXqaVDP4d4uU8hlF5HkVIIEB2LY4pnYBd5XPi
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
last-modified: Wed, 12 Jul 2017 09:13:19 GMT
server: UploadServer
etag: "455005e2f4b8ecc484500fab08619f70"
x-goog-generation: 1499850799559224
x-goog-hash: crc32c=1zd0wQ==, md5=RVAF4vS47MSEUA+rCGGfcA==
content-type: image/gif
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37
accept-ranges: bytes
expires: Thu, 25 Jul 2024 02:10:33 GMT

GET
H3 200 mmt.gif
imps.monu.delivery/ 37 B
63 B 11ms
7ms Image
image/gif 35.186.236.140
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imps.monu.delivery/mmt.gif?s=fd6252cc-2263-4692-8f56-3f75ffaf0701&a=s.d&u=ec27c27d-c540-4450-8b4c-9d3b869beb9f
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.236.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.236.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2e4d08754839510a3d77ddf8205a515e51e4277c323932b10441196744ce757

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 02:10:33 GMT
age: 124037
x-guploader-uploadid: ADPycdtfTH7AOMIL8vASnI2SAUKO57hiMqR3KrgVyd3_EGuyzarfJLPV8txIzxbrXqaVDP4d4uU8hlF5HkVIIEB2LY4pnYBd5XPi
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
last-modified: Wed, 12 Jul 2017 09:13:19 GMT
server: UploadServer
etag: "455005e2f4b8ecc484500fab08619f70"
x-goog-generation: 1499850799559224
x-goog-hash: crc32c=1zd0wQ==, md5=RVAF4vS47MSEUA+rCGGfcA==
content-type: image/gif
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37
accept-ranges: bytes
expires: Thu, 25 Jul 2024 02:10:33 GMT

GET
H3 200 mmt.gif
imps.monu.delivery/ 37 B
63 B 12ms
8ms Image
image/gif 35.186.236.140
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imps.monu.delivery/mmt.gif?s=fd6252cc-2263-4692-8f56-3f75ffaf0701&a=s.d&u=c4152799-e894-4662-a2a4-a42d312d81f7
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.236.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.236.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2e4d08754839510a3d77ddf8205a515e51e4277c323932b10441196744ce757

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 02:10:33 GMT
age: 124037
x-guploader-uploadid: ADPycdtfTH7AOMIL8vASnI2SAUKO57hiMqR3KrgVyd3_EGuyzarfJLPV8txIzxbrXqaVDP4d4uU8hlF5HkVIIEB2LY4pnYBd5XPi
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
last-modified: Wed, 12 Jul 2017 09:13:19 GMT
server: UploadServer
etag: "455005e2f4b8ecc484500fab08619f70"
x-goog-generation: 1499850799559224
x-goog-hash: crc32c=1zd0wQ==, md5=RVAF4vS47MSEUA+rCGGfcA==
content-type: image/gif
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37
accept-ranges: bytes
expires: Thu, 25 Jul 2024 02:10:33 GMT

GET
H3 200 mmt.gif
imps.monu.delivery/ 37 B
63 B 12ms
9ms Image
image/gif 35.186.236.140
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imps.monu.delivery/mmt.gif?s=fd6252cc-2263-4692-8f56-3f75ffaf0701&a=s.d&u=3da146d5-1cf2-4be4-9079-b2f1c2c61187
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.236.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.236.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2e4d08754839510a3d77ddf8205a515e51e4277c323932b10441196744ce757

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 02:10:33 GMT
age: 124037
x-guploader-uploadid: ADPycdtfTH7AOMIL8vASnI2SAUKO57hiMqR3KrgVyd3_EGuyzarfJLPV8txIzxbrXqaVDP4d4uU8hlF5HkVIIEB2LY4pnYBd5XPi
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
last-modified: Wed, 12 Jul 2017 09:13:19 GMT
server: UploadServer
etag: "455005e2f4b8ecc484500fab08619f70"
x-goog-generation: 1499850799559224
x-goog-hash: crc32c=1zd0wQ==, md5=RVAF4vS47MSEUA+rCGGfcA==
content-type: image/gif
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37
accept-ranges: bytes
expires: Thu, 25 Jul 2024 02:10:33 GMT

GET
H3 200 mmt.gif
imps.monu.delivery/ 37 B
63 B 13ms
9ms Image
image/gif 35.186.236.140
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imps.monu.delivery/mmt.gif?s=fd6252cc-2263-4692-8f56-3f75ffaf0701&a=s.d&u=389c2c79-cb7d-4800-9f2c-9ee84c91dd11
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.236.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.236.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2e4d08754839510a3d77ddf8205a515e51e4277c323932b10441196744ce757

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 02:10:33 GMT
age: 124037
x-guploader-uploadid: ADPycdtfTH7AOMIL8vASnI2SAUKO57hiMqR3KrgVyd3_EGuyzarfJLPV8txIzxbrXqaVDP4d4uU8hlF5HkVIIEB2LY4pnYBd5XPi
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
last-modified: Wed, 12 Jul 2017 09:13:19 GMT
server: UploadServer
etag: "455005e2f4b8ecc484500fab08619f70"
x-goog-generation: 1499850799559224
x-goog-hash: crc32c=1zd0wQ==, md5=RVAF4vS47MSEUA+rCGGfcA==
content-type: image/gif
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37
accept-ranges: bytes
expires: Thu, 25 Jul 2024 02:10:33 GMT

GET
H3 200 mmt.gif
imps.monu.delivery/ 37 B
63 B 14ms
8ms Image
image/gif 35.186.236.140
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imps.monu.delivery/mmt.gif?s=fd6252cc-2263-4692-8f56-3f75ffaf0701&a=s.d&u=0115eba8-b4ce-4839-bee5-c28a1c9b14c8
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.236.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.236.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2e4d08754839510a3d77ddf8205a515e51e4277c323932b10441196744ce757

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 02:10:33 GMT
age: 124037
x-guploader-uploadid: ADPycdtfTH7AOMIL8vASnI2SAUKO57hiMqR3KrgVyd3_EGuyzarfJLPV8txIzxbrXqaVDP4d4uU8hlF5HkVIIEB2LY4pnYBd5XPi
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
last-modified: Wed, 12 Jul 2017 09:13:19 GMT
server: UploadServer
etag: "455005e2f4b8ecc484500fab08619f70"
x-goog-generation: 1499850799559224
x-goog-hash: crc32c=1zd0wQ==, md5=RVAF4vS47MSEUA+rCGGfcA==
content-type: image/gif
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37
accept-ranges: bytes
expires: Thu, 25 Jul 2024 02:10:33 GMT

GET
H3 200 mmt.gif
imps.monu.delivery/ 37 B
63 B 13ms
9ms Image
image/gif 35.186.236.140
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imps.monu.delivery/mmt.gif?s=fd6252cc-2263-4692-8f56-3f75ffaf0701&a=s.d&u=827fc8e0-82ff-4690-83c3-d2380c7524bb
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.236.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.236.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2e4d08754839510a3d77ddf8205a515e51e4277c323932b10441196744ce757

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 02:10:33 GMT
age: 124037
x-guploader-uploadid: ADPycdtfTH7AOMIL8vASnI2SAUKO57hiMqR3KrgVyd3_EGuyzarfJLPV8txIzxbrXqaVDP4d4uU8hlF5HkVIIEB2LY4pnYBd5XPi
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
last-modified: Wed, 12 Jul 2017 09:13:19 GMT
server: UploadServer
etag: "455005e2f4b8ecc484500fab08619f70"
x-goog-generation: 1499850799559224
x-goog-hash: crc32c=1zd0wQ==, md5=RVAF4vS47MSEUA+rCGGfcA==
content-type: image/gif
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37
accept-ranges: bytes
expires: Thu, 25 Jul 2024 02:10:33 GMT

GET
H3 200 mmt.gif
imps.monu.delivery/ 37 B
63 B 13ms
9ms Image
image/gif 35.186.236.140
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imps.monu.delivery/mmt.gif?s=fd6252cc-2263-4692-8f56-3f75ffaf0701&a=s.d&u=8ac367b4-1fc1-4e9e-90a8-296aa003810e
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.236.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.236.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2e4d08754839510a3d77ddf8205a515e51e4277c323932b10441196744ce757

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 02:10:33 GMT
age: 124037
x-guploader-uploadid: ADPycdtfTH7AOMIL8vASnI2SAUKO57hiMqR3KrgVyd3_EGuyzarfJLPV8txIzxbrXqaVDP4d4uU8hlF5HkVIIEB2LY4pnYBd5XPi
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
last-modified: Wed, 12 Jul 2017 09:13:19 GMT
server: UploadServer
etag: "455005e2f4b8ecc484500fab08619f70"
x-goog-generation: 1499850799559224
x-goog-hash: crc32c=1zd0wQ==, md5=RVAF4vS47MSEUA+rCGGfcA==
content-type: image/gif
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37
accept-ranges: bytes
expires: Thu, 25 Jul 2024 02:10:33 GMT

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 2 KB
2 KB 114ms
4ms Script
text/javascript 2600:9000:2511:2400:a:e047:753:be1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2511:2400:a:e047:753:be1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a695b8b12c7d88355d0b1b33d6c643a7913bcfbeae91553bd7560019188b1032

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-amz-version-id: null
Date: Thu, 27 Jul 2023 09:10:37 GMT
Via: 1.1 7edae070a6a25cc68c970c1111701a20.cloudfront.net (CloudFront)
Last-Modified: Thu, 04 May 2023 00:14:06 GMT
Server: AmazonS3
X-Amz-Cf-Pop: JFK50-P6
Age: 12435
x-amz-server-side-encryption: AES256
ETag: "4d5acbf33f4a0592ac0515db92fe88e6"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1858
X-Amz-Cf-Id: KWru6Ogq2g0rbY0yYNicOSc07lCXg24Q8ArUOpEp6Zi89EDGUW4gtw==

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 102 KB
25 KB 15ms
14ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4924e12a30059184d9bd1c36294dcdf957f5f2da452209448b35a93aa785cca5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 22 Jun 2023 08:35:03 GMT
server: cloudflare
x-amz-request-id: S2QBQHH2TC63EM46
age: 1782
etag: W/"9b8b8eb50e4814cbdc325ce477c96910"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7ed4efa1fe4841ef-EWR
x-amz-id-2: paiYCZA4/iBW6lJMp38Op+S/zQyfE8vlkXISpS5sVAOGOB0ZN9ZxpTZy7TGFauR+RWvVW4BMRWE=

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 38 KB
12 KB 53ms
4ms Script
text/javascript 108.138.128.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-46.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0c2ec1f2d626ab278d81abe34d30681f0007e8c79a890165f27e3e1550e99b7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 05:20:10 GMT
content-encoding: gzip
via: 1.1 b4bbc10bb9b68293dc88560c2ddfcc2c.cloudfront.net (CloudFront)
last-modified: Wed, 31 May 2023 20:34:33 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
age: 26262
etag: W/"550ead3a95bd6cfcd917d45c5f8f4553"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: hdoIJY0NxMm6RoqZH43Anw5gaR2MUhCLXuRUKMKkQtuzTazHgYWuWQ==

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
2 KB 131ms
97ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 1c54b9d1b579c59f8245fd21a021725c0dbde06ec90f44df1bbc03458f40dfe8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT
via: 1.1 google, 1.1 google
last-modified: Wed, 05 Jul 2023 19:08:57 GMT
server: Google Frontend
etag: 6c49a4094d9a446bdc7fe3d19d23b4c7
content-type: text/javascript; charset=utf-8
x-cloud-trace-context: 49eb44ecf2d4c67b8a22ffbbd04387c7
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1311

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
896 B 76ms
6ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 27 Jul 2023 12:37:51 GMT
x-content-type-options: nosniff
content-encoding: br
age: 4667
x-jsd-version: master
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 439
x-served-by: cache-fra-eddf8230042-FRA, cache-lga21951-LGA
x-jsd-version-type: branch
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 67ms
22ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

b118568858df50612fa3591132d6d6bb41ddf00f8c74ad8cccd16e5510691aad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Jul 2023 13:25:47 GMT
server: nginx
etag: W/"64ad585b-a980"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 28 Jul 2023 12:37:51 GMT

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 40 KB
9 KB 100ms
17ms Script
application/javascript 104.18.24.112
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.112 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca372f1d4ced7e2a37e83eb5b880159ba569a4fbf613b9cc2894a6c8726c13f6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 20 Jul 2023 17:46:36 GMT
server: cloudflare
age: 65360
etag: W/"64b972fc-a13f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86400
cf-ray: 7ed4efa28cf918f6-EWR
expires: Fri, 28 Jul 2023 12:37:51 GMT

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 32ms
4ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 06 Jul 2023 13:09:20 GMT
content-encoding: gzip
age: 1812511
x-guploader-uploadid: ADPycdt-0Wu_xLUzdxIUWtyN0qfZioHcycDN_xLc1k3-SxG-99esXs2UW3fkNY0AF32E5Trvxhx6e2LAaTjvaCurhQND2Q
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Fri, 05 Jul 2024 13:09:20 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 385 B
166 B 391ms
387ms XHR
text/plain 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=493766145868713&correlator=860688080555572&eid=31076488%2C31070232&output=ldjh&gdfp_req=1&vrg=202307260101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=20842576%3A116518301%2CIN44NM%2CIN44NM-DDS.A&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250&ifi=11&adks=3002795083&didk=3353522815&sfv=1-0-40&prev_scp=pos%3D1%26monu%3D300x250_A1%26slotNum%3D1%26placementNum%3D1%26allowNative%3Dfalse%26amznbid%3D2%26amznp%3D2%26refresh_count%3D0%26tabVisibilityState%3Dvisible%26max_bid%3Dnone%26provider_performance%3D_notchrome_10.00%26context%3D12_NY_notchrome%26slotOnScreen%3Dfalse&eri=1&cust_params=page_num%3D0%26big4%3Dtrue%26url%3Dehfmc-com.ngontinh24.com%26referrer%3Ddirect%26infolinks%3Dtrue%26hem_included%3Dfalse%26tcf_gdprApplies%3Dfalse%26tcfBehavior%3DnotApplicable&sc=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&abxe=1&dt=1690461471056&lmt=1690029259&adxs=1070&adys=1455&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&frm=20&vis=1&psz=300x0&msz=300x0&fws=512&ohw=0&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYtILsupkxSABSAghkEhkKCnB1YmNpZC5vcmcYtILsupkxSABSAghkEhcKCHJ0YmhvdXNlGLSC7LqZMUgAUgIIZBIZCgp1aWRhcGkuY29tGLOC7LqZMUgAUgIIZBIUCgVvcGVueBi0guy6mTFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YtILsupkxSABSAghkEhsKDGlkNS1zeW5jLmNvbRi0guy6mTFIAFICCGQ.&dlt=1690461466474&idt=4415

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2668dfc2f4cfaf686c148c4f00a0734a81aa03e1d151cbcccd5f6c903ad278d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 134
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 23 KB
11 KB 474ms
469ms XHR
text/plain 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=493766145868713&correlator=2225703938419624&eid=31076488%2C31070232&output=ldjh&gdfp_req=1&vrg=202307260101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=20842576%3A116518301%2CIN44NM%2CIN44NM-DDS.J&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=160x600&ifi=12&adks=2393718110&didk=2589088969&sfv=1-0-40&prev_scp=pos%3D10%26monu%3D160x600_B10%26slotNum%3D1%26placementNum%3D1%26allowNative%3Dfalse%26amznbid%3D2%26amznp%3D2%26bidder_responseTime%3Dyieldmo_700%26auction_id%3D14235733-b4da-453e-b24c-c6aebef6cc87%26monu_df%3D0.20%26safeframe%3Dtrue%26bid_source%3Dclient%26hb_format%3Dbanner%26hb_size%3D160x600%26hb_adid%3D2037271570489c85%26hb_bidder%3Dyieldmo%26refresh_count%3D0%26tabVisibilityState%3Dvisible%26max_bid%3Ddf%26provider_performance%3Dyieldmo_notchrome_0.20%26context%3D12_NY_notchrome%26slotOnScreen%3Dtrue&eri=1&cust_params=page_num%3D0%26big4%3Dtrue%26url%3Dehfmc-com.ngontinh24.com%26referrer%3Ddirect%26infolinks%3Dtrue%26hem_included%3Dfalse%26tcf_gdprApplies%3Dfalse%26tcfBehavior%3DnotApplicable&sc=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&abxe=1&dt=1690461471080&lmt=1690029259&adxs=1432&adys=730&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&frm=20&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYtILsupkxSABSAghkEhkKCnB1YmNpZC5vcmcYtILsupkxSABSAghkEhcKCHJ0YmhvdXNlGLSC7LqZMUgAUgIIZBIZCgp1aWRhcGkuY29tGLOC7LqZMUgAUgIIZBIUCgVvcGVueBi0guy6mTFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YtILsupkxSABSAghkEhsKDGlkNS1zeW5jLmNvbRi0guy6mTFIAFICCGQ.&dlt=1690461466474&idt=4415

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

98e5d8338bc423e03105d5d3739ed51919eb1f8655823309237c80fe3cba264d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10805
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 23 KB
11 KB 490ms
485ms XHR
text/plain 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=493766145868713&correlator=389592589064501&eid=31076488%2C31070232&output=ldjh&gdfp_req=1&vrg=202307260101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=20842576%3A116518301%2CIN44NM%2CIN44NM-DDR.D&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250%7C160x600%7C300x600&ifi=13&adks=3809490118&didk=2997991039&sfv=1-0-40&prev_scp=pos%3D4%26monu%3D300x250-160x600-300x600_A4%26slotNum%3D1%26placementNum%3D1%26directDeals%3Dsticky_pillar%26allowNative%3Dfalse%26bidder_responseTime%3Dmedianet_700%26auction_id%3D4c32b460-310c-4b68-9165-e92aa4ed30c2%26monu_df%3D0.06%26safeframe%3Dtrue%26bid_source%3Dclient%26hb_format%3Dbanner%26hb_size%3D300x600%26hb_adid%3D18294e4c7315bff5%26hb_bidder%3Dmedianet%26amznbid%3D2%26amznp%3D2%26refresh_count%3D0%26tabVisibilityState%3Dvisible%26max_bid%3Ddf%26provider_performance%3Dmedianet_notchrome_0.06%26context%3D12_NY_notchrome%26slotOnScreen%3Dtrue&eri=1&cust_params=page_num%3D0%26big4%3Dtrue%26url%3Dehfmc-com.ngontinh24.com%26referrer%3Ddirect%26infolinks%3Dtrue%26hem_included%3Dfalse%26tcf_gdprApplies%3Dfalse%26tcfBehavior%3DnotApplicable&sc=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&abxe=1&dt=1690461471088&lmt=1690029259&adxs=-300&adys=1200&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=2&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&frm=20&vis=1&psz=300x-1&msz=300x-1&fws=512&ohw=0&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYtILsupkxSABSAghkEhkKCnB1YmNpZC5vcmcYtILsupkxSABSAghkEhcKCHJ0YmhvdXNlGLSC7LqZMUgAUgIIZBIZCgp1aWRhcGkuY29tGLOC7LqZMUgAUgIIZBIUCgVvcGVueBi0guy6mTFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YtILsupkxSABSAghkEhsKDGlkNS1zeW5jLmNvbRi0guy6mTFIAFICCGQ.&dlt=1690461466474&idt=4415

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dad4d403e4089d279bbf97965c0db4a936a4472936b149b83a39781b27ce7edc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10857
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 385 B
168 B 419ms
414ms XHR
text/plain 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=493766145868713&correlator=4242484407260731&eid=31076488%2C31070232&output=ldjh&gdfp_req=1&vrg=202307260101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=20842576%3A116518301%2CIN44NM%2CIN44NM-DDS.A&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=160x600&ifi=14&adks=1314502783&didk=1060650966&sfv=1-0-40&prev_scp=pos%3D1%26monu%3D160x600_A1%26slotNum%3D1%26placementNum%3D1%26allowNative%3Dfalse%26amznbid%3D2%26amznp%3D2%26bidder_responseTime%3Dmedianet_400%26auction_id%3D8338dbe7-a1bf-4ee8-adf5-582aac2c62e4%26monu_df%3D0.02%26safeframe%3Dtrue%26bid_source%3Dclient%26hb_format%3Dbanner%26hb_size%3D160x600%26hb_adid%3D1837cf2adb4e24ec%26hb_bidder%3Dmedianet%26refresh_count%3D0%26tabVisibilityState%3Dvisible%26max_bid%3Ddf%26provider_performance%3Dmedianet_notchrome_0.02%26context%3D12_NY_notchrome%26slotOnScreen%3Dfalse&eri=1&cust_params=page_num%3D0%26big4%3Dtrue%26url%3Dehfmc-com.ngontinh24.com%26referrer%3Ddirect%26infolinks%3Dtrue%26hem_included%3Dfalse%26tcf_gdprApplies%3Dfalse%26tcfBehavior%3DnotApplicable&sc=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&abxe=1&dt=1690461471127&lmt=1690029259&adxs=1140&adys=3092&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=3&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&frm=20&vis=1&psz=160x0&msz=160x0&fws=512&ohw=0&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYtILsupkxSABSAghkEhkKCnB1YmNpZC5vcmcYtILsupkxSABSAghkEhcKCHJ0YmhvdXNlGLSC7LqZMUgAUgIIZBIZCgp1aWRhcGkuY29tGLOC7LqZMUgAUgIIZBIUCgVvcGVueBi0guy6mTFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YtILsupkxSABSAghkEhsKDGlkNS1zeW5jLmNvbRi0guy6mTFIAFICCGQ.&dlt=1690461466474&idt=4415

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

22a2b4d664d7993a771b9051bc069b00062894e04a32bf6f25388a3cc2f6b611

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 133
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 23 KB
10 KB 440ms
437ms XHR
text/plain 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=493766145868713&correlator=2300873005625576&eid=31076488%2C31070232&output=ldjh&gdfp_req=1&vrg=202307260101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=20842576%3A116518301%2CIN44NM%2CIN44NM-DDH.A&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90&ifi=15&adks=891648550&didk=2360857655&sfv=1-0-40&prev_scp=pos%3D1%26monu%3D728x90_A1%26slotNum%3D1%26placementNum%3D1%26allowNative%3Dfalse%26bidder_responseTime%3Dmedianet_500%26auction_id%3D0dfb9534-1a9a-4fe0-9dcb-75a531e67bb6%26monu_df%3D0.04%26safeframe%3Dtrue%26bid_source%3Dclient%26hb_format%3Dbanner%26hb_size%3D728x90%26hb_adid%3D1842f2fb78e73523%26hb_bidder%3Dmedianet%26amznbid%3D2%26amznp%3D2%26refresh_count%3D0%26tabVisibilityState%3Dvisible%26max_bid%3Ddf%26provider_performance%3Dmedianet_notchrome_0.04%26context%3D12_NY_notchrome%26slotOnScreen%3Dtrue&eri=1&cust_params=page_num%3D0%26big4%3Dtrue%26url%3Dehfmc-com.ngontinh24.com%26referrer%3Ddirect%26infolinks%3Dtrue%26hem_included%3Dfalse%26tcf_gdprApplies%3Dfalse%26tcfBehavior%3DnotApplicable&sc=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&abxe=1&dt=1690461471147&lmt=1690029259&adxs=222&adys=1189&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&frm=20&vis=1&psz=728x0&msz=728x0&fws=0&ohw=0&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYtILsupkxSABSAghkEhkKCnB1YmNpZC5vcmcYtILsupkxSABSAghkEhcKCHJ0YmhvdXNlGLSC7LqZMUgAUgIIZBIZCgp1aWRhcGkuY29tGLOC7LqZMUgAUgIIZBIUCgVvcGVueBi0guy6mTFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YtILsupkxSABSAghkEhsKDGlkNS1zeW5jLmNvbRi0guy6mTFIAFICCGQ.&dlt=1690461466474&idt=4415

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9f7e47091bb856702a7083595d4ced658230c00544df3ac83cafa93874440ea0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10630
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 23 KB
10 KB 391ms
388ms XHR
text/plain 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=493766145868713&correlator=3475390114524877&eid=31076488%2C31070232&output=ldjh&gdfp_req=1&vrg=202307260101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=20842576%3A116518301%2CIN44NM%2CIN44NM-DDS.D&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=160x600&ifi=16&adks=932655064&didk=1847662068&sfv=1-0-40&prev_scp=pos%3D4%26monu%3D160x600_B4%26slotNum%3D1%26placementNum%3D1%26allowNative%3Dfalse%26amznbid%3D2%26amznp%3D2%26bidder_responseTime%3Dyieldmo_1100%26auction_id%3De8350092-e66e-40ee-b240-a84db154ae4f%26monu_df%3D0.17%26safeframe%3Dtrue%26bid_source%3Dclient%26hb_format%3Dbanner%26hb_size%3D160x600%26hb_adid%3D232df4b9ccc2c37c%26hb_bidder%3Dyieldmo%26refresh_count%3D0%26tabVisibilityState%3Dvisible%26max_bid%3Ddf%26provider_performance%3Dyieldmo_notchrome_0.17%26context%3D12_NY_notchrome%26slotOnScreen%3Dtrue&eri=1&cust_params=page_num%3D0%26big4%3Dtrue%26url%3Dehfmc-com.ngontinh24.com%26referrer%3Ddirect%26infolinks%3Dtrue%26hem_included%3Dfalse%26tcf_gdprApplies%3Dfalse%26tcfBehavior%3DnotApplicable&sc=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&abxe=1&dt=1690461471153&lmt=1690029259&adxs=8&adys=730&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&frm=20&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYtILsupkxSABSAghkEhkKCnB1YmNpZC5vcmcYtILsupkxSABSAghkEhcKCHJ0YmhvdXNlGLSC7LqZMUgAUgIIZBIZCgp1aWRhcGkuY29tGLOC7LqZMUgAUgIIZBIUCgVvcGVueBi0guy6mTFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YtILsupkxSABSAghkEhsKDGlkNS1zeW5jLmNvbRi0guy6mTFIAFICCGQ.&dlt=1690461466474&idt=4415

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9920d97b97d4d84af1d4ea5036084838e8583600892536db54fda3f773d9fa5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10660
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 27 KB
12 KB 407ms
404ms XHR
text/plain 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=493766145868713&correlator=2948554302453597&eid=31076488%2C31070232&output=ldjh&gdfp_req=1&vrg=202307260101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=20842576%3A116518301%2CIN44NM%2CIN44NM-DDA.B&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90&ifi=17&adks=3242601509&didk=4110994414&sfv=1-0-40&prev_scp=pos%3D2%26monu%3D728x90_B2%26slotNum%3D1%26placementNum%3D1%26directDeals%3Dsticky_bottom%26allowNative%3Dfalse%26bidder_responseTime%3Dmedianet_400%26auction_id%3D0a67bca1-0c85-4920-aa8d-a29dcb5e4853%26monu_df%3D0.05%26safeframe%3Dtrue%26bid_source%3Dclient%26hb_format%3Dbanner%26hb_size%3D728x90%26hb_adid%3D164aefad61a99869%26hb_bidder%3Dmedianet%26amznbid%3D2%26amznp%3D2%26refresh_count%3D0%26tabVisibilityState%3Dvisible%26max_bid%3Ddf%26provider_performance%3Dmedianet_notchrome_0.05%26context%3D12_NY_notchrome%26slotOnScreen%3Dtrue&eri=1&cust_params=page_num%3D0%26big4%3Dtrue%26url%3Dehfmc-com.ngontinh24.com%26referrer%3Ddirect%26infolinks%3Dtrue%26hem_included%3Dfalse%26tcf_gdprApplies%3Dfalse%26tcfBehavior%3DnotApplicable&sc=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&abxe=1&dt=1690461471157&lmt=1690029259&adxs=436&adys=1200&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=4&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&frm=20&vis=1&psz=728x-1&msz=728x-1&fws=512&ohw=0&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYtILsupkxSABSAghkEhkKCnB1YmNpZC5vcmcYtILsupkxSABSAghkEhcKCHJ0YmhvdXNlGLSC7LqZMUgAUgIIZBIZCgp1aWRhcGkuY29tGLOC7LqZMUgAUgIIZBIUCgVvcGVueBi0guy6mTFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YtILsupkxSABSAghkEhsKDGlkNS1zeW5jLmNvbRi0guy6mTFIAFICCGQ.&dlt=1690461466474&idt=4415

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e88ad9eae900274df2ef5372f8f78469acdafef7b4e0fda34ce534cf48a54414

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12043
x-xss-protection: 0
google-lineitem-id: 6239183429
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138386434142
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 23 KB
10 KB 911ms
907ms XHR
text/plain 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=493766145868713&correlator=264599157351562&eid=31076488%2C31070232&output=ldjh&gdfp_req=1&vrg=202307260101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=20842576%3A116518301%2CIN44NM%2CIN44NM-DDH.I&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90&ifi=18&adks=2678087454&didk=3510166364&sfv=1-0-40&prev_scp=pos%3D9%26monu%3D728x90_A9%26slotNum%3D1%26placementNum%3D1%26directDeals%3Dsticky_header%26allowNative%3Dfalse%26amznbid%3D2%26amznp%3D2%26bidder_responseTime%3Dmedianet_1000%26auction_id%3D2aea0ab9-0eba-46ba-9632-38d2ab4dbe29%26monu_df%3D0.04%26safeframe%3Dtrue%26bid_source%3Dclient%26hb_format%3Dbanner%26hb_size%3D728x90%26hb_adid%3D2633d0de20db5fe3%26hb_bidder%3Dmedianet%26refresh_count%3D0%26tabVisibilityState%3Dvisible%26max_bid%3Ddf%26provider_performance%3Dmedianet_notchrome_0.04%26context%3D12_NY_notchrome%26slotOnScreen%3Dtrue&eri=1&cust_params=page_num%3D0%26big4%3Dtrue%26url%3Dehfmc-com.ngontinh24.com%26referrer%3Ddirect%26infolinks%3Dtrue%26hem_included%3Dfalse%26tcf_gdprApplies%3Dfalse%26tcfBehavior%3DnotApplicable&sc=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&abxe=1&dt=1690461471162&lmt=1690029259&adxs=436&adys=45&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&frm=20&vis=1&psz=728x0&msz=728x0&fws=0&ohw=0&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYtILsupkxSABSAghkEhkKCnB1YmNpZC5vcmcYtILsupkxSABSAghkEhcKCHJ0YmhvdXNlGLSC7LqZMUgAUgIIZBIZCgp1aWRhcGkuY29tGLOC7LqZMUgAUgIIZBIUCgVvcGVueBi0guy6mTFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YtILsupkxSABSAghkEhsKDGlkNS1zeW5jLmNvbRi0guy6mTFIAFICCGQ.&dlt=1690461466474&idt=4415

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6a0811132bfbbf1b293b593f578568adb239f6f53a677de9bd5ffd3b4c58b74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:52 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10688
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 40A3 6 KB
3 KB 304ms
42ms Document
text/html 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:51 GMT
expires: Fri, 26 Jul 2024 12:37:51 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3B6D
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAaAOQGEk2ZwI7grLTfhBZ20ir0077Wll9N-x8CNW4LpisN_Ql3i6q3-rmKPNZPYL134YdDYaASAyh2LsLntpo83wVN2qvseeYGkbyQ&google_gid=CAESEBFrDr8rowAPtvXaI-RuYew&g...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwamZ5RGV4cWNLXzBIVjZuWmlyM2hQSjE1c3hMeml1SlBUVDY3SnpHd2JlYw==&google_push

170 B
188 B

39ms
38ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwamZ5RGV4cWNLXzBIVjZuWmlyM2hQSjE1c3hMeml1SlBUVDY3SnpHd2JlYw==&google_push

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 27 Jul 2023 12:37:51 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwamZ5RGV4cWNLXzBIVjZuWmlyM2hQSjE1c3hMeml1SlBUVDY3SnpHd2JlYw==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 204 CookieSyncAdX
rtb.adentifi.com/ Frame 3B6D 0
287 B 262ms
12ms Image
text/plain 34.230.170.218
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncAdX?google_gid=CAESEEhEIi3Bx6lvCr9WcDwT7yg&google_cver=1&google_push=AaAOQGGqhAOE-Lu8w22qD3_NZ5q3HKKGVQO4eNPhLou0GidPP9fNd1uYsIcLLfrOcYJvJypGVYI3ce5MWeGFPz-2BweVEImtcvfw7g
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.230.170.218 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-230-170-218.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 3B6D 43 B
363 B 261ms
11ms Image
image/gif 74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAaAOQGHi_RzI3obHohF0Cf-RP7CPsqLgmU4v1fL1oMQF4EvLf0BwhGSqI1DEOSFVod5y89AKyTK6B0en3psLnu81AsjH-UC2vc04&google_gid=CAESEM5wTt3pM5lWSSeSwEmktug&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:51 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 203993
expires: Thu, 27 Jul 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3B6D
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEJ6NGE4Xz7v2qAZv4esK-tQ&google_cver=1&google_push=AaAOQGHfvnTzEamu8XUpiQOBoi7ZLoThYT2Da_nDIb1NB7_--QVxFOw7HxotXDrPlSgvRM6gmJSn9XJwz3x8N0p...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGHfvnTzEamu8XUpiQOBoi7ZLoThYT2Da_nDIb1NB7_--QVxFOw7HxotXDrPlSgvRM6gmJSn9XJwz3x8N0...

170 B
188 B

39ms
38ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGHfvnTzEamu8XUpiQOBoi7ZLoThYT2Da_nDIb1NB7_--QVxFOw7HxotXDrPlSgvRM6gmJSn9XJwz3x8N0psFmls7PWS040-BA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGHfvnTzEamu8XUpiQOBoi7ZLoThYT2Da_nDIb1NB7_--QVxFOw7HxotXDrPlSgvRM6gmJSn9XJwz3x8N0psFmls7PWS040-BA
Date: Thu, 27 Jul 2023 12:37:51 GMT
Connection: keep-alive
Content-Length: 244
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3B6D
Redirect Chain

https://dsp.adkernel.com/sync?exchange=11&google_gid=CAESEGO3Uxi_OpAY-WBx_AlDGkg&google_cver=1&google_push=AaAOQGF5abB1652CD3ujw3jrqi67PRlCtN5Srv0q04qkvhLS-o8d3OlgznKSHfMj7TsDjNKtxbudnoi3WDk1lttcny...
https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTgzMDY3MjU0Mjg5OTMzNjkwNjE&google_push=AaAOQGF5abB1652CD3ujw3jrqi67PRlCtN5Srv0q04qkvhLS-o8d3OlgznKSHfMj7TsDjNKtxbudnoi3WDk1lttcnyjK...

170 B
188 B

38ms
37ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTgzMDY3MjU0Mjg5OTMzNjkwNjE&google_push=AaAOQGF5abB1652CD3ujw3jrqi67PRlCtN5Srv0q04qkvhLS-o8d3OlgznKSHfMj7TsDjNKtxbudnoi3WDk1lttcnyjKuA-DYgrx

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTgzMDY3MjU0Mjg5OTMzNjkwNjE&google_push=AaAOQGF5abB1652CD3ujw3jrqi67PRlCtN5Srv0q04qkvhLS-o8d3OlgznKSHfMj7TsDjNKtxbudnoi3WDk1lttcnyjKuA-DYgrx
Date: Thu, 27 Jul 2023 12:37:51 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3B6D
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=google&ssp_init=step1&google_gid=CAESEOqUK2rdwEr7Dk1NZh19nJ0&google_cver=1&google_push=AaAOQGFunk3k7tuLb82d91AgQgGBtv2iF7MInuSRZtfLM9tX2NgQ0r_LcwFMSrK08SXaQYQFkkrD...
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=google&ssp_init=step1&google_gid=CAESEOqUK2rdwEr7Dk1NZh19nJ0&google_cver=1&google_push=AaAOQGFunk3k7tuLb82d91AgQgGBtv2iF7MInuSRZtfLM9tX2NgQ0r_LcwFMSrK08SXaQY...
https://cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=u1KwCTZBRdeHYDZ6jdpXcw==&no_redirect=1&google_push=AaAOQGFunk3k7tuLb82d91AgQgGBtv2iF7MInuSRZtfLM9tX2NgQ0r...

170 B
188 B

40ms
39ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=u1KwCTZBRdeHYDZ6jdpXcw==&no_redirect=1&google_push=AaAOQGFunk3k7tuLb82d91AgQgGBtv2iF7MInuSRZtfLM9tX2NgQ0r_LcwFMSrK08SXaQYQFkkrDvOKrrt7Gzi4zoNRvxD3eugpDhLQ

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=u1KwCTZBRdeHYDZ6jdpXcw==&no_redirect=1&google_push=AaAOQGFunk3k7tuLb82d91AgQgGBtv2iF7MInuSRZtfLM9tX2NgQ0r_LcwFMSrK08SXaQYQFkkrDvOKrrt7Gzi4zoNRvxD3eugpDhLQ
date: Thu, 27 Jul 2023 12:37:52 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3B6D
Redirect Chain

https://trace.mediago.io/cs/google?google_gid=CAESEG3Hmq533Y_1MHFR44Ysxho&google_cver=1&google_push=AaAOQGFUWMhfavleTqL5Po9-eEFtjTC66Jik9nbwtFacttrQOlQkxACalaTe8XZP1am6IRCWpmCQGZ-btwmWSdFZdL9qekTDg...
https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AaAOQGFUWMhfavleTqL5Po9-eEFtjTC66Jik9nbwtFacttrQOlQkxACalaTe8XZP1am6IRCWpmCQGZ-btwmWSdFZdL9qekTDghuIAqc&google_hm=70669cc9b63...

170 B
188 B

37ms
37ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AaAOQGFUWMhfavleTqL5Po9-eEFtjTC66Jik9nbwtFacttrQOlQkxACalaTe8XZP1am6IRCWpmCQGZ-btwmWSdFZdL9qekTDghuIAqc&google_hm=70669cc9b639c7f4172d478b3307d7e3

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AaAOQGFUWMhfavleTqL5Po9-eEFtjTC66Jik9nbwtFacttrQOlQkxACalaTe8XZP1am6IRCWpmCQGZ-btwmWSdFZdL9qekTDghuIAqc&google_hm=70669cc9b639c7f4172d478b3307d7e3
date: Thu, 27 Jul 2023 12:37:51 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 249
content-type: text/html; charset=utf-8

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 3B6D 0
12 B 36ms
35ms Image
text/html 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JtT22wkCRLeojnSVBke6gna1L0qPEtv9uRQwINiMq4Vv9GTAPLFktOZ5uZS5Zpz2ECAqfMTXk

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200 swfIndex.php Show response
ads.stickyadstv.com/www/delivery/ 67 B
655 B 82ms
80ms XHR
application/xml 63.251.28.234
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.stickyadstv.com/www/delivery/swfIndex.php?reqType=AdsSetup&protocolVersion=4.2&zoneId=13711039&componentId=prebid&componentSubId=mustang&timestamp=1690461471238&_fw_bidfloor=0.8&_fw_bidfloorcur=USD&pbjs_version=7.51.0&pKey=160478683&_fw_us_privacy=1---&schain=%7B%22nodes%22%3A%5B%7B%22hp%22%3A1%2C%22asi%22%3A%22vidcrunch.com%22%2C%22sid%22%3A%22632d59d7b9689f25ad20b012%22%7D%5D%2C%22complete%22%3A1%2C%22ver%22%3A%221.0%22%7D&loc=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&playerSize=300x250&video_context=instream&video_placement=3&video_plcmt=2
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb7.51.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 63.251.28.234 Secaucus, United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS
Software: nginx /
Resource Hash: b86a66f50a52eacf8ebea7e083790e4b094d740c7abd4ee07f53e139a6ff5e71

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:51 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: application/xml;charset=UTF-8
Access-Control-Allow-Origin: https://ehfmc-com.ngontinh24.com
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
x-sticky-vk: 1690461471227048-319

GET
H/1.1 200 swfIndex.php Show response
ads.stickyadstv.com/www/delivery/ 67 B
654 B 119ms
118ms XHR
application/xml 63.251.28.234
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.stickyadstv.com/www/delivery/swfIndex.php?reqType=AdsSetup&protocolVersion=4.2&zoneId=13711199&componentId=prebid&componentSubId=mustang&timestamp=1690461471240&_fw_bidfloor=0.6001&_fw_bidfloorcur=USD&pbjs_version=7.51.0&pKey=105320791&_fw_us_privacy=1---&schain=%7B%22nodes%22%3A%5B%7B%22hp%22%3A1%2C%22asi%22%3A%22vidcrunch.com%22%2C%22sid%22%3A%22632d59d7b9689f25ad20b012%22%7D%5D%2C%22complete%22%3A1%2C%22ver%22%3A%221.0%22%7D&loc=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&playerSize=300x250&video_context=instream&video_placement=3&video_plcmt=2
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb7.51.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 63.251.28.234 Secaucus, United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS
Software: nginx /
Resource Hash: b86a66f50a52eacf8ebea7e083790e4b094d740c7abd4ee07f53e139a6ff5e71

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:51 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: application/xml;charset=UTF-8
Access-Control-Allow-Origin: https://ehfmc-com.ngontinh24.com
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
x-sticky-vk: 1690461471245011-65

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 138 B
820 B 19ms
18ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb7.51.0.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

bea690986cc106755781f7bb611dfc235a03262193745d29457c7604e85d777d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:51 GMT
an-x-request-uuid: e01a0b8b-429c-420c-928a-e3ad90950909
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 138
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame E44D 111 KB
39 KB 163ms
4ms Script
text/javascript 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 02:37:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36028
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 28 Jul 2023 02:37:23 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/elements/html/ Frame E44D 11 KB
4 KB 13ms
11ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AYVOp8XxK4kE5iz3c7pF-Y9lRQg7siW0j5plYjYrBJaagqJdpwvWBvs_46AZsPtRMUP69ajkUkQkCcqoa56cBXXBFkSQ&cry=1&dbm_d=AKAmf-BmJkhXXAhKJaMrajeqlBGgZ0ONWZFjfk0xsUQdNrBNhC40DYGSRXX3R9SRp0TTdYIPYjsJvCPjZNRqq_fuFqR4Pkl28e6zK9V6hbhQ_FoyzAvcopjuXAIUYOdd_FJutBQiuA2kSCu6vOfNUvwTCkEMh0ac5GazZqODdczOyBQzpjyKw9Dpg4HGFU8lmQiLO6DRLeiFpaIaE3vK3mfKlOTeoe_rNgl33e8uA4YLZddj8bkbri4VI-a4k29zM_B5U8HDeKygerNhfaAKoX3LqstYXDM-PQHgeVPn12nXayzWN7FBDmjEjJsDWtJm46WnXF4GjPNtj-NBE2J1F9hKTmIbP7oudxY5TVdE4DdY69Qu4k6ea9zt1UNcFXIhEzMawDnHy-70OvDjdkXzz9wiDJHE-3FmHrUZON9QkAlmi8eVUc1i86-M4TWTfHIw8G4j6rAe0hNRf_ZyUzL-gBGkYciXXokXAYERzzQIOFBq-5qhH-vX_1cA9BNuOe1AUS7NMqr3XamxlidbgH02KX6uei0FllrhBhZ-l3ZVabSuQeqsy90zHY_K7gWrPe0b_rpnt0_ZhBU6yXlrU1dFYFByZzH2Y84zYuhLGYKAr38yRVzRtOyvosBuOJFQqsO-TUU4clHrwTywyE9gPUT0W8l-JL7HRODr61tslaERTzo2tQMjsQGUKysYYnNzR7q7tNNnvk1zTwe4dm6FHDVuceHEpHrfOzp__D9DRmsC1y5OHdwaJ_8AZC-2_0Et_R09P8TRlFnoTNlbjqc1TaSQoLs_9iwNRqwmIwdnFIr94VRhTUgf7bgt6PsxSrQED5bROYzNst1SxX3NbfKB5oEbwytXi-Cu79YlCqTE08pZSvc-WQLkjVgp69fmcjNge6vvpJ5V9iYnPucQK7OstpuV1MWg8uBhN8NZnCLdl6xbBrcc2H7XHC_5Ef5tdBWTom4AbTCUCEx68Z1NtXCVpANKWcnR-LxZbjaM5fZNeZ8HunSPqZl48bGOoGWfwD879OX2Gv4rJ6Lw3vxp7K1peMWKTGDfLFo9NH5bUD5_rMIBZcy1hAtpCWuC3GNQq7jGzArbDW_o4C65DtAeS1J3qaglmKCM04XGzzJjGc-smFwszsY4mNyS32ex-mRDx2MgBfQoPpjYdiuWMvgyjXcUm7jzUC3tkllUcaqAvsuTfKdbJiojwkj0RvNsVZgKp9FPFy-SnSauhlemBXzI1ubAkLqgT6W0pi0gr0vJwwai0AOPlyW9wVr5nVn1qjtr89JDRtkpeb3YpQpucN-XLojATyp32gvQHfdebrjd5CfKOzWmhNczOhPCrd_v1n1oCP2NYvUapzGVfgl4aDqwUfF1mGdDHgI2NS5WQIJQC4Q7kAjBCAkthVK9pWNPBx6ak1JMHuNmQ-lAxHStKD9MdYX5Q7r_uswKRM8IVwBMB5zMC-oUYaDmW0a-QjOtCKPRsM_RKwa81bmKXx6BlrRc0X6TtaVePVLj9PmJJ3KUkFnxDqVVbfZOmk3gg8LfOW6Pqbhu4uisZveGpi0lkKvNmoVb0rizKi0O22SXtAnJYqUX29vAbyOnEFWCVo41Fc4LgCVtkLKsDYBOLCL9iPWMq27WC-lepOw8fdoqVViVv-v6nkU4jfiZv5c_yCsKODYb5ZdJ_rwY2w1Td_OGtP3-g3EINBFrjML1aFqVQrO3VQC71-AP2FEzAk83DvzifokHWnbVaWRbHb2zl5phtVvLunEF93U9oSpBEgD74lRt9O_1TOsMfnu2YO8F236WT27oJkLVKbiKcvXwXsF9twA1FXnUGlZfyQrOZgRJzAStZzkGdZywqKk7VYUl3wwm01biqP0F-KYUoUuUPBQtdwAi5W-1uzxkzg9FAGDJfzU8ObAhMp6yM5hSWZisQc3QstTUmsuATtUSlgRZRUPWeCkjwAFC2R_84IZgJE-e3naN8SKXx8RUhc5pFiudtj-dab5e7R9P0txZndlOxhZqpL3i-jlmk1iWoVwxbKbqw8kZQk_IUY7Ut8-8Lty0cL4r3iBF0LU8Fm3ugQ0O2HLc2cMRFYYA-jYdxEFRkq81tTgusWVny4qWKTQj4P6hpftxKc8tgvhsbft5o2aUa7DKzZ0qAhhcPdQQkVukZjPFYZTdoYrzsvLUOd9JBz8w_RoRWXp9S-X66_wQ0MkQk3k0ksLU3-5PKsP1SdywOv4pXUrslUzcxyhCFBsloE_5H-JI03O7TI0QvhSUZEjVYmIX5bwBw29CKcaS6P4XnI-ZSbSoN9A2J8U57m2iiXRJwJQbFzBzYUjAKhmfgoo5zEUU7ZEnCCHMLkqNMswI26LgrtsMm53qiic8uvQXC1UoOEwIqxPHVv0G5xzYTlEKM8ryO2mCvzx3OPmkD1Wpjn-7TpddHZIMp2A_5tgILT0tFwWiEVF1dwle-Dt58NgVzkxRI6SCgLCf2n4gmAHsE6B7-NfVpt5r4SsP81teQ3ct7tvyO7U8wRnBEjceo8Lb9ZvVkSYnEM0eZ_aZbH_mqRLlJFZrY7wht4bbvEMD_UTEsDU-kDMFf3MMdqMND_ehNdrZcpVbi-H5dLWvo4Md5LH1dJoD8jjnay_Fl3IqFn8jtKnVoqEHje8Y6VhzTWaLoplLTUNFclX2hhKGeM8GS-WmgGd92KLXBb0dCr4JSKbwum8OQHIvFAX7jP_ZPmqgzAi-mLuQHhdu7CDoe7v0ra8BfIFLfjG0Fd83hIF-HUQ5aW0WISpsgYU1KKo7ffb_zF1ib7sAC4wmAoF3hQh_9IMDTu5xA1OFbfg7pwU008R05ncvEyPf9dela2QwNAyndv5Yagvocv8RAH9V28rjaiopNAW2FVaz3HNJGtVARl0d9yStYq2c4OzRX6jJAJo04bY4CCbOmzyNDIddvr6m9SGEejNvuZI4r5XfY6SEygh6li1e5-St0yJ6xX2v6QUkBg-2eMQoBF8aZen1LZxeyd2i2y79XfyjQIzUUv6lhPWYsJZECbta57moTVHNDokOOGWEmNmkvKgQ4egKDLFYxc9USODbUy2_p-sEU2Rwwg0PCEdllqtQEu3kF7of8NEYKmkS2VQI3HuJ6vi9GGQ_V0GirEotfEnaIfKRoV9421IzIqSB85WqX4x3HtwG2a49Xp3mCct9LYQZ27uwVKP-lBG-kT5nh5oYsQs3nGGoECuUdhnEf3CCWC-CrQT9fTg5zBCegmSQty0cmefjH0-cyLxp8cwIUlwPXgyccqn0YLfh9PkQj_zOxoohn6-125mh14gsQiejLLJdIRj_q2wzzLgbqkCdMbfyLfEbrwsawSFvQLIP4lFGQEplBfuQIyb6d0OekWk7Q9VBzT09JPX609_GvZJ7nAoaVT45CMAML-3NLE3g88SfW8gLIvtCXYao2lBTlTbp&cid=CAQSKQBpAlJWzY0bIBzU6w2_RbHAj2CbW_j7xPxXhX1muXWicelitmPW9lwTGAE&dv3_ver=m202306200101&rfl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ds=l&xdt=1&iif=1&cor=3579400355349208600&adk=2215386029&idt=88&cac=0&dtd=55

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:33:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57846
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:33:45 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/ Frame E44D 30 KB
11 KB 12ms
11ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0b2c524428c1a3604e3d1cdc61c2ae371a8f2fc767f801180fcf892db9e07c3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:51:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78362
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11572
x-xss-protection: 0
server: cafe
etag: 5014499061205845695
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:51:49 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame E44D 41 KB
13 KB 12ms
12ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:39:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57523
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Jul 2024 20:39:08 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3AC1 1 KB
643 B 31ms
15ms Document
text/html 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 58803
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:17:48 GMT
etag: 48472445140208031
expires: Thu, 27 Jul 2023 20:17:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame E44D 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 92c63cba499a41bc07ea7cd12f72d10e5d607e6e88b294ef05879ef19033b1be

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame A3EC 0
19 B 38ms
37ms Image
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CaOBJG2XCZNeqEb-nrr4Po5WIsAW0iN2dccH3r7fTELCQHxABII3V3iRgycapi8Ck2A-gAffim7QoyAECqAMByAPJBKoE1wFP0Ekww5Rfk9fsNAKAleV13DfLntlC14c2ByE0tOgaNY3AEPBbyCV1fU7-KszeuKU6VkQz225DyhQ4sow160l0yqfN9fxYCC1U3gdIENodIiHlfRppTTDehzUIsDQZ8JgFJfeXkoT98ow2Z2n_cV3RbyZH_yvcbOkxbx8NvPNxf-AA2QvzoBH0g1z0rqfCa0EZtL798lJhWHdQi--wfO2NdT6rWWqcE57SH6SWBUoxFFKs_jIjNbvK8ORWyJjoop-atYxa46JqozqClxjuqVcSyfQEcf-ACsAE4ff34YEEkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBgKAB_ea7JMDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQtf8Y0ggUCIBhEAEYHzICigI6AoBASL39wTqACgHICwHYEw3QFQGAFwGyFxwKGggAEhRwdWItNzEwOTg2NDI1OTM0ODkzOBgA&sigh=ATdjN3K5Bp0&uach_m=[UACH]&cid=CAQSGwBpAlJWk6rJph_rNYjSv6dauvJSEk4VoVv30xgB&cbvp=2&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=1663128080&adf=743467531&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466964&bpp=1&bdt=490&idt=272&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=584&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=h3JYZEuvl9&p=https%3A//ehfmc-com.ngontinh24.com&dtd=281

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=1663128080&adf=743467531&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466964&bpp=1&bdt=490&idt=272&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=584&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=h3JYZEuvl9&p=https%3A//ehfmc-com.ngontinh24.com&dtd=281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 27 Jul 2023 12:37:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/ Frame ADD9 30 KB
11 KB 14ms
12ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CuPVv_nWLWVSk8KJ4NJxW5CKIJ7hvEzFF8ZZFu-4EbX-GLdhMmWiuECnkp_MBdAYqXLZbMWrEcWez76jaoN75EA6YOvw&cry=1&dbm_d=AKAmf-CSNODUmxLiLEw0wmUElcHrL8nMqgCH85QJjpHPZCYWANqCcne8VPGU2t_Ddf6iaaHBkAH-_dyqs8eYEbahrf0j2T7-5Et638a_jH4u-d8EBl8kNANbRpSgQ3kJYGmwsaXYXjiEudkMY0GLWd1NI53ChW9xHv94U_IOaIzaPZSNWlE4TJa7jXTyMlGShSpx1LdLlGkvLbwopzmOheO8_D-ddLbc2vJFB0x-uV_kKxTfXEqP1p96YQigJYm-wvJ80daqj6e6cdVXF1xTe8BVIrMmWzCQLS2fGYAwuwyVbBrostlnweJNFijgPGjCYwPuVCZTOW6Kc28gLA-6Qgx4u9QU7bgQrgcBcyo4L2V_oWSH5Jc-McXRcshYlCheSCu4OR8MVBBpsH0b-BYB6hLZhGNFYsiC2dG13qP4m73ljbiGW62BaVf52Edl-CO214QrY_2KXZziFyav0TssowSKgsLVFGGHVznzPOUG6ccec4ftZkG5T0c6fy2x_sc3hBCcC8h9J71ZvgL57hbn_5zvzBmncYSLfdK5YCJX8ebMUkTUvO5aPKGbPHiw62EYzqJ2jrSn4qsvBa2IuyVKgU8UgvNfBEQBxRQCUJg70nS_iuDOIZNHLbL_To7NNN9wfKWsWBGWBi9FW946kIKrN1q2vptnXdTuGRU0-9UPLdCaoRYY25Yd0rQifZu0DzzmFRxU0mfMojaGR3Rw6nC529RT6hxqXEQgumbIW4rGd6UwjlY-5zTezVYjiYgqrUwmzSR4XiEiYmvC_JPC5WGeHfif0xYFWvLhfML8_DMpqzNk97aMGPM3ae936qPffG6NYQVnMfKQ4DFmbnTf0eWqeV5pZhZiTXyjWJqgszYn_AKOUHNZV6MSs33MbpiXB2O4hGVEQKTMOFQjzhdQ03Dly9fnz6foLXofaGGNBNhWuhQ-Rn_F3wHCAfQKo6aSLeEKQWwuhcT6dQzyDSfqQyld7N1UOANV3kWdr_EHt8O9bHWoio0RBWcaCQBycQARAuA3tLQEF1DK9_kt7Ni6hyafg5l2K0Qy4DZy0UEc0ecIYhR4DJOTIzL5G_uJij-FuZH8Fd5otI1OG1HfNf3cvHPq9BBn_Har74i6g_sFIgKKOd5Ccq-F6NnZxuSlwNiBlSEE0kZbPliZC1NvWEKC_oec48h2CwBIm9my3HustP50pMztwcGiDWxR2B62hm_ByebrKlBGY8hQeZpb01JIDNCYIvOK-9aooI_QOG17QmHvrL4JJszgG5gchFbuPeyJy4FWuLeUrJ5nQsPkFfVcst08wz45IhMYN_cQXh8Dm6lz32l0rwXVhn3XHCZcUDwLczaTPlDgxE1xIzNhLTmUcJsSREwe7V3cKogR_PA1yX9N1kO43hKwJe8Uja8AJJfyGYasPK1HSomlW0SMmGwkDx5dWqdWcQxVKcAOkmBPGn12KYePEEVyufDWYkw9Z4-agYEj6WfgBsDdJL0BQdolc6tq9NkCi078YAVVoK6v0-yymqUBxk7HeTSE_doH7C3ewYJE3B0NVR6G0BXjMSPauJgLgSfr5IXxDKlijaHz-KaZ5FQ2EF8x65ZV0C8fAGGioJDWTa7kAXLwz0lchaRSsDEBXIMSCo6tUKkF7DlLcqq3v9jTobEMkLwJ34EQcPIoGHPZ_YD-yy7cj6t4APnt069Fh3Hs2bIyzW8brPWkbGLrRdF160dht2Km9SZFee24NWF9kZsrz6QAaHoQMIf75HuPRh7BGYR89ObAOtMyzdMsbzN0ftk1D2JhELpDodyVgQ-2z9a4y0FzDMOfyUnho5Sb3-ZfN2qcw5CZIVcS5nQCpccFnc1TPwDP1lSG6FCpFDKuMdG6hIw1guVoVe6mAegW2CmAnkuGKA_oIr8LXAhZAOnlH0CQs8Ny6CrZyPayNxbEE-iyPkl6MyV1eZW-YHWdhbMt_JpEhPNnNZn9m-sIGYDFbFWc_495zxxMq3CH3T5OpY1Dt06a_GDZERGUSqAcoTLZFoJhj9R0W2hObJZLzi1ZyIGscBLBdFu_OMJqnFNV1FWYeSc65vppoKd1MSDZP_SbBnezxwvVa6e9rVign8FNQNy7DkaEgUHj0FYLVSDfy0Ce3Jyqbq4gy359gWlf_bK-L3LQO5kYoM3re0wwzl9ByufU4qYUM6gdFNHbdjdmXPj9h1tIt0tnJY4lCWaQhRWt75Tyz59dZN6VcJv2T0DggNqOVJPjt5GT4nqWOAhqsy5fwptKRgN0peUQzPUBUcyYA9nT2VNTw14SXhQiuZkbNJnXXZvbzfBeZaaYVnxBRNBD1mSTQ1xMhx_k0vQKm4ifbOAwELUVQJao9ivHobjlwgrmn6NRhMIU-sbCMajOrmd3KGQwczpcQ_ppkY88kJZUvfxtqypxD92MTj2mUQQS-e9GO2QQIC6AD50FMdxAxHyz2BufpAGYNvgRPjg7GpGgnbXDhVm-FCxW73PMgWyEGagZhkM6wB5lF5NBU2paMo9-ciE_cPCcR469KdsTVymmZYwgN0UOAjBi04zg2oT4BQKEarzIscL5clqx4bUC4JuqyqH_oxX55FBRNcqDgrNWo1UsT_BtamlhjeXiH5ZoTqiAFXzBN7m9h2IsqZADMyoQSK7Gw7NBeNP7EwZRG2lvKkNQVsJM1qwU92R4HYVA2B9L9nZmHmwkkAbVLzpW03LSDkkGZm_B1dXU1u8wn76eIjVaDZ9DhgtNE3ylsK0Lz6bb0wpfG-STICSIYt8b1D-cReAnbATNZRaPTeHtHTbnUo2p9att7mJ8hQ0niDvisTy1jQ5agjE6-ro6PGaJaU8_fnSxkOR2CYtS7Ue-g6PLKluFvW4BopeQk26_lX6T9ZiEfflA2ZvxxkBfzSi2o3jTGfAHkueNhjByCmOG35dHO6NvEloCpMKBmd-zWu--UlPvgWyrSkr11Rka4LvvzPCITngblOo8ijcJ6dYEsMYCuVTzUqjFGW_L34Yl38mvq9vf-5m4Jo4KLuk70r8oNr8GVxR80oRIi8VsZKm2RJZMhCNnIygO1PIFTvI2pG7KC1dJjoDTT2j4oJPHPRub-7_bi9H1V7UayntVg7qGwdTsN4bkcYectCdCLODnvlLOASQ1lFjcytRF4eH0tGIDnB4jWE2ti56gjJqrI1AH1eosN2ACiwl7ArP413Ge6fEbT_b-Vn1rdxNF8phU0ZpAVzqgCd9Qws-EziRkk3ePYic39hZOlcgW4IS-1waQdczWz1_P2YzzqoTjS8BiO3mDcYwxYKTu9iflvk9GbCN3rHC2L2HHLd4fLpv6AqHF1WH5cQY1AkN305DzakaT3UJu2n-IKqkAS-HS_43A-WakrYqWmvosj-wv99WMclwmtVMrsjc4O-UyoG9o4SnQEAt8G9PrPjaLfbdEH-RbvD88CyW78Q-9AW9l-108Zpnk7jtXc1ubz1klUqpQ8kvTcvUr0cnl5TjIxhwFXfJkf7MOUQj7z34VSUFUHg&cid=CAQSOwBpAlJWWyTklgCkEywftECmZYrlhJJYnD3RJVUFPHtNTJEE3xNdhHNKUxKsqKIfF4eWJ7K0NR6PG3joGAE&dv3_ver=m202306200101&rfl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ds=l&xdt=1&iif=1&cor=9848365699106064000&adk=1215661106&idt=61&cac=0&dtd=19

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0b2c524428c1a3604e3d1cdc61c2ae371a8f2fc767f801180fcf892db9e07c3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:51:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78362
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11572
x-xss-protection: 0
server: cafe
etag: 5014499061205845695
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:51:49 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/elements/html/ Frame ADD9 11 KB
4 KB 16ms
14ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:33:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57846
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:33:45 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame ADD9 0
0 144ms
59ms Fetch
image/gif 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssdtCSlp9vqrHGBvG3MDyLttQUtgY2pZAMOvBGZv7jQQSR27cC_wSbxfNw0evF8nqzFIhbqNTce1ksnkoCGRPe1AE5V6ng_a7-OYGq7locwwlNdptrPAagC8tKSM5ELER1NPCqlt2vs3PFqydse8-qsa2aJOSiRCSN9wb_n9t0IUg4NWdOuzPKjVKZoYZPdijFdlMOuwSCQ2AY7wUWB7pO8TZGoHx10iCB2V3yMc5p1Lggpkq2NgI2MwLKcu0i81HUXPuRsH9DNz9vQiV9O0e47SAp4J8Jnrq-A-5EKLgn2MRiC72g9X_UcJ9jPJYXcqeVm9Lcgst5MA6wasURcInqnTFktEUR-IQjqpssQEZi_tkELdML2Sjlam5-sVrF1aAyWPa2So_nN1gyDJG2Ipfim-Cy7CisiYx7IQLDVIUT_z9arUn4E-sDNAu056YNZKwWx3tlFh8InzMljCV0pwLAYysE5tZ-EZbR0o-qaPRJ6sBOnSlBN_EAEUe0LwwMhtupwFI3ufA8tOJL84lF-Z-Gfx78Dk44kb0Y8RmU_T6pbvtW6iAfxsUIJe3bNbEMRzCxvC6iLXsf6OG05uIl3e4IHNpTDgeWNTY7Q2dfCro2-qKrulIz1Rfs0nXy6C1IrXd1dvJZqUTEPfQ3oVCzmX3ED-9VsGwJaW-C6KabojWUeGCi9ObOyB4zwnLYUb1WqWq03JAGedEcyIcSGAN2py4NtIN_G4VOdY-ti7gvDhW_oXOaTGuK49Z2UAA6m8SJh-ULvflvhOhNnE-t--bCVDcd5Vol7JgrfKFzeIPcWE1oH3L62A0FkCtOI9syKSQ3KxOXd0t5Q8stsHdeKZ9hY88Fs9xnmSGLiX6FxfPXdEA7mZsJg0s_nmjMvnX6AcFaayHANhHzWMfx0YnbbUbQd6eppRAm-Y1HQVQjmkDWcfGVfTJvYUCKYZ6xeAmqcNL7M4IYSWTOJ0dbh96lyGrLobEARGjg0gyyFU8xdxjnhHPbvUeBv6QXWbcdxk1hk9E1WuXjVa9hRQQnTLOfzKY7oYHJifQMa4h3xtY8n71KKO_TgjfjJenSrvDIP5Q5jVxw4AJEJK6X7kRaaUvAy9K0hD-hjp22bdFki8fDYagmm6CpRfhqJLf0qkJSzmhCZplMUGTzVi3hJmJVrrOCL8-p5pZWPHkmaHa--dTVn_NdUvrjcBwOw756XGxeCZqdgTkdQB3CTtKwGCOdFwHH72cWYxT5WJxTomBKTKflmLXz1ynJny0U9BrAdehU7-zYVl2xjQKXS-6s&sai=AMfl-YTkwhu6xK-TXx2kD1MIbaCbMPX4VfdjkZJtuizQT_0tKaWjuCefCth-6htjT-spnbHcfU_Nj-3_4JnZLLlXdgXGmxgwfpgskePOQNfwr-vjAHSlGdstc5kBJVMRRySifp0ozT3Qrc1404TdZUsqUgh330Dmz9IMp3wNgQKbt4IaIocXVDxtyPsz7vSHXmIpZRNmU_6341mdSlFBImmPSKnCCqJtmREE0-nvo4GxFolVf0xPFr99B-yqDsBmsPaFbrhU&sig=Cg0ArKJSzLXCAiu6hma0EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20230725.54987&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 27 Jul 2023 12:37:51 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:51 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame ADD9 41 KB
13 KB 13ms
13ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:39:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57523
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Jul 2024 20:39:08 GMT

GET
H2 200 14083400015850626733
s0.2mdn.net/simgad/ Frame ADD9 114 KB
114 KB 43ms
5ms Image
image/png 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/14083400015850626733

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=2294626326&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466970&bpp=1&bdt=495&idt=1510&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&fsb=1&xpc=hDyHm3Dgx6&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1515

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87416b7576818b43a89b150fe1132d4295ef65251c65358e71d46f0938f3f5be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 07:04:14 GMT
x-content-type-options: nosniff
age: 106417
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 116422
x-xss-protection: 0
last-modified: Fri, 02 Jun 2023 14:27:31 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Jul 2024 07:04:14 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2C19 1 KB
643 B 30ms
20ms Document
text/html 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=2294626326&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466970&bpp=1&bdt=495&idt=1510&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&fsb=1&xpc=hDyHm3Dgx6&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1515

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 58803
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:17:48 GMT
etag: 48472445140208031
expires: Thu, 27 Jul 2023 20:17:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame ADD9 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f060c879360a50319d9667096fb49bd0ec3b6f098847bc0484a1c45a4eec0b62

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 417 B
474 B 216ms
181ms XHR
application/json 2602:803:c002:200::113
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23852&site_id=389792&zone_id=2276222&size_id=15&alt_size_ids=9%2C10&us_privacy=1---&rp_schain=1.0,1!monumetric.com,fdd82422-8575-448e-84fe-fa092518ca2d,1,,,&eid_pubcid.org=8217a596-e105-4814-9f40-7d0549462d31%5E1&rf=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&tg_i.domain=ehfmc-com.ngontinh24.com&tg_i.page=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&tg_i.pbadslot=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.C%23sidebar-3&tk_flint=pbjs_lite_v7.54.2&x_source.tid=8e8b0420-69d3-4919-beaa-e19f0fd2c128&l_pb_bid_id=23594a1675c64404&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=8e8b0420-69d3-4919-beaa-e19f0fd2c128&rp_maxbids=1&p_gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.C%23sidebar-3&slots=1&rand=0.62360256621056
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::113 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: a84c6f078d9a7ba72daa8778f88abd3957dc52801f65b37d8c0faf2406d13402

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:51 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 417
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ 873 B
702 B 50ms
16ms XHR
application/json 147.28.146.89
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.146.89 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: b5283bbd34da429be86d91e5131f4e707fd8c570229fe639119a1e333a0df521

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
content-length: 531

POST
H2 204 637e6546decb82d45236f0f8 Show response
prebid.cootlogix.com/prebid/multi/ 0
946 B 128ms
96ms XHR
text/plain 157.245.128.131
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.cootlogix.com/prebid/multi/637e6546decb82d45236f0f8
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 157.245.128.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:51 GMT
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
content-length: 0

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
66 B 141ms
109ms XHR
text/plain 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:51 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 200 v2 Show response
e.serverbid.com/api/ 16 B
225 B 48ms
17ms XHR
application/json 159.89.246.130
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://e.serverbid.com/api/v2
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 159.89.246.130 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:50 GMT
content-encoding: gzip
access-control-max-age: 10080
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept
content-length: 42

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 3 KB
2 KB 108ms
78ms XHR
application/json 35.168.216.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?lt=1690461471448&to=0&aun=mmt-389c2c79-cb7d-4800-9f2c-9ee84c91dd11_1_1_ad&pubcid=8217a596-e105-4814-9f40-7d0549462d31&gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.C%23sidebar-3&pv=fff0983d-b165-41c1-91ef-d53851e10d5c&maxw=300&maxh=600&si=490025&pi=3&bf=300x250%2C160x600%2C300x600&uspConsent=1---&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%227.54.2%22%7D&ogu=null&ns=10240
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.216.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-216-217.compute-1.amazonaws.com
Software: nginx /
Resource Hash: dfe2cdac5d59edd76df13ad0f49876915ea927a38766bbd7f5363860efa3eb81

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:51 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 3 KB
2 KB 138ms
108ms XHR
application/json 35.168.216.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?lt=1690461471450&to=0&aun=mmt-389c2c79-cb7d-4800-9f2c-9ee84c91dd11_1_1_ad&pubcid=8217a596-e105-4814-9f40-7d0549462d31&gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.C%23sidebar-3&pv=fff0983d-b165-41c1-91ef-d53851e10d5c&maxw=300&maxh=600&si=490027&pi=3&bf=300x250%2C160x600%2C300x600&uspConsent=1---&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%227.54.2%22%7D&ogu=null&ns=10240
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.216.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-216-217.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 5ea86e20602f4643c3f37ee2060e584feb158d6af17d830131821467347c73da

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:51 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 3 KB
2 KB 86ms
56ms XHR
application/json 35.168.216.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?lt=1690461471451&to=0&aun=mmt-389c2c79-cb7d-4800-9f2c-9ee84c91dd11_1_1_ad&pubcid=8217a596-e105-4814-9f40-7d0549462d31&gpid=%2F20842576%2C116518301%2FIN44NM%2FIN44NM-DDS.C%23sidebar-3&pv=fff0983d-b165-41c1-91ef-d53851e10d5c&maxw=300&maxh=600&si=490028&pi=3&bf=300x250%2C160x600%2C300x600&uspConsent=1---&schain=1.0%2C1!monumetric.com%2Cfdd82422-8575-448e-84fe-fa092518ca2d%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%227.54.2%22%7D&ogu=null&ns=10240
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.216.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-216-217.compute-1.amazonaws.com
Software: nginx /
Resource Hash: ef281c64ef03bad5a4449f59e7a339e98a6e1b5d08bf1575ca443e2270d7f4fa

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:51 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
744 B 153ms
126ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUWWG7OK
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 18aecb50ca98181e6dd52d1ee3fdc30ec18b599fa0b2507641b41f77b51d5eb6

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:51 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Thu, 27 Jul 2023 12:37:51 GMT

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 539 B
701 B 129ms
102ms XHR
application/json 195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

f6bdf3c69854929afa51973c65e2b6fd8f58d66db01164aa19730b6d20815e3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT
x-content-type-options: nosniff
p3p: CP="CAO PSA OUR"
x-envoy-upstream-service-time: 96
content-length: 539
pragma: no-cache
server: ayl-lb-usa02
access-control-max-age: 3600
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding
access-control-allow-headers: Accept-Encoding, Content-Type
expires: 0

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 140 B
822 B 45ms
33ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

cbf884057533aa2463bcbd8652fc11ab7cc23b74c50eaf0b0cddff3e31906a31

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:51 GMT
an-x-request-uuid: ec00d9d8-bf22-4f0e-afe9-7a16722ff8e1
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 140
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 mmt.gif
imps.monu.delivery/ 37 B
63 B 20ms
17ms Image
image/gif 35.186.236.140
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imps.monu.delivery/mmt.gif?s=fd6252cc-2263-4692-8f56-3f75ffaf0701&a=b.r&u=3da146d5-1cf2-4be4-9079-b2f1c2c61187&d=%7B%22utm%22%3A%7B%7D%7D
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.236.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.236.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2e4d08754839510a3d77ddf8205a515e51e4277c323932b10441196744ce757

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 02:10:33 GMT
age: 124038
x-guploader-uploadid: ADPycdtfTH7AOMIL8vASnI2SAUKO57hiMqR3KrgVyd3_EGuyzarfJLPV8txIzxbrXqaVDP4d4uU8hlF5HkVIIEB2LY4pnYBd5XPi
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
last-modified: Wed, 12 Jul 2017 09:13:19 GMT
server: UploadServer
etag: "455005e2f4b8ecc484500fab08619f70"
x-goog-generation: 1499850799559224
x-goog-hash: crc32c=1zd0wQ==, md5=RVAF4vS47MSEUA+rCGGfcA==
content-type: image/gif
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37
accept-ranges: bytes
expires: Thu, 25 Jul 2024 02:10:33 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 385 B
166 B 327ms
326ms XHR
text/plain 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=493766145868713&correlator=364737280058431&eid=31076488%2C31070232&output=ldjh&gdfp_req=1&vrg=202307260101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=20842576%3A116518301%2CIN44NM%2CIN44NM-DDS.B&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250%7C160x600%7C300x600&ifi=19&adks=3575954672&didk=2824074649&sfv=1-0-40&prev_scp=pos%3D2%26monu%3D300x250-160x600-300x600_A2%26slotNum%3D1%26placementNum%3D1%26allowNative%3Dfalse%26amznbid%3D2%26amznp%3D2%26bidder_responseTime%3Dmedianet_1100%26auction_id%3Db8603769-c1e7-4266-8854-6d33ba0931ae%26monu_df%3D0.04%26safeframe%3Dtrue%26bid_source%3Dclient%26hb_format%3Dbanner%26hb_size%3D300x600%26hb_adid%3D264ab02f136ac575%26hb_bidder%3Dmedianet%26refresh_count%3D0%26tabVisibilityState%3Dvisible%26max_bid%3Ddf%26provider_performance%3Dmedianet_notchrome_0.04%26context%3D12_NY_notchrome%26slotOnScreen%3Dfalse&eri=1&cust_params=page_num%3D0%26big4%3Dtrue%26url%3Dehfmc-com.ngontinh24.com%26referrer%3Ddirect%26infolinks%3Dtrue%26hem_included%3Dfalse%26tcf_gdprApplies%3Dfalse%26tcfBehavior%3DnotApplicable&sc=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&abxe=1&dt=1690461471520&lmt=1690029259&adxs=1070&adys=1884&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=5&ucis=9&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&frm=20&vis=1&psz=300x0&msz=300x0&fws=512&ohw=0&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYtILsupkxSABSAghkEhkKCnB1YmNpZC5vcmcYtILsupkxSABSAghkEhcKCHJ0YmhvdXNlGLSC7LqZMUgAUgIIZBIZCgp1aWRhcGkuY29tGLOC7LqZMUgAUgIIZBIUCgVvcGVueBi0guy6mTFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YtILsupkxSABSAghkEhsKDGlkNS1zeW5jLmNvbRi0guy6mTFIAFICCGQ.&dlt=1690461466474&idt=4415

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4e8d5fc04178cc60a19742cee3eb017888fdf34c9a31e3592890feef98a8dc43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 134
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 10ms
10ms Preflight
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 27 Jul 2023 12:37:51 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 350322
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 10925881766127972509
tpc.googlesyndication.com/simgad/ Frame 694A 110 KB
110 KB 17ms
16ms Image
image/jpeg 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10925881766127972509

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b858be02dc3216e4755794100bd1f703f5cc3ea767c30bc4db21bde4e0c92c63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 12:57:37 GMT
x-content-type-options: nosniff
age: 85214
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 112390
x-xss-protection: 0
last-modified: Wed, 03 May 2023 18:47:31 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 25 Jul 2024 12:57:37 GMT

GET
H3 200 12385176290511739714
tpc.googlesyndication.com/simgad/ Frame 694A 3 KB
3 KB 21ms
20ms Image
image/png 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12385176290511739714?w=100&h=100

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

69734d13741cc5ca9265f7ad17cce7f10b368114c1987b9090ff432bf023f881

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 17:36:02 GMT
x-content-type-options: nosniff
age: 68509
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3164
x-xss-protection: 0
last-modified: Wed, 21 Aug 2019 22:06:28 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 25 Jul 2024 17:36:02 GMT

GET
H2 200 data=c1xxk4aU9am7ghp2fmGo36TpGmN1XTvHzB-_a-Xd__2z2sz_PT7-pRS6ZTmRlMB70dJJHQmi5e1t0Res
mts0.google.com/vt/ Frame 694A 51 KB
51 KB 161ms
41ms Image
image/png 2607:f8b0:4020:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mts0.google.com/vt/data=c1xxk4aU9am7ghp2fmGo36TpGmN1XTvHzB-_a-Xd__2z2sz_PT7-pRS6ZTmRlMB70dJJHQmi5e1t0Res

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

4c475fdc8753accf44a4b9aba40a5597007edc62fa9c69ef557e8b7e2fabd609

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'; base-uri 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:51 GMT
content-security-policy: script-src 'none'; object-src 'none'; base-uri 'none'
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
server-timing: gfet4t7; dur=28
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51952
x-xss-protection: 0
x-server-version-bin: CggIBBCb54KmBg==
server: scaffolding on HTTPServer2
etag: 08b44578a5de1f0c9
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2843
expires: Thu, 27 Jul 2023 13:25:14 GMT

GET
DATA 200
OK truncated
/ Frame 694A 301 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 651fc5051db295a80ef0ec8faf17ab61562ea6e220be33a1a127263e3681a491

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 694A 418 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ebd902c796e15c5ea443dff52f3581b7b0076a00fcf4acce32983a48d27d877f

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H2 204 csi
csi.gstatic.com/ Frame 694A 0
234 B 1038ms
379ms Ping
image/gif 2404:6800:4009:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~lkl543jm&c=7568049181108&slotId=3784024590554&qqid=CLyL5NrzroADFU44wQodFtwIqw&sei=44730425%2C44752538%2C75259414%2C420706098&nsei=44714510%2C44729911%2C44730426%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=ulc&ulv=1&ua_e=1
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/5529604523bf1021996c9e114ecf8778.js?tag=video_location/web_och
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4009:800::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:52 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-00TsOkvHvnsZU.js Show response
rules.quantcount.com/ Frame F52F 160 B
635 B 22ms
4ms Script
application/javascript 2600:9000:21dd:e000:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-00TsOkvHvnsZU.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21dd:e000:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 600296d979650e8cbc41ca2950c1a33de723a6137494a8c80b4a7b9c42b2e61b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 11:46:31 GMT
via: 1.1 ea5efad48fd2ca3e2050f885ef5ad57c.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C2
age: 3081
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Thu, 13 Oct 2022 22:56:02 GMT
server: AmazonS3
etag: "1606c77f964fed869c1c52ad7f0e3885"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: B4xzJO-VzdMvat8GH8wyMhC_Z5H-gJ9qzAE6W4C-BW-oEdrkYDCGbQ==

GET
H/1.1 200
OK pr Show response
s.amazon-adsystem.com/v3/ Frame B37B 2 KB
3 KB 13ms
13ms Document
text/html 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-LoopMe_n-onetag_n-simpli.fi_rbd_rx_ox-db5_smrt_an-db5_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-LoopMe_n-onetag_n-simpli.fi_rbd_rx_ox-db5_smrt_an-db5_3lift_n-Outbrain&dcc=t

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

84e3ad7bfde0bdfc72a199601c24ce3aa778ac8245677082fafffbd46671c84c

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-LoopMe_n-onetag_n-simpli.fi_rbd_rx_ox-db5_smrt_an-db5_3lift_n-Outbrain&dcc=t
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 2523
Content-Type: text/html;charset=ISO-8859-1
Date: Thu, 27 Jul 2023 12:37:51 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: 9WCXPNGDQS4AWC157SPP

GET
H3 200 css2
fonts.googleapis.com/ Frame D15F 4 KB
671 B 42ms
41ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 27 Jul 2023 12:37:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 27 Jul 2023 11:31:10 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 27 Jul 2023 12:37:52 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame D15F 205 B
229 B 14ms
13ms Image
image/png 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 24 Jul 2023 16:09:11 GMT
x-content-type-options: nosniff
age: 246521
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 23 Jul 2024 16:09:11 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame D15F 604 B
628 B 17ms
16ms Image
image/png 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 21:04:19 GMT
x-content-type-options: nosniff
age: 56013
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 25 Jul 2024 21:04:19 GMT

GET
H3 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/elements/html/ Frame D15F 14 KB
6 KB 14ms
13ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d22f70ec714241cb6cfff6851ba3b7118c29a8e0d073fbb70b6dd05dd48a7e88

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 15:59:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74329
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6346
x-xss-protection: 0
server: cafe
etag: 2178636335013097452
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 15:59:03 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/elements/html/ Frame D15F 20 KB
8 KB 15ms
14ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6f4407e58a52926a78be27a8cdba65b8ccf8161463db84cee6cc81c7b7b1fb91

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 15:04:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77602
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8601
x-xss-protection: 0
server: cafe
etag: 3714838898622182897
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 15:04:30 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame E968 14 KB
1 KB 43ms
41ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 27 Jul 2023 12:37:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 27 Jul 2023 12:27:33 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 27 Jul 2023 12:37:52 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame E968 2 KB
896 B 12ms
12ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78224
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/ Frame E968 23 KB
9 KB 12ms
12ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93028274da1d373cd41165f6a442568ddd482370e8093e45d14a4ad0f6981f19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78224
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9132
x-xss-protection: 0
server: cafe
etag: 17712579318771444318
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame E968 3 KB
1 KB 14ms
13ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:40:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57459
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:40:13 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame E968 20 KB
8 KB 14ms
14ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ecb4fb492aee0a820dfc4a395fb80e2ac2e864bbf38aa1ae28d6d70fb9e6da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78224
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H3 200 nessie_icon_tiamat_white.png
tpc.googlesyndication.com/pagead/images/ Frame E968 225 B
254 B 23ms
20ms Image
image/png 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/nessie_icon_tiamat_white.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5719cdd3acdb2b6a5b9ae0bee910fc88fbc0f297f83235c02865d78eeed48446

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 16:15:59 GMT
x-content-type-options: nosniff
server: cafe
age: 73313
etag: 14085932017949564970
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 225
x-xss-protection: 0
expires: Thu, 27 Jul 2023 16:15:59 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E968 179 KB
56 KB 68ms
67ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f294f48a5bc171da79776780d32c77ae3323a508cb595a56f116ecb7578a8e7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57383
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690198756579870"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:52 GMT

GET
H3 200 39d4397462e2693449f221f9915f9e59.js Show response
www.gstatic.com/mysidia/ Frame E968 33 KB
14 KB 20ms
19ms Script
text/javascript 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/39d4397462e2693449f221f9915f9e59.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

67edbe1fe2a38ebf16fc36b42cc267e37f18629ec79feae7a177178bf6e24d89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 17:55:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 153753
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14179
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 20:41:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 23 Oct 2023 17:55:19 GMT

GET
H3 200 9124108767142337151
tpc.googlesyndication.com/simgad/ Frame E968 3 KB
3 KB 17ms
12ms Image
image/jpeg 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9124108767142337151?w=100&h=100

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae778bcf1e24f689fbe3f037b6da6159739fc35c96833f69a062c25cfd31ac60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 21:28:00 GMT
x-content-type-options: nosniff
age: 572992
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3003
x-xss-protection: 0
last-modified: Fri, 19 May 2023 16:35:46 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 19 Jul 2024 21:28:00 GMT

GET
DATA 200
OK truncated
/ Frame E968 195 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9e34975a0a58f4262f18fc35a4a9efb9f9b3962b87772f8fa5c006d5b7bc3f57

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame E968 336 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: be3b15b1e68cf3e9278293d3b50491fe16c985e0ee5968852cac4fc062a7134e

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 10EE 42 B
64 B 48ms
46ms Fetch
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvX-0_kYgry9RiS-ACGW9T-_hQbO5li6FW-r591u1XjXdRMr2-llrQZL-oRNWDx489iuPAYazita0ekC0gMg9LwrvS9vbKcy6LQchNBwI5yd3HAqr6KwgqFoHOFI4BQgmKveiJbM-7FVA&sai=AMfl-YROLtcj4mXLF-7eF5DpTHwM3mLGpZi29hcVSxSCVauplWCipQmhzQCoPvD_Aj89cObn3WjJZsH0u8gP&sig=Cg0ArKJSzDFLWwxsa0rYEAE&cid=CAQSGwBpAlJWc28yCiwHH8UAp1z5HhXtRwM17Jc1XxgB&id=lidar2&mcvt=1705&p=0,0,280,1200&mtos=1705,1705,1705,1705,1705&tos=1705,0,0,0,0&v=20230724&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=676577707&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1690461467230&rpt=3102&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 0ED6 6 KB
3 KB 14ms
12ms Document
text/html 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: cdn.confiant-integrations.net
URL: https://cdn.confiant-integrations.net/gptprebidnative/202307190925/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:51 GMT
expires: Fri, 26 Jul 2024 12:37:51 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 44B4 0
0 29ms
28ms Fetch
image/gif 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuBL1a68gkEjpDh26hRwzZoN0qz1SEL-tSCXVNNxLIdY0TdU53m4iNwpWU9L9aiiDgsisne527ypPBrZj0b0nGVzpw8kUprjBF406k-hWCpCR8eQtdjfieWxNwiSrhrMBPNeMYWpEn1hu30K_6jxuOkgasF-2gz3K9z_-zt0mRpaYI1YjGDU_w_imU9wqxBRb3fTSS0G697cswDtG9SpQfEoXa87thvn79qOmSfb4fipvRAOR9i8rmX_og9Hm29Re3eiqiFPnHWsCB3Sa4yfOc5JIsuNrj38paRoAgOzzZ9ybB1HMi14UKEF2Bpc8_v4bdCHChxtK2E4HIuzWhC-f09C2QOlq1IoHOWWIvnLDg6RcrcbuU&sai=AMfl-YRf2tOEox4w9n_RVglbxBUVgxnnsahN5S9Ea24GhdgMVj48Vxgkruha8QOBfLDMkaMLDndqkmArbLRlZ5fw0TlRW7IN1Sag0elbhBIS-YW2wIDuVHTT3tunRErA8g&sig=Cg0ArKJSzNoJe4xX_B52EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:52 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 infolinks_main.js Show response
resources.infolinks.com/js/ Frame 44B4 4 KB
3 KB 51ms
15ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/infolinks_main.js
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ccd60283cbe1ed22b288489054a5c2e1a6efae48957d15eb7fdfa57646fc0c6c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:52 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 27 Jul 2023 08:45:07 GMT
server: cloudflare
age: 13963
etag: W/"102b-60173fb2c47a1"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 7ed4efaa6b0f4388-EWR
expires: Thu, 27 Jul 2023 09:45:09 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 44B4 179 KB
56 KB 66ms
66ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f294f48a5bc171da79776780d32c77ae3323a508cb595a56f116ecb7578a8e7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57383
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690198756579870"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:52 GMT

GET
H3 200 container.html Show response
3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 2E8C 6 KB
3 KB 28ms
14ms Document
text/html 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: cdn.confiant-integrations.net
URL: https://cdn.confiant-integrations.net/gptprebidnative/202307190925/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:51 GMT
expires: Fri, 26 Jul 2024 12:37:51 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 4269 6 KB
3 KB 15ms
12ms Document
text/html 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: cdn.confiant-integrations.net
URL: https://cdn.confiant-integrations.net/gptprebidnative/202307190925/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:51 GMT
expires: Fri, 26 Jul 2024 12:37:51 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame D8C1 6 KB
3 KB 17ms
13ms Document
text/html 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: cdn.confiant-integrations.net
URL: https://cdn.confiant-integrations.net/gptprebidnative/202307190925/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:51 GMT
expires: Fri, 26 Jul 2024 12:37:51 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 206
Partial Content videoplayback
rr3---sn-ab5sznzr.googlevideo.com/ Frame 694A 4 MB
0 65ms
5ms Media
video/mp4 2607:f8b0:4006:13::8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rr3---sn-ab5sznzr.googlevideo.com/videoplayback?expire=1690490269&ei=HWXCZOKNHJGPkAT2xregDA&ip=2a0d:5600:24:1500:1012:1f8c:488d:1ea0&id=26146dd05a4ab5f9&itag=18&source=youtube&requiressl=yes&mh=43&mm=31&mn=sn-ab5sznzr&ms=au&mv=m&mvi=3&pl=48&susc=gvp&acao=yes&ctier=L&mime=video/mp4&vprv=1&dur=64.203&lmt=1688220683180057&mt=1690460491&txp=5530434&sparams=expire,ei,ip,id,itag,source,requiressl,susc,acao,ctier,mime,vprv,dur,lmt&sig=AOq0QJ8wRgIhAK1bJAecMtfyV1ec1ASCmPIaHANL8nDfA3NfAQAFxk7xAiEAyvYdzXBliOmgh5iHeuUDj0lp11mJ09y7Y4tGgkW3rkI=&lsparams=mh,mm,mn,ms,mv,mvi,pl&lsig=AG3C_xAwRQIhAIraqz5L6vsog_JKAnsL_JBQvBWQpfYFq8lOqBWMf42XAiArIJ9nUxCvzz47kRuunrOQoAiUoIwotBll4M7VBMwUsA==&cpn=2ZZI2nQ0uvOaXha3

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:13::8 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Range: bytes=0-

Response headers

Date: Thu, 27 Jul 2023 12:37:52 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sat, 01 Jul 2023 14:11:23 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-4355505/4355506
Cache-Control: private, max-age=28497
Cross-Origin-Resource-Policy: cross-origin
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 4355506
Expires: Thu, 27 Jul 2023 12:37:52 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame CF6D 1 KB
643 B 22ms
17ms Document
text/html 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 58804
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:17:48 GMT
etag: 48472445140208031
expires: Thu, 27 Jul 2023 20:17:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H/1.1 200 prebid Show response
id5-sync.com/api/config/ 136 B
554 B 470ms
89ms XHR
application/json 141.95.33.111
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.111 , Germany, ASN16276 (OVH, FR),

Reverse DNS

a23-52-163-93.deploy.static.akamaitechnologies.com

Software

Resource Hash

2aa25a19729df7b573f42c20a108d4ec213403df5ac193414f02f35887e7017c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:52 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
550 B 36ms
9ms XHR
application/json 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=2jqw284&fmt=json
Requested by: Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 1e44a52b942e3596b681269d57e44976aa2bde949276529b07a594cddd9e26f7

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:52 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Sat, 26 Aug 2023 12:37:52 GMT

GET
H2

200

cksync.php
contextual.media.net/
Redirect Chain

https://x.bidswitch.net/sync?ssp=medianet&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&gdpr_pd=1
https://x.bidswitch.net/ul_cb/sync?ssp=medianet&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&gdpr_pd=1
https://server.cpmstar.com/usersync.aspx?bsw_custom_parameter=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D440%26ssp...
https://x.bidswitch.net/sync?dsp_id=440&ssp=medianet&user_id=Gnx9rIQsQWVZgNvDVOur0
https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=&gdpr_consent=&gdpr_pd=

61 B
474 B

35ms
33ms

Image
image/gif

23.52.163.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=&gdpr_consent=&gdpr_pd=

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Server

23.52.163.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Thu, 27 Jul 2023 12:37:55 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Thu, 27 Jul 2023 12:37:55 GMT

Redirect headers

Location: //contextual.media.net/cksync.php?cs=1&type=bs&ovsid=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=&gdpr_consent=&gdpr_pd=
Date: Thu, 27 Jul 2023 12:37:54 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=156972&us_privacy=1---
https://image8.pubmatic.com/AdServer/ImgSync?p=156972&us_privacy=1---&rdf=1
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=ODAxMDE5MzEtQTM1Ri00RTI3LTlGMDktQjA5MTJBN0FEQTg1&gdpr=-1&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}

0
217 B

7ms
6ms

Image
text/plain

162.248.18.32
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 162.248.18.32 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
date: Thu, 27 Jul 2023 12:37:53 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://x.bidswitch.net/sync?ssp=adaptmx&user_id=ff378c32-21c3-4707-9f31-0f63efd798e1&gdpr=0&gdpr_consent=&us_privacy=1---
https://x.bidswitch.net/ul_cb/sync?ssp=adaptmx&user_id=ff378c32-21c3-4707-9f31-0f63efd798e1&gdpr=0&gdpr_consent=&us_privacy=1---
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=fa600ba6-dc58-41e7-a41a-832e682c030f&ssp=adaptmx&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=419&user_id=10593732968356378916&ssp=adaptmx&gdpr=0&gdpr_consent=
https://prebid.a-mo.net/setuid?bidder=bid_switch&uid=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=0&gdpr_consent=&us_privacy=

0
113 B

12ms
11ms

Image
text/plain

147.28.146.89
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?bidder=bid_switch&uid=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 147.28.146.89 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:54 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

Location: //prebid.a-mo.net/setuid?bidder=bid_switch&uid=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=0&gdpr_consent=&us_privacy=
Date: Thu, 27 Jul 2023 12:37:54 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

us.gif
sync.go.sonobi.com/
Redirect Chain

https://creativecdn.com/cm-notify?pi=sonobi
https://creativecdn.com/cm-notify?pi=sonobi&tc=1
https://sync.go.sonobi.com/us.gif?nw=rh&nuid=8mnwWBfzUa8PcJcwrgYP&pi=sonobi&tc=1

49 B
864 B

30ms
10ms

Image
image/gif

69.166.1.10
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=rh&nuid=8mnwWBfzUa8PcJcwrgYP&pi=sonobi&tc=1

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

HTTP/1.1

Server

69.166.1.10 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:54 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-98
Content-Type: image/gif
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 49
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://sync.go.sonobi.com/us.gif?nw=rh&nuid=8mnwWBfzUa8PcJcwrgYP&pi=sonobi&tc=1
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT, Thu, 27 Jul 2023 12:37:53 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://bloggernetwork-d.openx.net/w/1.0/pd?us_privacy=1---
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEG0abUQYKqKxvLgVRUV-6Lw&google_cver=1

43 B
61 B

33ms
32ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEG0abUQYKqKxvLgVRUV-6Lw&google_cver=1
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEG0abUQYKqKxvLgVRUV-6Lw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=115&p=226&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40
https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=fa6665c9-bad5-4024-a8ba-d6708fe19ec2

61 B
625 B

89ms
32ms

Image
image/gif

23.52.163.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=fa6665c9-bad5-4024-a8ba-d6708fe19ec2

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Server

23.52.163.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-52-163-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Thu, 27 Jul 2023 12:37:53 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Thu, 27 Jul 2023 12:37:53 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:52 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=fa6665c9-bad5-4024-a8ba-d6708fe19ec2
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1588146
content-length: 0
expires: Thu, 27 Jul 2023 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/prebid/
Redirect Chain

https://prebid.a-mo.net/cchain?cb=https%3A%2F%2Fib.adnxs.com%2Fprebid%2Fsetuid%3Fbidder%3Damx%26uid%3Dff378c32-21c3-4707-9f31-0f63efd798e1&gdpr=0&gdpr_consent=&us_privacy=1---
https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F0%2F642%3Fgdpr%3D0%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26us_privacy%3D1---%26A%3Dbb33aa9f-187e-424c-b345-d805ac4198df%26bidd...
https://prebid.a-mo.net/cchain/0/642?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&us_privacy=1---&A=bb33aa9f-187e-424c-b345-d805ac4198df&bidder=appnexus&cbx=aHR0cHM6Ly9pYi5hZG54cy5jb20vcHJlYmlkL3NldHVpZD9iaW...
https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F1%2F642%3Fgdpr%3D0%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26us_privacy%3D1---%26A%3Dbb33aa9f-187e-...
https://prebid.a-mo.net/cchain/1/642?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&us_privacy=1---&A=bb33aa9f-187e-424c-b345-d805ac4198df&bidder=openx&cbx=aHR0cHM6Ly9pYi5hZG54cy5jb20vcHJlYmlkL3NldHVpZD9iaWRkZ...
https://ssum.casalemedia.com/usermatchredir?s=191503&gdpr=0&gdpr_consent=&us_privacy=1---&cb=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F2%2F642%3Fgdpr%3D0%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26us...
https://prebid.a-mo.net/cchain/2/642?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&us_privacy=1---&A=bb33aa9f-187e-424c-b345-d805ac4198df&bidder=index_rtb&cbx=aHR0cHM6Ly9pYi5hZG54cy5jb20vcHJlYmlkL3NldHVpZD9ia...
https://cm.adform.net/cookie?gdpr=0&gdpr_consent=&redirect_url=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F3%2F642%3Fgdpr%3D0%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26us_privacy%3D1---%26A%3Dbb33aa9f...
https://prebid.a-mo.net/cchain/3/642?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&us_privacy=1---&A=bb33aa9f-187e-424c-b345-d805ac4198df&bidder=adform&cbx=aHR0cHM6Ly9pYi5hZG54cy5jb20vcHJlYmlkL3NldHVpZD9iaWRk...
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&us_privacy=1---&redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F4%2F642%3Fgdpr%3D0%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26us_privacy%3D1---%26A%3Db...
https://prebid.a-mo.net/cchain/4/642?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&us_privacy=1---&A=bb33aa9f-187e-424c-b345-d805ac4198df&bidder=sovrn&cbx=aHR0cHM6Ly9pYi5hZG54cy5jb20vcHJlYmlkL3NldHVpZD9iaWRkZ...
https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fprebid.a-mo....
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=158355&pmc=1&pr=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F5%2F642%3Fgdpr%3D0%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26us_privacy%3D1---%26A%3Dbb33...
https://prebid.a-mo.net/cchain/5/642?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&us_privacy=1---&A=bb33aa9f-187e-424c-b345-d805ac4198df&bidder=pubmatic&cbx=aHR0cHM6Ly9pYi5hZG54cy5jb20vcHJlYmlkL3NldHVpZD9iaW...
https://ib.adnxs.com/prebid/setuid?bidder=amx&uid=ff378c32-21c3-4707-9f31-0f63efd798e1bb33aa9f-187e-424c-b345-d805ac4198df&us_privacy=1---&gdpr=0

43 B
1 KB

16ms
15ms

Image
image/gif

68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=amx&uid=ff378c32-21c3-4707-9f31-0f63efd798e1bb33aa9f-187e-424c-b345-d805ac4198df&us_privacy=1---&gdpr=0

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
an-x-request-uuid: 9ef5205a-46fd-4708-95b4-76a0174fc976
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

location: https://ib.adnxs.com/prebid/setuid?bidder=amx&uid=ff378c32-21c3-4707-9f31-0f63efd798e1bb33aa9f-187e-424c-b345-d805ac4198df&us_privacy=1---&gdpr=0
date: Thu, 27 Jul 2023 12:37:57 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
content-length: 0

GET
H2

200

sync
ads.yieldmo.com/v000/
Redirect Chain

https://ads.yieldmo.com/pbcas?us_privacy=1---&gdpr=0&gdpr_consent=&type=image
https://cm.g.doubleclick.net/pixel?google_nid=yieldmo_dbm&google_cm&pn_id=c
https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEL3CRSXhFpqvO1lUUlZrYYM&google_cver=1

43 B
638 B

14ms
10ms

Image
image/gif

54.167.233.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEL3CRSXhFpqvO1lUUlZrYYM&google_cver=1
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 54.167.233.116 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-167-233-116.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 43

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEL3CRSXhFpqvO1lUUlZrYYM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 299
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ProfilesEngineServlet
api.intentiq.com/profiles_engine/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=4ba74d4dae&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=4ba74d4dae&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us.gif?nw=td&nuid=a7485659-1d87-4413-a256-0b6bba4fa732&pubid=4ba74d4dae
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=570392714&pt=17&dpn=1&dpt=&trid=&pcid=0879b8ef-eed0-499d-b782-d1c89f5648b0

0
710 B

43ms
16ms

Image
text/plain

13.226.34.62
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=570392714&pt=17&dpn=1&dpt=&trid=&pcid=0879b8ef-eed0-499d-b782-d1c89f5648b0
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 13.226.34.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-34-62.ewr53.r.cloudfront.net
Software: Apache-Coyote/1.1 /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:54 GMT
via: 1.1 2ef71b29bcfbfc8755cad5f92a3c329a.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: EWR53-C2
vary: Origin
access-control-allow-methods: POST, GET
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
access-control-allow-origin: https://ehfmc-com.ngontinh24.com/
x-cache: Miss from cloudfront
access-control-max-age: 3600
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Accept, X-Requested-With, remember-me
content-length: 0
x-amz-cf-id: 2x65Hxl7HMhwDzK4rZWCeCxPcnWSFshTRyn-1r_iALVslwZHHOhRcA==
alt-svc: h3=":443"; ma=86400

Redirect headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:53 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-98
Content-Type: text/plain; charset=utf8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=570392714&pt=17&dpn=1&dpt=&trid=&pcid=0879b8ef-eed0-499d-b782-d1c89f5648b0
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

cksync.php
cs.media.net/
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcs.media.net%2Fcksync.php%3Fcs%3D8%26type%3Ddxu%26ovsid%3D_wfivefivec_
https://pm.w55c.net/ping_match.gif?scc=1&ei=MEDIANET&rurl=https%3A%2F%2Fcs.media.net%2Fcksync.php%3Fcs%3D8%26type%3Ddxu%26ovsid%3D_wfivefivec_
https://cs.media.net/cksync.php?cs=8&type=dxu&ovsid=rDiXmOQ61Qp0fC5

61 B
639 B

64ms
64ms

Image
image/gif

23.197.0.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync.php?cs=8&type=dxu&ovsid=rDiXmOQ61Qp0fC5
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: HTTP/1.1
Server: 23.197.0.23 Marietta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-197-0-23.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:53 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 61
x-mnet-hl2: E
Expires: Thu, 27 Jul 2023 12:37:53 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:52 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-784-g0c0b2cf#rel-ec2-master i-0e392308e04f047a8@us-east-1d@dxedge-app-us-east-1-prod-asg
Location: https://cs.media.net/cksync.php?cs=8&type=dxu&ovsid=rDiXmOQ61Qp0fC5
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

204

magnite
prebid.a-mo.net/setuid/
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&gdpr=0&gdpr_consent=&us_privacy=1---
https://prebid.a-mo.net/setuid/magnite?uid=LKL540WK-1B-DXU8&gdpr=0&us_privacy=1---

0
148 B

13ms
10ms

Image
text/plain

147.28.146.89
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/magnite?uid=LKL540WK-1B-DXU8&gdpr=0&us_privacy=1---
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 147.28.146.89 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://prebid.a-mo.net/setuid/magnite?uid=LKL540WK-1B-DXU8&gdpr=0&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 636a4452fa95aad32992c06634d4089f
Expires: 0

GET
H/1.1 200
OK cksync.php
cs.media.net/ 60 B
648 B 221ms
122ms Image
image/gif 23.197.0.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync.php?cs=8
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.197.0.23 Marietta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-197-0-23.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0c34dc4de2a524e93b1315788f03ba101b99e22ff50082945e84a00368d73e16

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:52 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 60
x-mnet-hl2: E
Expires: Thu, 27 Jul 2023 12:37:52 GMT

GET
H2

200

cookie
sync.cootlogix.com/api/
Redirect Chain

https://sync.cootlogix.com/api/sync/image/?cid=&gdpr=0&gdpr_consent=&us_privacy=1---
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsonobi%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---%26userId%3D%5BUID%5D
https://sync.cootlogix.com/api/cookie?partnerId=sonobi&gdpr=0&gdpr_consent=&us_privacy=1---&userId=0879b8ef-eed0-499d-b782-d1c89f5648b0
https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcoo...
https://sync.cootlogix.com/api/cookie?partnerId=openx&userId=0ec1ac5b-23e2-46b9-a649-e8a117002e4c&gdpr=0&gdpr_consent=&us_privacy=1---
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---?gdpr=0&gdpr_conse...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=0&gdpr_consent=&us_privacy=1---

43 B
761 B

9ms
6ms

Image
image/avif

64.227.9.154
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 64.227.9.154 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:56 GMT
access-control-allow-methods: GET, HEAD, OPTIONS, POST
content-type: image/avif
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
content-length: 43

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=0&gdpr_consent=&us_privacy=1---
Date: Thu, 27 Jul 2023 12:37:55 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=oth&i=y-gJBd7gBE2pel0A2wVK.IudZi10brvltldvlq~A

35 B
250 B

65ms
11ms

Image
image/gif

35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=oth&i=y-gJBd7gBE2pel0A2wVK.IudZi10brvltldvlq~A
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: HTTP/1.1
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:53 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Thu, 27 Jul 2023 12:37:52 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://usersync.gumgum.com/usersync?b=oth&i=y-gJBd7gBE2pel0A2wVK.IudZi10brvltldvlq~A
content-length: 0

GET
H/1.1

200
OK

cksync.php
cs.media.net/
Redirect Chain

https://medianet-match.dotomi.com/match/bounce/current?version=1&networkId=57734&redir=https%3A%2F%2Fcs.media.net%2Fcksync.php%3Fcs%3D8%26type%3Dcon%26ovsid%3D%24UID
https://medianet-match.dotomi.com/match/bounce/current?DotomiTest=7222d115a03004b4&is_secure=true&version=1&networkId=57734&redir=https%3A%2F%2Fcs.media.net%2Fcksync.php%3Fcs%3D8%26type%3Dcon%26ovs...
https://cs.media.net/cksync.php?cs=8&type=con&ovsid=AAABq8WqSrkM8QNdej8RAAAAAAA&expiration=1690547874&is_secure=true

61 B
651 B

62ms
62ms

Image
image/gif

23.197.0.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync.php?cs=8&type=con&ovsid=AAABq8WqSrkM8QNdej8RAAAAAAA&expiration=1690547874&is_secure=true
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: HTTP/1.1
Server: 23.197.0.23 Marietta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-197-0-23.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:55 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 61
x-mnet-hl2: E
Expires: Thu, 27 Jul 2023 12:37:55 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://cs.media.net/cksync.php?cs=8&type=con&ovsid=AAABq8WqSrkM8QNdej8RAAAAAAA&expiration=1690547874&is_secure=true
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2 200 gg
match.justpremium.com/match/ 43 B
325 B 62ms
10ms Image
image/gif 3.223.12.17
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.justpremium.com/match/gg?ex_uid=u_587908ec-ee73-4995-b782-4d4a3a2a29c3
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.12.17 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-12-17.compute-1.amazonaws.com
Software: /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
content-length: 43
content-type: image/gif

GET
H2 200 142
match.deepintent.com/usersync/ 0
224 B 276ms
9ms Image
image/gif 38.91.45.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.91.45.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software: b /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif
date: Thu, 27 Jul 2023 12:37:53 GMT
server: b
content-length: 0
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'

GET
H/1.1

200

usersync
usersync.gumgum.com/
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=7437480408642019502

35 B
250 B

11ms
11ms

Image
image/gif

35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=7437480408642019502
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: HTTP/1.1
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:54 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
an-x-request-uuid: cf86f767-ad0e-4dde-b805-590457d75ea3
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://usersync.gumgum.com/usersync?b=apn&i=7437480408642019502
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200

155.gif
id5-sync.com/k/
Redirect Chain

https://id5-sync.com/s/441/9.gif?puid=u_587908ec-ee73-4995-b782-4d4a3a2a29c3&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://id5-sync.com/c/441/2/8/2.gif?puid=$UID&gdpr=0&gdpr_consent=
https://id5-sync.com/c/441/2/8/2.gif?puid=7437480408642019502&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=a7485659-1d87-4413-a256-0b6bba4fa732&ttl=%%TTL%%
https://ce.lijit.com/merge?pid=92&3pid=7437480408642019502&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F441%2F1246%2F6%2F4.gif%3Fpuid%3D%5BSOVRNID%5D%26gdpr%3D0%26gdpr...
https://ce.lijit.com/merge?pid=92&3pid=7437480408642019502&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F441%2F1246%2F6%2F4.gif%3Fpuid%3D%5BSOVRNID%5D%26gdpr%3D0%26gdpr...
https://id5-sync.com/c/441/1246/6/4.gif?puid=HDPVfRZHq_uSkr3DQI69IfXJ&gdpr=0&gdpr_consent=
https://ice.360yield.com/match?publisher_dsp_id=79&dsp_callback=1&external_user_id=ID5-b9a94eoiVwWPsgJhbFeQkzgSG7YJflDi9qemNfq1iw&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F441%2F124%2F5%2F5.gif%3Fpuid%3D...
https://id5-sync.com/cq/441/124/5/5.gif?puid=d8894ba5-35bd-4833-8e9c-b10a6d4f19ce&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F441%2F429%2F4%2F6.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/441/429/4/6.gif?puid=80101931-A35F-4E27-9F09-B0912A7ADA85&gdpr=0&gdpr_consent=
https://dis.eu.criteo.com/dis/usersync.aspx?r=30&p=59&cp=id5&cu=1&url=https%3A%2F%2Fid5-sync.com%2Fc%2F441%2F203%2F3%2F7.gif%3Fpuid%3D%40%40CRITEO_USERID%40%40%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/441/203/3/7.gif?puid=fa6665c9-bad5-4024-a8ba-d6708fe19ec2&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F441%2F108%2F2%2F8.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
https://id5-sync.com/c/441/108/2/8.gif?puid=7f4728db-c546-4885-91eb-59bdc0ffdd33&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=58&3pid=80101931-A35F-4E27-9F09-B0912A7ADA85&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F441%2F1242%2F1%2F9.gif%3Fpuid%3D%5BSOVRNID%5D%...
https://id5-sync.com/c/441/1242/1/9.gif?puid=HDPVfRZHq_uSkr3DQI69IfXJ&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/id5?us_privacy=
https://id5-sync.com/k/155.gif?id5AccountNum=155&numCascadesAllowed=9&puid=AACNS07JhMoAACkhYs-_rg

43 B
2 KB

93ms
90ms

Image
image/gif

141.95.33.111
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/k/155.gif?id5AccountNum=155&numCascadesAllowed=9&puid=AACNS07JhMoAACkhYs-_rg

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

HTTP/1.1

Server

141.95.33.111 , Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif;charset=UTF-8
date: Thu, 27 Jul 2023 12:37:59 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding: chunked
p3p: CP="CAO PSA OUR"

Redirect headers

location: https://id5-sync.com/k/155.gif?id5AccountNum=155&numCascadesAllowed=9&puid=AACNS07JhMoAACkhYs-_rg
Date: Thu, 27 Jul 2023 12:38:00 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

us.gif
sync.go.sonobi.com/
Redirect Chain

https://x.bidswitch.net/sync?ssp=sonobi&gdpr=0&gdpr_consent=
https://server.cpmstar.com/usersync.aspx?bsw_custom_parameter=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D440%26ss...
https://x.bidswitch.net/sync?dsp_id=440&ssp=sonobi&user_id=Gnx9rIQsQWVZgNvDVOur0
https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=fa600ba6-dc58-41e7-a41a-832e682c030f

49 B
880 B

9ms
8ms

Image
image/gif

69.166.1.10
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=fa600ba6-dc58-41e7-a41a-832e682c030f

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

HTTP/1.1

Server

69.166.1.10 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:55 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-98
Content-Type: image/gif
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 49
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: //sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=fa600ba6-dc58-41e7-a41a-832e682c030f
Date: Thu, 27 Jul 2023 12:37:55 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

204

yahoo
prebid.a-mo.net/setuid/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58570/occ?gdpr=0&gdpr_consent=&uid=ff378c32-21c3-4707-9f31-0f63efd798e1
https://prebid.a-mo.net/setuid/yahoo?uid=y-PnnBldZE2uFJR3vV3fWLIeevFl4.GHcqNCui6js-~A&gdpr=0

0
136 B

14ms
14ms

Image
text/plain

147.28.146.89
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/yahoo?uid=y-PnnBldZE2uFJR3vV3fWLIeevFl4.GHcqNCui6js-~A&gdpr=0
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 147.28.146.89 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:54 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid/yahoo?uid=y-PnnBldZE2uFJR3vV3fWLIeevFl4.GHcqNCui6js-~A&gdpr=0
date: Thu, 27 Jul 2023 12:37:54 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.64
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

us.gif
sync.go.sonobi.com/
Redirect Chain

https://p.rfihub.com/cm?pub=35683&in=1
https://sync.go.sonobi.com/us.gif?nw=zt&nuid=970314641601922599

49 B
862 B

13ms
12ms

Image
image/gif

69.166.1.10
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=zt&nuid=970314641601922599

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

HTTP/1.1

Server

69.166.1.10 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:55 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-98
Content-Type: image/gif
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 49
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: https://sync.go.sonobi.com/us.gif?nw=zt&nuid=970314641601922599
Date: Thu, 27 Jul 2023 12:37:54 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

us.gif
sync.go.sonobi.com/
Redirect Chain

https://bh.contextweb.com/bh/rtset?do=add&pid=560606&ev=0879b8ef-eed0-499d-b782-d1c89f5648b0&daaqp=1&rurl=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dpp%26nuid%3D%25%25VGUID%25%25
https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=OFcwWG5wUTFtQnEyY21FZDg1WGRHZw&gdpr=&gdpr_consent=
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=&gdpr_consent=&ev=CAESEHvQ3FJ-XV1iTNMoabmhfI4&google_cver=1
https://sync.go.sonobi.com/us.gif?nw=pp&nuid=Eskvj2ED94C8

49 B
856 B

12ms
11ms

Image
image/gif

69.166.1.10
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=pp&nuid=Eskvj2ED94C8

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

HTTP/1.1

Server

69.166.1.10 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:56 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-98
Content-Type: image/gif
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 49
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
location: https://sync.go.sonobi.com/us.gif?nw=pp&nuid=Eskvj2ED94C8
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-848647674d-5zncp
expires: -1

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B37B
Redirect Chain

https://csync.loopme.me/?pubid=11405&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dloopme.com%26id%3D%7Bviewer_token%7D&gdpr=0
https://s.amazon-adsystem.com/ecm3?ex=loopme.com&id=234476cf-2671-4bfc-95f2-9dc06b40d897&gdpr=0

43 B
479 B

29ms
14ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=loopme.com&id=234476cf-2671-4bfc-95f2-9dc06b40d897&gdpr=0

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-LoopMe_n-onetag_n-simpli.fi_rbd_rx_ox-db5_smrt_an-db5_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:53 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: XNYA8M6DTET1ZANPGH8G
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=loopme.com&id=234476cf-2671-4bfc-95f2-9dc06b40d897&gdpr=0
date: Thu, 27 Jul 2023 12:37:53 GMT
server: _
content-length: 0

GET
H2 204 /
onetag-sys.com/match/ Frame B37B 0
149 B 39ms
10ms Image
text/plain 51.222.239.230
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=113&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&gdpr=0

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-LoopMe_n-onetag_n-simpli.fi_rbd_rx_ox-db5_smrt_an-db5_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.239.230 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ip230.ip-51-222-239.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B37B
Redirect Chain

https://um.simpli.fi/amazon/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsimpli.fi%26id%3D?gdpr=0
https://s.amazon-adsystem.com/ecm3?id=89A587D6428942BFB7DBA431CAFC20D7&ex=simpli.fi&status=ok

43 B
479 B

18ms
16ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=89A587D6428942BFB7DBA431CAFC20D7&ex=simpli.fi&status=ok

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-LoopMe_n-onetag_n-simpli.fi_rbd_rx_ox-db5_smrt_an-db5_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:53 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: KFFQYYJG8SPHH8KV9SW5
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Thu, 27 Jul 2023 12:37:53 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://s.amazon-adsystem.com/ecm3?id=89A587D6428942BFB7DBA431CAFC20D7&ex=simpli.fi&status=ok
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 26 Jul 2023 12:37:53 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B37B
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=amazon&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D&gdpr=0
https://sync.1rx.io/usersync2/rmpssp?sub=amazon&zcc=1&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D&cb=1690461473044
https://ad.turn.com/r/cs?pid=45&rndcb=4685120908
https://sync.1rx.io/usersync/turn/4093334856250701331?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-14723f11-90d9-492f-9cc4-e7bb3476cf9c-005?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3DRX-14723f11-90d9-492f-9cc4-e7bb...
https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-14723f11-90d9-492f-9cc4-e7bb3476cf9c-005

43 B
479 B

24ms
20ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-14723f11-90d9-492f-9cc4-e7bb3476cf9c-005

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-LoopMe_n-onetag_n-simpli.fi_rbd_rx_ox-db5_smrt_an-db5_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:56 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: YPD3M325PY23S2QVS7D3
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Thu, 27 Jul 2023 12:37:55 GMT
Server: Tengine
ETag: RX14723f1190d9492f9cc4e7bb3476cf9c005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-14723f11-90d9-492f-9cc4-e7bb3476cf9c-005
Content-Type: text/html
Connection: keep-alive

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B37B
Redirect Chain

https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__&gdpr=0
https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__&gdpr=0&s=2
https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=SHqIxsER5zzdNQS3bQL1&gdpr=0

43 B
479 B

30ms
26ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=SHqIxsER5zzdNQS3bQL1&gdpr=0

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-LoopMe_n-onetag_n-simpli.fi_rbd_rx_ox-db5_smrt_an-db5_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:54 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: A1CQWA5NQYHQ7XHDX8KT
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:53 GMT
Content-Type: text/html; charset=utf-8
Location: https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=SHqIxsER5zzdNQS3bQL1&gdpr=0
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 112
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3 200 container.html Show response
3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6763 6 KB
3 KB 61ms
56ms Document
text/html 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: cdn.confiant-integrations.net
URL: https://cdn.confiant-integrations.net/gptprebidnative/202307190925/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:51 GMT
expires: Fri, 26 Jul 2024 12:37:51 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 694A 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8ccdb383b23bb82d0534f368c913c0693454302be712a4a31509461167e0add9

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

POST
H/1.1 200 prebid Show response
id5-sync.com/api/config/ 135 B
553 B 449ms
87ms XHR
application/json 141.95.33.111
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb7.51.0.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.111 , Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

91d9858a3fbbbbb194b1de253ee64efccf4524e1f7289276deb4be8607995973

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:52 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 8AB5 52 KB
17 KB 35ms
3ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb7.51.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 21831
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 27 Jul 2023 12:37:52 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 27 Jul 2023 06:34:02 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish
X-Cache: HIT
X-Cache-Hits: 42781
X-Served-By: cache-lga21943-LGA
X-Timer: S1690461473.900528,VS0,VE0

GET

wGbQAlJJ
sync-tm.everesttech.net/upi/pid/
Redirect Chain

https://ads.stickyadstv.com/auto-user-sync?
https://1f2e7.v.fwmrm.net/ad/u?_dv=2&dsp_user_mapping=true&127719=6b8bcc71db428e0a12d1a2a376a5e79&rdU=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D1169%26userId%3d%23%7bu...
https://ads.stickyadstv.com/user-registering?dataProviderId=1169&userId=e3cdb_7260476750273148835&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=stickyads&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ads.stickyadstv.com/user-registering?dataProviderId=208&userId=a7485659-1d87-4413-a256-0b6bba4fa732&gdpr=0&gdpr_consent=
https://pr-bh.ybp.yahoo.com/sync/stickyads/6b8bcc71db428e0a12d1a2a376a5e79?gdpr=0&gdpr_consent=
https://ads.stickyadstv.com/user-registering?dataProviderId=199&userId=y-pwbkk5lE2oMvJZOdlUhjXMyE2sFIJVnp72.7xSNY~A
https://ib.adnxs.com/getuid?https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D209%26userId%3D$UID%26gdpr%3D0%26gdpr_consent%3D
https://ads.stickyadstv.com/user-registering?dataProviderId=209&userId=7437480408642019502&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge?AG_PID=freewheel&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=freewheel&gdpr=0&gdpr_consent=
https://ads.stickyadstv.com/user-registering?dataProviderId=561&userId=6abd5532-2c7a-11ee-9042-8203411c076b
https://um.simpli.fi/freewheel?
https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=89A587D6428942BFB7DBA431CAFC20D7
https://sync.ipredictive.com/d/sync/cookie/generic?partner=stickyadstv&append=1&cb=3846141&redirect=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D690%26userId%3D
https://ads.stickyadstv.com/user-registering?dataProviderId=690&userId=5ffed2df-4bd8-4892-8816-399f9a8960c6
https://pixel-sync.sitescout.com/dmp/pixelSync?nid=103&gdpr=0&gdpr_consent=
https://ads.stickyadstv.com/user-registering?dataProviderId=721&userId=2158e5d2-ac31-454d-af6e-d48bb416c5f4-64c26527-5553&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match/?party=18&gdpr=0&gdpr_consent=
https://ads.stickyadstv.com/user-registering?dataProviderId=189&userId=6606311347755805104&_fw_gdpr=0&_fw_gdpr_consent=
https://sync-tm.everesttech.net/upi/pid/wGbQAlJJ?gdpr=0&gdpr_consent=&redir=https://ads.stickyadstv.com/user-registering?dataProviderId=187&userId=${TM_USER_ID}&gdpr=0&gdpr_consent=

0
0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame ADD9 0
0 51ms
50ms Fetch
image/gif 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssdtCSlp9vqrHGBvG3MDyLttQUtgY2pZAMOvBGZv7jQQSR27cC_wSbxfNw0evF8nqzFIhbqNTce1ksnkoCGRPe1AE5V6ng_a7-OYGq7locwwlNdptrPAagC8tKSM5ELER1NPCqlt2vs3PFqydse8-qsa2aJOSiRCSN9wb_n9t0IUg4NWdOuzPKjVKZoYZPdijFdlMOuwSCQ2AY7wUWB7pO8TZGoHx10iCB2V3yMc5p1Lggpkq2NgI2MwLKcu0i81HUXPuRsH9DNz9vQiV9O0e47SAp4J8Jnrq-A-5EKLgn2MRiC72g9X_UcJ9jPJYXcqeVm9Lcgst5MA6wasURcInqnTFktEUR-IQjqpssQEZi_tkELdML2Sjlam5-sVrF1aAyWPa2So_nN1gyDJG2Ipfim-Cy7CisiYx7IQLDVIUT_z9arUn4E-sDNAu056YNZKwWx3tlFh8InzMljCV0pwLAYysE5tZ-EZbR0o-qaPRJ6sBOnSlBN_EAEUe0LwwMhtupwFI3ufA8tOJL84lF-Z-Gfx78Dk44kb0Y8RmU_T6pbvtW6iAfxsUIJe3bNbEMRzCxvC6iLXsf6OG05uIl3e4IHNpTDgeWNTY7Q2dfCro2-qKrulIz1Rfs0nXy6C1IrXd1dvJZqUTEPfQ3oVCzmX3ED-9VsGwJaW-C6KabojWUeGCi9ObOyB4zwnLYUb1WqWq03JAGedEcyIcSGAN2py4NtIN_G4VOdY-ti7gvDhW_oXOaTGuK49Z2UAA6m8SJh-ULvflvhOhNnE-t--bCVDcd5Vol7JgrfKFzeIPcWE1oH3L62A0FkCtOI9syKSQ3KxOXd0t5Q8stsHdeKZ9hY88Fs9xnmSGLiX6FxfPXdEA7mZsJg0s_nmjMvnX6AcFaayHANhHzWMfx0YnbbUbQd6eppRAm-Y1HQVQjmkDWcfGVfTJvYUCKYZ6xeAmqcNL7M4IYSWTOJ0dbh96lyGrLobEARGjg0gyyFU8xdxjnhHPbvUeBv6QXWbcdxk1hk9E1WuXjVa9hRQQnTLOfzKY7oYHJifQMa4h3xtY8n71KKO_TgjfjJenSrvDIP5Q5jVxw4AJEJK6X7kRaaUvAy9K0hD-hjp22bdFki8fDYagmm6CpRfhqJLf0qkJSzmhCZplMUGTzVi3hJmJVrrOCL8-p5pZWPHkmaHa--dTVn_NdUvrjcBwOw756XGxeCZqdgTkdQB3CTtKwGCOdFwHH72cWYxT5WJxTomBKTKflmLXz1ynJny0U9BrAdehU7-zYVl2xjQKXS-6s&sai=AMfl-YTkwhu6xK-TXx2kD1MIbaCbMPX4VfdjkZJtuizQT_0tKaWjuCefCth-6htjT-spnbHcfU_Nj-3_4JnZLLlXdgXGmxgwfpgskePOQNfwr-vjAHSlGdstc5kBJVMRRySifp0ozT3Qrc1404TdZUsqUgh330Dmz9IMp3wNgQKbt4IaIocXVDxtyPsz7vSHXmIpZRNmU_6341mdSlFBImmPSKnCCqJtmREE0-nvo4GxFolVf0xPFr99B-yqDsBmsPaFbrhU&sig=Cg0ArKJSzLXCAiu6hma0EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1251&vt=11&dtpt=1249&dett=2&cstd=0&cisv=r20230725.54987&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:52 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 27 Jul 2023 12:37:52 GMT

GET
H3 200 XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js Show response
pagead2.googlesyndication.com/bg/ Frame F29D 37 KB
14 KB 13ms
13ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=533972128&adf=1360024207&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466965&bpp=2&bdt=491&idt=970&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=f5oVZjJuPd&p=https%3A//ehfmc-com.ngontinh24.com&dtd=979

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4f9e4b1838819f2fdbc6eea07e712886701f71a49ff22a445a9be3d5c7d806

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:38:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57574
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14628
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jul 2024 20:38:18 GMT

POST
H/1.1 200 23.json Show response
id5-sync.com/g/v2/ 601 B
1 KB 272ms
94ms XHR
application/json 141.95.33.111
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/23.json

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/159753/4709/1/pwt.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.111 , Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

6bb52b420d5e14882293b25de8b119bee2564a76aa0cbb2c0f903a2ce8b592fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:52 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
p3p: CP="CAO PSA OUR"
access-control-allow-credentials: true

GET
H2 200 rid Show response
match.adsrvr.org/track/ 108 B
653 B 10ms
10ms XHR
application/json 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/159753/4709/1/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 01aaca93231f9751b0e046d3fa659e9a6fb7f5daddcb3021fbf6798ed29e4007

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:52 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 108
expires: Sat, 26 Aug 2023 12:37:52 GMT

GET
H2 200 amzns2s Show response
rtb.gumgum.com/usync/ Frame 6996 4 KB
1 KB 39ms
12ms Document
text/html 44.199.146.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-LoopMe_n-onetag_n-simpli.fi_rbd_rx_ox-db5_smrt_an-db5_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.199.146.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-199-146-122.compute-1.amazonaws.com
Software: nginx /
Resource Hash: d5a704669f2706e9a8bb3fe7c8b7f7c06681595b6f0ded76cba2d2357addf5ff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Thu, 27 Jul 2023 12:37:53 GMT
etag: W/"0a4c03492bb95fe0188fdb7a5399735a2"
server: nginx
timing-allow-origin: *

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 006A 281 B
554 B 54ms
8ms Document
text/html 23.52.162.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-LoopMe_n-onetag_n-simpli.fi_rbd_rx_ox-db5_smrt_an-db5_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-162-21.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 27 Jul 2023 12:37:53 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame 54E6 772 B
793 B 35ms
24ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-LoopMe_n-onetag_n-simpli.fi_rbd_rx_ox-db5_smrt_an-db5_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 0a8a670bf8b428e343b29af1054b6235d182c2ec2e84b4cf8d603f5d3b199f82

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 490
content-type: text/html
date: Thu, 27 Jul 2023 12:37:52 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame B912
Redirect Chain

https://ssbsync-us.smartadserver.com/api/sync?callerId=2&gdpr=0
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=5547321580367140260&gdpr=0&gdpr_consent=

43 B
479 B

35ms
16ms

Document
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=5547321580367140260&gdpr=0&gdpr_consent=

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-LoopMe_n-onetag_n-simpli.fi_rbd_rx_ox-db5_smrt_an-db5_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 27 Jul 2023 12:37:53 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: 3VPXFRAMM5E5TDDW293D

Redirect headers

content-length: 0
date: Thu, 27 Jul 2023 12:37:53 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=5547321580367140260&gdpr=0&gdpr_consent=

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 31CC
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid=%24UID&ex=appnexus.com&gdpr=0
https://s.amazon-adsystem.com/ecm3?id=7437480408642019502&ex=appnexus.com&gdpr=0

43 B
479 B

25ms
21ms

Document
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?id=7437480408642019502&ex=appnexus.com&gdpr=0

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-LoopMe_n-onetag_n-simpli.fi_rbd_rx_ox-db5_smrt_an-db5_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 27 Jul 2023 12:37:53 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: YG8NVQ0NA1J3CCJPNWCJ

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 6e088b25-15e4-4744-b99b-28f4a47e6c6a
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 27 Jul 2023 12:37:52 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://s.amazon-adsystem.com/ecm3?id=7437480408642019502&ex=appnexus.com&gdpr=0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.21.3
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
x-xss-protection: 0

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame E1E9
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID&gdpr=0
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=1562212822517953672969

43 B
479 B

18ms
18ms

Document
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=1562212822517953672969

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-LoopMe_n-onetag_n-simpli.fi_rbd_rx_ox-db5_smrt_an-db5_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 27 Jul 2023 12:37:53 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: A20TT9PHACRT8142QRK2

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Thu, 27 Jul 2023 12:37:53 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=1562212822517953672969
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 204 g_pbto
1x1.a-mo.net/hbx/ 0
90 B 77ms
12ms Image
text/plain 18.211.12.31
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1x1.a-mo.net/hbx/g_pbto?A=undefined&bid=undefined&a=undefined&cn=undefined&aud=undefined&ts=1690461472978&eid=2653257e81966471
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.211.12.31 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-211-12-31.compute-1.amazonaws.com
Software: MonetEngine /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:54 GMT
cache-control: max-age=0, private, must-revalidate
server: MonetEngine

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ 35 B
296 B 44ms
4ms Image
image/gif 104.117.182.27
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=projectevents&project=prebid&acid=8b5eb610-f351-40ad-bec4-04b8e246cbd9&cid=8CUWWG7OK&crid=856612716|856612716|856612716&adunit_count=3&dn=ehfmc-com.ngontinh24.com&requrl=https://ehfmc-com.ngontinh24.com/&istop=true&event=client_timeout&value=3&rd=1100
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.117.182.27 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-117-182-27.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:54 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Thu, 27 Jul 2023 12:37:54 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 185 KB
47 KB 357ms
354ms XHR
text/plain 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=493766145868713&correlator=894282434595980&eid=31076488%2C31070232&output=ldjh&gdfp_req=1&vrg=202307260101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=20842576%3A116518301%2CIN44NM%2CIN44NM-DDS.C&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250%7C160x600%7C300x600&ifi=20&adks=3682374856&didk=350508831&sfv=1-0-40&prev_scp=pos%3D3%26monu%3D300x250-160x600-300x600_B3%26slotNum%3D1%26placementNum%3D1%26allowNative%3Dfalse%26amznbid%3D2%26amznp%3D2%26refresh_count%3D0%26tabVisibilityState%3Dvisible%26max_bid%3Dnone%26provider_performance%3D_notchrome_10.00%26context%3D12_NY_notchrome%26slotOnScreen%3Dfalse&eri=1&cust_params=page_num%3D0%26big4%3Dtrue%26url%3Dehfmc-com.ngontinh24.com%26referrer%3Ddirect%26infolinks%3Dtrue%26hem_included%3Dfalse%26tcf_gdprApplies%3Dfalse%26tcfBehavior%3DnotApplicable&sc=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&abxe=1&dt=1690461472985&lmt=1690029259&adxs=1070&adys=2488&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=6&ucis=a&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&frm=20&vis=1&psz=300x0&msz=300x0&fws=512&ohw=0&psts=ABnkTfD9pVKJP4KxsPfuS8OHMDSVScu17xWt6wx3pA0ZRdjx7qbkLx_zQj3pZxWcCEVJUnBACFklMdi1dSy9Q1Sx1tSlhQ%2CABnkTfBy0XFcFshnkgY_LYb-WJLQ%2CABnkTfBy0XFcFshnkgY_LYb-WJLQ&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYtILsupkxSABSAghkEhkKCnB1YmNpZC5vcmcYtILsupkxSABSAghkEhcKCHJ0YmhvdXNlGLSC7LqZMUgAUgIIZBIZCgp1aWRhcGkuY29tGLOC7LqZMUgAUgIIZBIUCgVvcGVueBi0guy6mTFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YtILsupkxSABSAghkEhsKDGlkNS1zeW5jLmNvbRi0guy6mTFIAFICCGQ.&dlt=1690461466474&idt=4415

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260101/pubads_impl.js?cb=31076488

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

17a1da8687841f2b86460adb758b1311a35058db2338f71695222d5a56453ac8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48209
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js Show response
pagead2.googlesyndication.com/bg/ Frame E81E 37 KB
14 KB 24ms
22ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=1663128080&adf=743467531&pi=t.ma~as.3925753591&w=771&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=771x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466964&bpp=1&bdt=490&idt=272&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=584&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=h3JYZEuvl9&p=https%3A//ehfmc-com.ngontinh24.com&dtd=281

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4f9e4b1838819f2fdbc6eea07e712886701f71a49ff22a445a9be3d5c7d806

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:38:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57575
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14628
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jul 2024 20:38:18 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/sadbundle/12141210611375748195/300x250/ Frame 993C 4 KB
1 KB 10ms
0ms Document
text/html 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc6278edd76d7935b11f032c6291f3786a798c630eaa7518eb59587b5c1ad71f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 141962
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1392
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Jul 2023 21:11:51 GMT
expires: Wed, 24 Jul 2024 21:11:51 GMT
last-modified: Wed, 28 Jun 2023 05:38:04 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame E44D 0
0 54ms
49ms Fetch
image/gif 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstXJPr4FJAINtWr1trKG4L4ljGM4_ObsL849yyEFmVDl0k4evBIjNhxQrBTQ-sVzZaAqo2t_bd4BNXJkafJx1GEnd31F1aUQRJXyX7o71CNDg4HhlHz6t5DCAylhjkvUSQ7UObFFWnVvtNteTPMOlgTs2kFQU-qZ56IdPiawp3fNhbQ3sQPFKudXHSNz1C3Lfu7gUhm99jImM7fc1Hw0JxPKF80PMdu-KCASeVwXzsft1MXIj_2yTzxhxClrqnKAxHKlqJI7KDn7-tQyeL0bT4wu7dU5RH5zufnSWgWpgZ1eg9H0zsQs8yR1hJClv4MmM0sJaeRmqaaWXrVA7ltZkTH-bf5Wk2PJd6zM1wuY4yfugob9kariIIf5r8T6kmNBMC3BIOnYBolSTmSUHjd6Ts-yCwkiO4liFzre6VwBrBAM7gYbehfAlQmwA1Wd0N71RJ6ZTerZRaIcanGmONx_1jW6tINJCyZod0W0naxkQafCAoqozDZjN4QiTdcgZdQo_k_5nngfOwStSZdLmsPmGAtFv9sZOarNOdo5cDwZMslvopHcEuOnUs5i-JZe8_wDKbfimaVwmlYbuoepj2EPXsSp-Cxnppz7WVq6Pr4rA5_WN1LGUyNCn7h4Q3IN0ZxL9RBgg5kjlAOoJ_RcvdEW-UPvDMEh0IgOOQ6VVmZft-aKNzKOdLCXFCTcB5dMer4UptxvWOLdaD3kwmZ6ikBsmi_FFIslhY6UKxbW9sKSr8PxGM1DMcmKJhopK4zcd0Lf60vw6jQpp1JxH8W9g9Xgz1KOFzZLybvh9V7qyUPTHfFiZ4lwwUiK0OfOK51U9dNj3stfnX73BnINvNk6_5bb2vtglltMEhZdjpChj_NX78VX_L-JbuiW9mpuHCobV3LyfzR9fR72YXxF-iAoEsHYfa57-eWVXTeqbd7H3VK71R2RS3w8y5buj0hWAOiyd0C-LYFK2iPpbmHIaesUfjTzFot9zVCHAJKmbUEzSTKNF04m9zwe2YomT2nsUtF4xehuQJ-fCp9jkvFkW4YtFOKcQ_e2l_IfUwLvLKpb2Tq0unPbi6CQR56P5SHpTxM-zp_Msf7YJQ6nPEB_WI5k3akx7SZIdzsLKupAVtDWUTFf7E8uuP61MdHINE9KMsaqCWeYOKd51TcfZjfGqvxhfjo25zT4GMy_H7jMA1Z8uRvxvZbOTiYLEth2r2y8dJaNQk8VrjQ5OsIpxVYsRpItyLbRMmuJd-1WnKmJpuXgrqiwKoAFuwd0nzk3OjYVRT1rfhwXMp8hBwLoqxSxyx08EVLPuxW-gu8y-YoMia4nSKE5TVO9Jg&sai=AMfl-YS1twfUOy0ovnbWkFZUXcucP8O5V3r8MOi5l_zJPcXdKlwtOulpLzu0xQw94mXlRb-DJ47osnHq_xaydkZTKaQnzrGvKCM_nwnuYR9jwAA5265u1EI6O9HP44sL0kiZDqzMM-lxc1zKYowDEAZtEFmTY2NfYym3mVwGYpScqflk4YCaQof2aFTGOzKH1g3q66jy5vg9wbIZV_sH4027QyGxYED-nUfhGKSa2f8&sig=Cg0ArKJSzKOaKkPrO_oNEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1788&cbvp=1&cstd=1783&cisv=r20230725.74528&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 27 Jul 2023 12:37:53 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:53 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3AC1
Redirect Chain

https://aep.mxptint.net/sn.ashx?google_gid=CAESEIASIi-vyIAUoxiTgocvVk8&google_cver=1&google_push=AaAOQGGKCC0bghV1pLrHuLDGu-NeQInfNyC0dqqCG9x2oe0EeKHEk6cQD1keNm5mpEO9wlqJ9EzF_PKKCOAiQa3cXmsdfJWQxbS0uzc
https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AaAOQGGKCC0bghV1pLrHuLDGu-NeQInfNyC0dqqCG9x2oe0EeKHEk6cQD1keNm5mpEO9wlqJ9EzF_PKKCOAiQa3cXmsdfJWQxbS0uzc&google_hm=UjMzNjQ3XzEwN...

170 B
188 B

56ms
54ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AaAOQGGKCC0bghV1pLrHuLDGu-NeQInfNyC0dqqCG9x2oe0EeKHEk6cQD1keNm5mpEO9wlqJ9EzF_PKKCOAiQa3cXmsdfJWQxbS0uzc&google_hm=UjMzNjQ3XzEwNjc4MzhBNF8zNDg3ODg0MA%3D%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AaAOQGGKCC0bghV1pLrHuLDGu-NeQInfNyC0dqqCG9x2oe0EeKHEk6cQD1keNm5mpEO9wlqJ9EzF_PKKCOAiQa3cXmsdfJWQxbS0uzc&google_hm=UjMzNjQ3XzEwNjc4MzhBNF8zNDg3ODg0MA%3D%3D
Date: Thu, 27 Jul 2023 12:37:52 GMT
Cache-Control: private
Strict-Transport-Security: max-age=-373466208; includeSubDomains
P3P: CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE", CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE"
Content-Length: 349
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3AC1
Redirect Chain

https://rtb.adentifi.com/CookieSyncAdX?google_gid=CAESEGwWO3TrA9Jw_LxqPq5aUJA&google_cver=1&google_push=AaAOQGFrySrfk6oQaZy4vRNhb3ZJUZnKDuji13hD5so72UAsLRuf9EGPoX2bpvqrHG8yBk0N1-GEO2F_dNvm0SsuLiUS_...
https://cm.g.doubleclick.net/pixel?google_nid=adtheorent&google_hm=Zp9EECx6Ee6T2xKnrfzb6w&google_push=AaAOQGFrySrfk6oQaZy4vRNhb3ZJUZnKDuji13hD5so72UAsLRuf9EGPoX2bpvqrHG8yBk0N1-GEO2F_dNvm0SsuLiUS_lz...

170 B
188 B

94ms
91ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adtheorent&google_hm=Zp9EECx6Ee6T2xKnrfzb6w&google_push=AaAOQGFrySrfk6oQaZy4vRNhb3ZJUZnKDuji13hD5so72UAsLRuf9EGPoX2bpvqrHG8yBk0N1-GEO2F_dNvm0SsuLiUS_lzGJ6KAcM8&google_redir=https%3A%2F%2Frtb.adentifi.com%2FCookieSyncAdXCheck&google_ula=6802874232

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=adtheorent&google_hm=Zp9EECx6Ee6T2xKnrfzb6w&google_push=AaAOQGFrySrfk6oQaZy4vRNhb3ZJUZnKDuji13hD5so72UAsLRuf9EGPoX2bpvqrHG8yBk0N1-GEO2F_dNvm0SsuLiUS_lzGJ6KAcM8&google_redir=https%3A%2F%2Frtb.adentifi.com%2FCookieSyncAdXCheck&google_ula=6802874232
date: Thu, 27 Jul 2023 12:37:53 GMT
content-type: text/plain

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3AC1
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESELcaKPx3RWVwL4-FJizjU2A&google_cver=1&google_push=AaAOQGE-Lo-hSdr0SX8Nf3lnAe9LtDJRjGlY8n7Z0RU_YcLWmfzVjdeY6NU5fVqfh0YYUkoJQtHW15qdVXvdbutmRCCDH4_...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AaAOQGE-Lo-hSdr0SX8Nf3lnAe9LtDJRjGlY8n7Z0RU_YcLWmfzVjdeY6NU5fVqfh0YYUkoJQtHW15qdVXvdbutmRCCDH4_qD4Fz-YY&google_hm=eS01NGs3SlFaRTJwRy5...

170 B
188 B

47ms
44ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AaAOQGE-Lo-hSdr0SX8Nf3lnAe9LtDJRjGlY8n7Z0RU_YcLWmfzVjdeY6NU5fVqfh0YYUkoJQtHW15qdVXvdbutmRCCDH4_qD4Fz-YY&google_hm=eS01NGs3SlFaRTJwRy5rQXdOWFZyWXg2cEJnUC4yakhkY35B

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 27 Jul 2023 12:37:53 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AaAOQGE-Lo-hSdr0SX8Nf3lnAe9LtDJRjGlY8n7Z0RU_YcLWmfzVjdeY6NU5fVqfh0YYUkoJQtHW15qdVXvdbutmRCCDH4_qD4Fz-YY&google_hm=eS01NGs3SlFaRTJwRy5rQXdOWFZyWXg2cEJnUC4yakhkY35B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3AC1
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEGiXZycTwgahC91LEZIk3-Y&google_cver=1&google_push=AaAOQGFxifOXcsNCPcqm2lAMbxWxUW891i6glrcaodVAEJO664yPWYQ9gAT2XqDRQHHqNInJF5_QMMAe...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEGiXZycTwgahC91LEZIk3-Y&google_cver=1&google_push=AaAOQGFxifOXcsNCPcqm2lAMbxWxUW891i6glrcaodVAEJO664yPWYQ9gAT2XqDRQHHqNInJF5_...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTM0ODM3NzM1NTI2OTMzNjYyMA&google_push=AaAOQGFxifOXcsNCPcqm2lAMbxWxUW891i6glrcaodVAEJO664yPWYQ9gAT2XqDRQHHqNInJF5_QMM...

170 B
188 B

40ms
39ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTM0ODM3NzM1NTI2OTMzNjYyMA&google_push=AaAOQGFxifOXcsNCPcqm2lAMbxWxUW891i6glrcaodVAEJO664yPWYQ9gAT2XqDRQHHqNInJF5_QMMAeaEZP2q-nkoGGto7EpqvXs5o

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTM0ODM3NzM1NTI2OTMzNjYyMA&google_push=AaAOQGFxifOXcsNCPcqm2lAMbxWxUW891i6glrcaodVAEJO664yPWYQ9gAT2XqDRQHHqNInJF5_QMMAeaEZP2q-nkoGGto7EpqvXs5o
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H/1.1 200
200 asr
aid.send.microad.jp/g/ Frame 3AC1 43 B
641 B 771ms
193ms Image
image/gif 202.233.84.1
MICROAD MicroAd

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aid.send.microad.jp/g/asr?google_gid=CAESEOl66zdPVEmBh1nQpd_hEUM&google_cver=1&google_push=AaAOQGFP87FC8qZSP6PJrS1VuSpVONqxwIPKj296DpQo9DJsJp1KdeGKF04xznglHFvJRhAy0jfQU5fDVqOiGxTee8CYFRYAxiWwgds

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

202.233.84.1 , Japan, ASN131957 (MICROAD MicroAd, Inc., JP),

Reverse DNS

Software

Apache /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Thu, 27 Jul 2023 12:37:53 GMT
Strict-Transport-Security: max-age=3600
Server: Apache
P3P: policyref="http://www.microad.jp/w3c/p3p.xml",CP="NOI DSP COR NID DEVo PSAo OUR STP STA PRE"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Connection: close
Access-Control-Allow-Headers: origin, x-requested-with, If-Modified-Since, content-type, Pragma, Cache-Control
Content-Length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3AC1
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAaAOQGEhpR...
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k-FrmmJhr6jDXgLTijw0ddRCUciMATXqvLMAch9A&google_push=AaAOQGEhpRugDlMRuCkbIScO20TJxMX8DOU24W00oxj1ifsYEgRRhKGdLXCvXi-j4kP8zp8bLZ6G5wBOocyn...

170 B
188 B

46ms
42ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k-FrmmJhr6jDXgLTijw0ddRCUciMATXqvLMAch9A&google_push=AaAOQGEhpRugDlMRuCkbIScO20TJxMX8DOU24W00oxj1ifsYEgRRhKGdLXCvXi-j4kP8zp8bLZ6G5wBOocynXIZE-HwDa9cneyrRAA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:52 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k-FrmmJhr6jDXgLTijw0ddRCUciMATXqvLMAch9A&google_push=AaAOQGEhpRugDlMRuCkbIScO20TJxMX8DOU24W00oxj1ifsYEgRRhKGdLXCvXi-j4kP8zp8bLZ6G5wBOocynXIZE-HwDa9cneyrRAA
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1138810
content-length: 0
expires: Thu, 27 Jul 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3AC1
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEJYsuHs6s1O74JLGHus4zP8&google_cver=1&google_push=AaAOQGGmmrO9gjDpSiq7qQo42lNtepuccIaLlPQ9NBwDqPiDj70CNP7vBawhBwqff2jdAvbOh5OHqSebVsLgQCs...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGGmmrO9gjDpSiq7qQo42lNtepuccIaLlPQ9NBwDqPiDj70CNP7vBawhBwqff2jdAvbOh5OHqSebVsLgQC...

170 B
188 B

39ms
39ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGGmmrO9gjDpSiq7qQo42lNtepuccIaLlPQ9NBwDqPiDj70CNP7vBawhBwqff2jdAvbOh5OHqSebVsLgQCsMUrnyNhufRnQalc0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGGmmrO9gjDpSiq7qQo42lNtepuccIaLlPQ9NBwDqPiDj70CNP7vBawhBwqff2jdAvbOh5OHqSebVsLgQCsMUrnyNhufRnQalc0
Date: Thu, 27 Jul 2023 12:37:53 GMT
Connection: keep-alive
Content-Length: 245
Content-Type: text/html; charset=utf-8

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 3AC1 0
12 B 48ms
39ms Image
text/html 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IAN0ZFzkgokR2vtP39Yeu3UOhp0pnUGG0t7i73lK4ABMyGh1qv95V7J-8dZNcKG3Spf2mX

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=3845813746&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466968&bpp=2&bdt=494&idt=1314&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=430&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=36q7txpbHb&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1322

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 2C19
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEMGwem1HBDJaTWIliP40Fxk&google_cver=1&google_push=AaAOQGELO8j49XqbTUVxXrWHiQ0V9mZAS9BYEzhTaY5a_laXDq9PnUKtr-MILENWdz__mfs7wtcDGI5XfykGblJBnDg0-bimX6j2xaE
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NDA5MzMzNDg1NjI1MDcwMTMzMQ==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1

43 B
398 B

74ms
32ms

Image
image/gif

2620:112:f002:bbbb::21
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=2294626326&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466970&bpp=1&bdt=495&idt=1510&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&fsb=1&xpc=hDyHm3Dgx6&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1515
Protocol: H2
Server: 2620:112:f002:bbbb::21 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2C19
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEPhOd_BJmJKgLPbMbOSxdGM&google_push=AaAOQGGb7IY9TVpObi3DviyrB9gCKA6CEu0KVG65QwJsErtZISP5rZ1HVC...

170 B
188 B

62ms
61ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEPhOd_BJmJKgLPbMbOSxdGM&google_push=AaAOQGGb7IY9TVpObi3DviyrB9gCKA6CEu0KVG65QwJsErtZISP5rZ1HVCPUOnrE9bdp4D3NkXo5tv6lafFDyzBsVhTRxg0YjRqZcPM

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=2294626326&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466970&bpp=1&bdt=495&idt=1510&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&fsb=1&xpc=hDyHm3Dgx6&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1515

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-lga21963-LGA
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1690461473.137524,VS0,VE9
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEPhOd_BJmJKgLPbMbOSxdGM&google_push=AaAOQGGb7IY9TVpObi3DviyrB9gCKA6CEu0KVG65QwJsErtZISP5rZ1HVCPUOnrE9bdp4D3NkXo5tv6lafFDyzBsVhTRxg0YjRqZcPM
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2C19
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEM9CXtzmclE3o7SR_9rvtdc&google_cver=1&google_push=AaAOQGGiY4mlnGnDLCnLOn2aCuCJ9_HcTbaxDUKCFhjImz5HrLbtQUji3P--cJEeEo6_SkLjTVWJgsvETBbYjepBdPRSr9s...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AaAOQGGiY4mlnGnDLCnLOn2aCuCJ9_HcTbaxDUKCFhjImz5HrLbtQUji3P--cJEeEo6_SkLjTVWJgsvETBbYjepBdPRSr9sT8AptPho&google_hm=eS01NGs3SlFaRTJwRy5...

170 B
188 B

48ms
45ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AaAOQGGiY4mlnGnDLCnLOn2aCuCJ9_HcTbaxDUKCFhjImz5HrLbtQUji3P--cJEeEo6_SkLjTVWJgsvETBbYjepBdPRSr9sT8AptPho&google_hm=eS01NGs3SlFaRTJwRy5rQXdOWFZyWXg2cEJnUC4yakhkY35B

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=2294626326&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466970&bpp=1&bdt=495&idt=1510&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&fsb=1&xpc=hDyHm3Dgx6&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1515

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 27 Jul 2023 12:37:53 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AaAOQGGiY4mlnGnDLCnLOn2aCuCJ9_HcTbaxDUKCFhjImz5HrLbtQUji3P--cJEeEo6_SkLjTVWJgsvETBbYjepBdPRSr9sT8AptPho&google_hm=eS01NGs3SlFaRTJwRy5rQXdOWFZyWXg2cEJnUC4yakhkY35B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2C19
Redirect Chain

https://beacon.lynx.cognitivlabs.com/adx.gif?google_gid=CAESENaGqhADEsIqhS9QtutmuMM&google_cver=1&google_push=AaAOQGEsWPFaGZ_WiPlmms4dS99ty6hYPVdqafk31h3Q1L6uVwslYMxVErEo4ioXBGaf5P5o9gacGKq97Xvnxlq...
https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=CsLn-nfv-U6M696tGIKFrw&google_push=AaAOQGEsWPFaGZ_WiPlmms4dS99ty6hYPVdqafk31h3Q1L6uVwslYMxVErEo4ioXBGaf5P5o9gacGKq97XvnxlqSVAs7gmBqA...

170 B
188 B

61ms
59ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=CsLn-nfv-U6M696tGIKFrw&google_push=AaAOQGEsWPFaGZ_WiPlmms4dS99ty6hYPVdqafk31h3Q1L6uVwslYMxVErEo4ioXBGaf5P5o9gacGKq97XvnxlqSVAs7gmBqAVcUE3pH

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=2294626326&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466970&bpp=1&bdt=495&idt=1510&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&fsb=1&xpc=hDyHm3Dgx6&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1515

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=CsLn-nfv-U6M696tGIKFrw&google_push=AaAOQGEsWPFaGZ_WiPlmms4dS99ty6hYPVdqafk31h3Q1L6uVwslYMxVErEo4ioXBGaf5P5o9gacGKq97XvnxlqSVAs7gmBqAVcUE3pH
Date: Thu, 27 Jul 2023 12:37:53 GMT
Server: Kestrel
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2C19
Redirect Chain

https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESEBwr-s48HfNMEQ15z7MghCU&google_cver=1&google_push=AaAOQGHl1m_ZCmIK4V5OHKVoCoFIWT83Ht0Y1q2mr0rzBm8qQCoumyIHjWY0NYatbzvSF6n1WbfQ8cO6dKxjDFIxO...
https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESEBwr-s48HfNMEQ15z7MghCU&google_cver=1&google_push=AaAOQGHl1m_ZCmIK4V5OHKVoCoFIWT83Ht0Y1q2mr0rzBm8qQCoumyIHjWY0NYatbzvSF6n1WbfQ8cO6dKxjDFIxO...
https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=N2VhOTE4OWExNTJjMGMzMw&google_push=AaAOQGHl1m_ZCmIK4V5OHKVoCoFIWT83Ht0Y1q2mr0rzBm8qQCoumyIHjWY0NYatbzvSF6n1WbfQ8cO6dKxjDFIxOlszc-li...

170 B
188 B

38ms
38ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=N2VhOTE4OWExNTJjMGMzMw&google_push=AaAOQGHl1m_ZCmIK4V5OHKVoCoFIWT83Ht0Y1q2mr0rzBm8qQCoumyIHjWY0NYatbzvSF6n1WbfQ8cO6dKxjDFIxOlszc-li471r4MLB

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=2294626326&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466970&bpp=1&bdt=495&idt=1510&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&fsb=1&xpc=hDyHm3Dgx6&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1515

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 27 Jul 2023 12:37:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: nginx
x-frame-options: SAMEORIGIN
location: https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=N2VhOTE4OWExNTJjMGMzMw&google_push=AaAOQGHl1m_ZCmIK4V5OHKVoCoFIWT83Ht0Y1q2mr0rzBm8qQCoumyIHjWY0NYatbzvSF6n1WbfQ8cO6dKxjDFIxOlszc-li471r4MLB
content-length: 0
x-xss-protection: 1; mode=block

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2C19 0
12 B 64ms
35ms Image
text/html 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IuAHJweDWgNdXow6_9txe93EL7sGR8LUQlVuu1BITyjKfpH-WoENoM1rVNNA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=2294626326&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466970&bpp=1&bdt=495&idt=1510&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&fsb=1&xpc=hDyHm3Dgx6&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1515

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
411 B 270ms
89ms XHR
application/json 162.19.138.119
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ec2-54-210-169-226.compute-1.amazonaws.com

Software

Resource Hash

86c9a00f0b3cbda7a6368ea65374ddfa83eb61d085494a217e237b3254b0501e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:52 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H2 204 state Show response
api.btloader.com/mw/ 0
102 B 49ms
31ms Fetch 130.211.23.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/mw/state?bt_env=prod
Requested by: Host: btloader.com
URL: https://btloader.com/tag?aax_id=AAX8RN661&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 27 Jul 2023 12:37:53 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
vary: Origin

GET
H2 200 px.gif
ad-delivery.net/ 43 B
937 B 25ms
10ms Image
image/gif 2606:4700:20::ac43:4513
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4513 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:54 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 573474
x-guploader-uploadid: ADPycdvQVI6Itiir0EUbPZXJN2RYwyDJl3f5HVlPC-T4-rftrv78wxUCz6xm1zkxHrMissxztlkd6Y5nDWXA-a0bEXjmKQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
content-length: 43
last-modified: Wed, 05 May 2021 19:25:32 GMT
server: cloudflare
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
vary: Accept-Encoding
x-goog-generation: 1620242732037093
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=86400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k%2FGG1GcgzT0BnQDL4nA%2BkH4%2BCPzxZb9BtVaVRuIztlTsexZy6vNiDT5L0rpkVcrm%2BOzFkv%2BFvMwO9ugj7KDMTJS4kmWoreS%2Beu9gQ9x8QumTjXs5UaftXLtu8uV%2BdzSDvNW181XZBBVfTCv6wA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 43
accept-ranges: bytes
cf-ray: 7ed4efb95b7b41f3-EWR
expires: Thu, 20 Jul 2023 22:18:15 GMT

GET
H2 200 favicon.ico
ad.doubleclick.net/ 1 KB
571 B 58ms
13ms Image
image/x-icon 172.217.13.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s04-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 01:00:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 41826
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 104
x-xss-protection: 0
last-modified: Tue, 08 May 2012 13:08:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/x-icon
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 28 Jul 2023 01:00:48 GMT

GET
H2 200 px.gif
ad-delivery.net/ 43 B
340 B 11ms
7ms Image
image/gif 2606:4700:20::ac43:4513
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.2943681081977876
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4513 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:54 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 573474
x-guploader-uploadid: ADPycdvQVI6Itiir0EUbPZXJN2RYwyDJl3f5HVlPC-T4-rftrv78wxUCz6xm1zkxHrMissxztlkd6Y5nDWXA-a0bEXjmKQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
content-length: 43
last-modified: Wed, 05 May 2021 19:25:32 GMT
server: cloudflare
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
vary: Accept-Encoding
x-goog-generation: 1620242732037093
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=86400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5jYbRBE1rMWBuJWzKsIcO%2BHh%2B5NPEYF6h6%2B0tgSVbaMw6x6OVSE21ynZVidvv0mohjAZmUSKIBBiO8rDFsoBrp5SEFo96yfeEwy6lQgrmlk9miLp7lP826fF2ootpd9UB6JCU%2FrWCcbY7%2FdzuQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 43
accept-ranges: bytes
cf-ray: 7ed4efb96b8841f3-EWR
expires: Thu, 20 Jul 2023 22:18:15 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A069 503 B
224 B 29ms
27ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDWo8rDAhi9zdXaATAB&v=APEucNUBhsEaFPNQV0dRbVu5e4R8fS5mbPl8-J0LpVDpyB9M-dOIvwsneHfycaGKsOmdaMFFO35ApYJOXAjfgsfdOBVfqkkXR-sTeS0gsYbDLjWrdfslE5c

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58644b7dfa826a3291e2e5d6c2974b47906616e1aa03a2f757fdd1bde7796621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 198
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 0ED6 85 KB
29 KB 56ms
56ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ab16567d9da12ec25f3ecac99aaf886c3afd988ce75648c944fe0756a0e433f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29792
x-xss-protection: 0
server: cafe
etag: 8957437012570195358
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:53 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0ED6 42 B
63 B 57ms
56ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Dk548ttvrk6QVjzYJ9mBVX0sWeAtTdIDSHeGzUvgCekAjWJzUexWjfy5xw2f0LjULsV4w-HmYuUgN1F37AqUB9AFdIuQ0Ux-_oN4Kl7myn4N8uYp8

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0ED6 0
20 B 57ms
53ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=17570431935271585348&x=1&ct=76

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame 0ED6 3 KB
1 KB 30ms
27ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/window_focus_fy2021.js

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:40:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57460
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:40:13 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame 0ED6 20 KB
8 KB 31ms
27ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ecb4fb492aee0a820dfc4a395fb80e2ac2e864bbf38aa1ae28d6d70fb9e6da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78225
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 0ED6 0
0 52ms
49ms Image
text/html 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSFMmUbtdV73Gjbq3BU7XgeLTYG1iDnWtWxWyT66BU5D1oYw5vR1ZCM2e9HYSurj46b48yoHvfzMJPS6dO6ET_CA5luAQ
Requested by: Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0ED6 179 KB
56 KB 105ms
102ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f294f48a5bc171da79776780d32c77ae3323a508cb595a56f116ecb7578a8e7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57383
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690198756579870"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:53 GMT

GET
H2 200 pixel
protected-by.clarium.io/ Frame 0ED6 68 B
245 B 64ms
11ms Image
image/png 54.86.168.92
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_T09oM2JUcnRiMm5IeU93R2syTFRPNVNXbzU0LzIzNjcyNTUwMTA6MTYweDYwMA==&v=5&s=v31h6blm2el&id=eyJkZnAiOnsiYWQiOjI4MTkyMjk2LCJjIjpudWxsLCJsIjowLCJvIjoyMzY3MjU1MDEwLCJBIjoiLzIwODQyNTc2LDExNjUxODMwMS9JTjQ0Tk0vSU40NE5NLUREUy5EIiwieSI6MTIxNzU5LCJjbyI6MCwicyI6Im1tdC04MjdmYzhlMC04MmZmLTQ2OTAtODNjMy1kMjM4MGM3NTI0YmJfMV8xX2FkIn19&cb=1836995&h=ehfmc-com.ngontinh24.com&d=eyJ3aCI6IlQwOW9NMkpVY25SaU1tNUllVTkzUjJzeVRGUlBOVk5YYnpVMEx6SXpOamN5TlRVd01UQTZNVFl3ZURZd01BPT0iLCJ3ZCI6eyJvIjoyMzY3MjU1MDEwLCJ3IjoiMTYwIiwiaCI6IjYwMCJ9LCJ3ciI6Mn0=
Requested by: Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.86.168.92 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-86-168-92.compute-1.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/png
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
cache-control: no-store, no-cache, must-revalidate, max-age=0
server: nginx/1.18.0 (Ubuntu)
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

pixel.gif
load77.exelator.com/
Redirect Chain

https://cms.analytics.yahoo.com/cms?partner_id=EXETE
https://ups.analytics.yahoo.com/ups/58735/cms?partner_id=EXETE
https://loadm.exelator.com/load/?p=204&g=680&j=0&buid=y-A5ZB9dxE2pX7vUxdB0pjlbAyIjxBaDIwkUw-~A
https://load77.exelator.com/pixel.gif

43 B
367 B

64ms
2ms

Image
image/gif

2a02:6ea0:c400::11
CDN77 ^_^

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://load77.exelator.com/pixel.gif
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 2a02:6ea0:c400::11 New York, United States, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-77-pop: newyorkUSNY
date: Thu, 27 Jul 2023 12:37:56 GMT
x-cache: HIT
x-77-cache: HIT
x-age: 797179
x-accel-date: 1689664297
content-length: 43
x-77-nzt: AZySJBYpdM//+ykMAA
x-accel-expires: @1690701097
last-modified: Wed, 25 Oct 2017 17:03:56 GMT
server: CDN77-Turbo
etag: "59f0c3fc-2b"
x-77-nzt-ray: 1e192d08aec8bfac2465c264960e9417
content-type: image/gif
access-control-allow-origin: *
accept-ranges: bytes

Redirect headers

date: Thu, 27 Jul 2023 12:37:55 GMT
server: nginx
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location: https://load77.exelator.com/pixel.gif
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
content-length: 0

GET
H2

200

/
load.exelator.com/load/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=exelate&google_hm=Y2M2ZGZiMmZlNWQ4YmMzMWRlNzFkYzg3YWE2MTM3MzM&&google_redir=https://load.exelator.com/load/?p=204&g=109
https://load.exelator.com/load/?p=204&g=109

134 B
134 B

51ms
13ms

Image
application/x-javascript

50.16.197.56
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://load.exelator.com/load/?p=204&g=109
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 50.16.197.56 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-197-56.compute-1.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: application/x-javascript;charset=UTF-8
date: Thu, 27 Jul 2023 12:37:53 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://load.exelator.com/load/?p=204&g=109
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 244
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

m
secure-gl.imrworldwide.com/cgi-bin/
Redirect Chain

https://idsync.rlcdn.com/397416.gif?partner_uid=cc6dfb2fe5d8bc31de71dc87aa613733
https://secure-gl.imrworldwide.com/cgi-bin/m?ci=us-liveramp&cg=Xc3008nMAJvOj_5vAFuwJ2WZ0n5mvPb0m0qaw9_QHQV6pj9eg

44 B
706 B

292ms
24ms

Image
image/gif

2600:9000:21ec:400:1e:a43d:b640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-gl.imrworldwide.com/cgi-bin/m?ci=us-liveramp&cg=Xc3008nMAJvOj_5vAFuwJ2WZ0n5mvPb0m0qaw9_QHQV6pj9eg
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 2600:9000:21ec:400:1e:a43d:b640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:54 GMT
via: 1.1 bc4b5a0c950f70df08b33cfb9288c098.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK51-C1
x-cache: Miss from cloudfront
p3p: P3P policyref="http://secure-gl.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
cross-origin-resource-policy: cross-origin
content-length: 44
pragma: no-cache
server: nginx
accept-ch: Sec-Ch-Ua-Model, Sec-Ch-Ua-Platform, Sec-Ch-Ua-Platform-Version
access-control-allow-methods: POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
x-amz-cf-id: 4gZvTN6Bkb0YbFVtT-UOGdQORR7Ogi3J1L6h4ZVeZgsMZLwkeamMwg==
expires: Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

date: Thu, 27 Jul 2023 12:37:53 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://secure-gl.imrworldwide.com/cgi-bin/m?ci=us-liveramp&cg=Xc3008nMAJvOj_5vAFuwJ2WZ0n5mvPb0m0qaw9_QHQV6pj9eg
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ 43 B
855 B 18ms
17ms Image
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=7be11c9c-3fd1-4409-a016-f23294a75c34&id=cc6dfb2fe5d8bc31de71dc87aa613733

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:55 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: EHAVKM8B24XCV7FKK05M
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 /
nmcsync.imrworldwide.com/ 35 B
428 B 157ms
9ms Image
image/gif 54.210.169.226
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nmcsync.imrworldwide.com/?xuid=cc6dfb2fe5d8bc31de71dc87aa613733

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.210.169.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
strict-transport-security: max-age=31536000
max-age: 0
accept-ch: Sec-Ch-Ua-Model, Sec-Ch-Ua-Platform, Sec-Ch-Ua-Platform-Version
content-type: image/gif
p3p: P3P policyref="http://nmcsync.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cross-origin-resource-policy: cross-origin
content-length: 35
expires: 0

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
396 B 231ms
93ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?p_user_id=cc6dfb2fe5d8bc31de71dc87aa613733&p_id=28539

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-response-time: 73
date: Thu, 27 Jul 2023 12:37:54 GMT
strict-transport-security: max-age=631138519
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: f8878ed8051a6ac5
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: 58da6b5f17e947a7fbfa97bf47571a604779e15aba48362637ed0ae4a928fd03
content-length: 43

GET
H2 200 frame_content.js Show response
resources.infolinks.com/js/1870.002-3.027.ab.1874.021-3.027/ Frame 44B4 2 KB
693 B 19ms
19ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1870.002-3.027.ab.1874.021-3.027/frame_content.js
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cc3a41863d92b22799ff23c52e2173e80b13ebc75b9144151ea105cd52b59de5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 19 Jul 2023 11:07:11 GMT
server: cloudflare
age: 4437
etag: W/"96d-600d508882e6a"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 7ed4efaff8f74388-EWR
expires: Sat, 26 Aug 2023 11:23:56 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 57F8 356 B
191 B 31ms
23ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDWo8rDAhjXy9XaATAB&v=APEucNWHV58US9C4UKjwD8pUaTKXMJedEOxMYmEImrj8af7DFm_VCK6Zt0NQyrIekpSfy1RW7OkZoCyreTB3XTa1UmE4QFauEvVzM_p4VmBACCR5vh-Mc_k

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

55f56026d86468db4135723445d1df3498809ce536fa7a518b2847d7e6a27a96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 165
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 2E8C 85 KB
29 KB 114ms
113ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b5c05892bdce212e19d0503253b600faaeedca47fa2db97964d412c8c11934e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29781
x-xss-protection: 0
server: cafe
etag: 4315658989838864570
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:53 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2E8C 42 B
63 B 43ms
41ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ACtW9ylbVqnHmkEdwESxGQyCJVNRn8mjYZQfjxaglVc9hwGlopht3jfr7jQXmulvlIzguBTeuGvUHWCUnt7Yp0ZJwn48gQep20K6s1FNFXLGoLN0M

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2E8C 0
20 B 46ms
41ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=6505049772523423541&x=1&ct=76

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame 2E8C 3 KB
1 KB 14ms
11ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/window_focus_fy2021.js

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:40:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57460
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:40:13 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame 2E8C 20 KB
8 KB 17ms
14ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ecb4fb492aee0a820dfc4a395fb80e2ac2e864bbf38aa1ae28d6d70fb9e6da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78225
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2E8C 179 KB
56 KB 49ms
46ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f294f48a5bc171da79776780d32c77ae3323a508cb595a56f116ecb7578a8e7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57383
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690198756579870"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:53 GMT

GET
H2 200 pixel
protected-by.clarium.io/ Frame 2E8C 68 B
244 B 14ms
11ms Image
image/png 54.86.168.92
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_T09oM2JUcnRiMm5IeU93R2syTFRPNVNXbzU0LzIzNjcyNTUwMTA6NzI4eDkw&v=5&s=v31h6blm2jh&id=eyJkZnAiOnsiYWQiOjI4MTkyMjk2LCJjIjpudWxsLCJsIjowLCJvIjoyMzY3MjU1MDEwLCJBIjoiLzIwODQyNTc2LDExNjUxODMwMS9JTjQ0Tk0vSU40NE5NLURESC5BIiwieSI6MTIxNzU5LCJjbyI6MCwicyI6Im1tdC1kZjY2NDgyNi01YzlhLTQ2ZjEtOTQ3YS01NmYzOTI2M2MzMGRfMV8xX2FkIn19&cb=6623692&h=ehfmc-com.ngontinh24.com&d=eyJ3aCI6IlQwOW9NMkpVY25SaU1tNUllVTkzUjJzeVRGUlBOVk5YYnpVMEx6SXpOamN5TlRVd01UQTZOekk0ZURrdyIsIndkIjp7Im8iOjIzNjcyNTUwMTAsInciOiI3MjgiLCJoIjoiOTAifSwid3IiOjJ9
Requested by: Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.86.168.92 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-86-168-92.compute-1.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/png
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
cache-control: no-store, no-cache, must-revalidate, max-age=0
server: nginx/1.18.0 (Ubuntu)
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame CBC0 356 B
191 B 33ms
27ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDWo8rDAhi9zdXaATAB&v=APEucNXgDoRh4blSGEp28sYPvokacm8DT7lalaVt4DYQ3FbKOeCqahILMDTIEuu-xu1JoAHj6ajkmbsplkBEffDm-WCpau_224s_C5lse7uqY9Faj249KP0

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

55f56026d86468db4135723445d1df3498809ce536fa7a518b2847d7e6a27a96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 165
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 4269 85 KB
29 KB 68ms
68ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b5c05892bdce212e19d0503253b600faaeedca47fa2db97964d412c8c11934e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29781
x-xss-protection: 0
server: cafe
etag: 4315658989838864570
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:53 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4269 42 B
63 B 45ms
44ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BXdwvxK9A2g51Yr5NJqm0IBPvCIJWkjU7uaNjwOs9KqCk1wyKXcUTTzStwGKQOsJnPpbEzP-TF4lRbwDTpvJMDj6w5fyz5wWZRsaGEYsGDgcjktUc

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4269 0
20 B 45ms
44ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=18089128470098513510&x=1&ct=76

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame 4269 3 KB
1 KB 14ms
12ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/window_focus_fy2021.js

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:40:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57460
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:40:13 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame 4269 20 KB
8 KB 14ms
13ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ecb4fb492aee0a820dfc4a395fb80e2ac2e864bbf38aa1ae28d6d70fb9e6da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78225
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 4269 0
0 42ms
41ms Image
text/html 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRtWt7oRcGn57AEe3HhS6WmKTjBLm50yFtuYIx95fYOC7e3k1DS7R_LAyTOvPpKlplQMC_2xvc8nQgnvuzc0vXZAMPuyQ
Requested by: Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4269 179 KB
56 KB 64ms
62ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f294f48a5bc171da79776780d32c77ae3323a508cb595a56f116ecb7578a8e7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57383
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690198756579870"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:53 GMT

GET
H2 200 pixel
protected-by.clarium.io/ Frame 4269 68 B
244 B 11ms
10ms Image
image/png 54.86.168.92
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_T09oM2JUcnRiMm5IeU93R2syTFRPNVNXbzU0LzIzNjcyNTUwMTA6MTYweDYwMA==&v=5&s=v31h6blm2oe&id=eyJkZnAiOnsiYWQiOjI4MTkyMjk2LCJjIjpudWxsLCJsIjowLCJvIjoyMzY3MjU1MDEwLCJBIjoiLzIwODQyNTc2LDExNjUxODMwMS9JTjQ0Tk0vSU40NE5NLUREUy5KIiwieSI6MTIxNzU5LCJjbyI6MCwicyI6Im1tdC0wMTE1ZWJhOC1iNGNlLTQ4MzktYmVlNS1jMjhhMWM5YjE0YzhfMV8xX2FkIn19&cb=6483377&h=ehfmc-com.ngontinh24.com&d=eyJ3aCI6IlQwOW9NMkpVY25SaU1tNUllVTkzUjJzeVRGUlBOVk5YYnpVMEx6SXpOamN5TlRVd01UQTZNVFl3ZURZd01BPT0iLCJ3ZCI6eyJvIjoyMzY3MjU1MDEwLCJ3IjoiMTYwIiwiaCI6IjYwMCJ9LCJ3ciI6Mn0=
Requested by: Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.86.168.92 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-86-168-92.compute-1.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/png
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
cache-control: no-store, no-cache, must-revalidate, max-age=0
server: nginx/1.18.0 (Ubuntu)
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 79B6 412 B
234 B 24ms
24ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CP_1exD12n0Y98yh5gEwAQ&v=APEucNX4tyTqdMYnIvlI9PG2HUV_sHAs9mR-p5yK8ZBugwtge-P4K-Y3jpRjG2tttROUQbTViqJU1mv2bFR5VW2X_YiIMWvMX4ozH7txhNuuxjCjEpBwZY4

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b5caab4f619e85958d7b9985c51504f31aa65076fba3ecf921eb3f91fe5061e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 208
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame D8C1 86 KB
29 KB 70ms
69ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e0229dbcb78d16f4e98ccb93decb992b6bb488fffdd85675e586ab6546efd3bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30178
x-xss-protection: 0
server: cafe
etag: 18056378990419963096
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:53 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D8C1 42 B
63 B 44ms
40ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BwPh6slOHEFPxG7Ov0Oo6vVEmKh9tnbTAJ_22ULxPDg8wdirw6lQ9XcmBQRpljG6ilABXfHd_mWUvDhBCY-LYbv8lh5ifNcbtuhQ1RHNWRLo7NUr4

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D8C1 0
20 B 46ms
42ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=4446582534515229103&x=1&ct=76

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame D8C1 3 KB
1 KB 17ms
14ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/window_focus_fy2021.js

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:40:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57460
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:40:13 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame D8C1 20 KB
8 KB 18ms
14ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ecb4fb492aee0a820dfc4a395fb80e2ac2e864bbf38aa1ae28d6d70fb9e6da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78225
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D8C1 179 KB
56 KB 60ms
56ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5b7d1e63e50218b22558bc94b9d37faac51551fcdb29a7390226a6669d24d8de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57355
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690371356542162"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:53 GMT

GET
H2 200 pixel
protected-by.clarium.io/ Frame D8C1 68 B
244 B 15ms
11ms Image
image/png 54.86.168.92
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_T09oM2JUcnRiMm5IeU93R2syTFRPNVNXbzU0LzIzNjcyNTUwMTA6MzAweDYwMA==&v=5&s=v31h6blm2s3&id=eyJkZnAiOnsiYWQiOjI4MTkyMjk2LCJjIjpudWxsLCJsIjowLCJvIjoyMzY3MjU1MDEwLCJBIjoiLzIwODQyNTc2LDExNjUxODMwMS9JTjQ0Tk0vSU40NE5NLUREUi5EIiwieSI6MTIxNzU5LCJjbyI6MCwicyI6Im1tdC0yNmMxNWI4ZS04MDgwLTQ5ODYtOTI0ZS0wNTBjMGYwMjIyZDZfMV8xX2FkIn19&cb=9520892&h=ehfmc-com.ngontinh24.com&d=eyJ3aCI6IlQwOW9NMkpVY25SaU1tNUllVTkzUjJzeVRGUlBOVk5YYnpVMEx6SXpOamN5TlRVd01UQTZNekF3ZURZd01BPT0iLCJ3ZCI6eyJvIjoyMzY3MjU1MDEwLCJ3IjoiMzAwIiwiaCI6IjYwMCJ9LCJ3ciI6Mn0=
Requested by: Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.86.168.92 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-86-168-92.compute-1.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/png
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
cache-control: no-store, no-cache, must-revalidate, max-age=0
server: nginx/1.18.0 (Ubuntu)
expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200 23.json Show response
id5-sync.com/g/v2/ 595 B
1 KB 90ms
90ms XHR
application/json 141.95.33.111
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/23.json

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/159753/4709/1/pwt.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.111 , Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

4752f13d4ada9fcf10b98764daa98dcf41a92012cce5e4b96ac7d60a992d5e27

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:52 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
p3p: CP="CAO PSA OUR"
access-control-allow-credentials: true

GET
H2 200 rid Show response
match.adsrvr.org/track/ 108 B
658 B 11ms
10ms XHR
application/json 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/159753/4709/1/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 3c2257e17b9f0151e2eda09218f6ba2d64a5b810b1cfad98bf867c5313dce583

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 108
expires: Sat, 26 Aug 2023 12:37:53 GMT

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
411 B 94ms
94ms XHR
application/json 162.19.138.119
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

41139f19a9bd033b2f51fb6e08a1c0f3cb2b2535956de24cc0cc8ed5c2760f20

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:53 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H3 200 cac0c864edda0087bf141d240f6ef92e.js Show response
www.gstatic.com/mysidia/ Frame EAD7 9 KB
4 KB 14ms
13ms Script
text/javascript 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/cac0c864edda0087bf141d240f6ef92e.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6d046447e30e2ecffe5f823e770fca36fff69966f98f67b6fee1acc5c37bdb61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:51:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 56789
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3959
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 20:41:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 24 Oct 2023 20:51:24 GMT

GET
H3 200 72f96481e1fa2f83db121c0d28854a9d.js Show response
www.gstatic.com/mysidia/ Frame EAD7 152 KB
56 KB 16ms
16ms Script
text/javascript 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/72f96481e1fa2f83db121c0d28854a9d.js?tag=gpa/dynamic_fig_web_banner_v2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5128aec75e8871050e308620c8c73acf0ca2680a6104e2fb257ed259dd9aac0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 18:30:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 151634
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57346
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 20:41:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 23 Oct 2023 18:30:39 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame EAD7 11 KB
1 KB 38ms
38ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%7CGoogle%20Sans%20Display%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e5688319ea093a91c367a5f64f22b2012affd2a2bf80a8e31a6f4e02c67fb1ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 27 Jul 2023 12:37:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 27 Jul 2023 11:00:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 27 Jul 2023 12:37:53 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame EAD7 2 KB
903 B 16ms
14ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78225
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/ Frame EAD7 23 KB
9 KB 17ms
15ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93028274da1d373cd41165f6a442568ddd482370e8093e45d14a4ad0f6981f19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78225
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9132
x-xss-protection: 0
server: cafe
etag: 17712579318771444318
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame EAD7 3 KB
1 KB 19ms
17ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:40:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57460
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:40:13 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame EAD7 20 KB
8 KB 17ms
16ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ecb4fb492aee0a820dfc4a395fb80e2ac2e864bbf38aa1ae28d6d70fb9e6da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78225
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame EAD7 179 KB
56 KB 46ms
45ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f294f48a5bc171da79776780d32c77ae3323a508cb595a56f116ecb7578a8e7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57383
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690198756579870"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:53 GMT

GET
H3 200 39d4397462e2693449f221f9915f9e59.js Show response
www.gstatic.com/mysidia/ Frame EAD7 33 KB
14 KB 26ms
25ms Script
text/javascript 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/39d4397462e2693449f221f9915f9e59.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

67edbe1fe2a38ebf16fc36b42cc267e37f18629ec79feae7a177178bf6e24d89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 17:55:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 153754
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14179
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 20:41:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 23 Oct 2023 17:55:19 GMT

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 54E6 43 B
479 B 31ms
25ms Image
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=openx.com&id=a498a143-b013-c6f5-194d-2832ce9451c7&gdpr=0

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D&gdpr=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:53 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: TSG4VR5JJ8ZDT2TEHDWS
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 54E6
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZMJlIQAD_4qDUABY

43 B
61 B

35ms
30ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZMJlIQAD_4qDUABY
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

x-served-by: cache-lga21963-LGA
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1690461474.815439,VS0,VE0
x-cache: HIT
location: https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZMJlIQAD_4qDUABY
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 6889bb7a-3c15-ef46-e894-bc5059f0576e
pr-bh.ybp.yahoo.com/sync/openx/ Frame 54E6 43 B
604 B 47ms
21ms Image
image/gif 2600:1f18:4e9:5a07:2f1b:1600:f704:2559
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/6889bb7a-3c15-ef46-e894-bc5059f0576e?gdpr=0

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a07:2f1b:1600:f704:2559 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:54 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 54E6 43 B
855 B 37ms
18ms Image
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=a498a143-b013-c6f5-194d-2832ce9451c7

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:54 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: H4XX8ZFJCJCEQ2D979WF
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 54E6
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=fc4edd3e-acb9-7d0f-d943-aaa5a6a79a27&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=a7485659-1d87-4413-a256-0b6bba4fa732&ttd_puid=fc4edd3e-acb9-7d0f-d943-aaa5a6a79a27&gdpr=0&gdpr_consent=

43 B
62 B

26ms
25ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=a7485659-1d87-4413-a256-0b6bba4fa732&ttd_puid=fc4edd3e-acb9-7d0f-d943-aaa5a6a79a27&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=a7485659-1d87-4413-a256-0b6bba4fa732&ttd_puid=fc4edd3e-acb9-7d0f-d943-aaa5a6a79a27&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 335

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 54E6 170 B
188 B 58ms
38ms Image
image/png 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZDAyMTBlZjQtNjVjZS0yM2FiLWNjYTMtZjAxYzZjNDU1NDQ3

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 6996
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=7437480408642019502

35 B
250 B

16ms
12ms

Image
image/gif

35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=7437480408642019502
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:54 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
an-x-request-uuid: 1eb082c0-a897-40d6-817f-c42b33328762
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://usersync.gumgum.com/usersync?b=apn&i=7437480408642019502
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 6996
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_587908ec-ee73-4995-b782-4d4a3a2a29c3&gdpr=0&gdpr_consent=&us_privacy=
https://server.cpmstar.com/usersync.aspx?bsw_custom_parameter=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D440%26ss...
https://x.bidswitch.net/sync?dsp_id=440&ssp=gumgum2&user_id=Gnx9rIQsQWVZgNvDVOur0
https://usersync.gumgum.com/usersync?b=bsw&i=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=&gdpr_consent=&us_privacy=

35 B
250 B

11ms
10ms

Image
image/gif

35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=bsw&i=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:55 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: //usersync.gumgum.com/usersync?b=bsw&i=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=&gdpr_consent=&us_privacy=
Date: Thu, 27 Jul 2023 12:37:55 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame 6996
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobR...
https://usersync.gumgum.com/usersync?b=obn&i=ENC%28Zl7UbveI2fTkwePTarr30kKSdsVR6a296BgVANHgs_VwN8xZ6Fd_9ldtHQjaxr8Z%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_587908ec-ee73-4995-b782-4d4a3a2a29c3&obuid=ENC(Zl7UbveI2fTkwePTarr30kKSdsVR6a296BgVANHgs_VwN8xZ6Fd_9ldtHQjaxr8Z...
https://sync.outbrain.com/syncPlatform?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0
https://match.adsrvr.org/track/cmf/generic?ttd_pid=icco6m5&ttd_tpi=1&gdpr=0&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA&initiator=platform
https://sync.outbrain.com/cookie-sync?p=ttd&uid=a7485659-1d87-4413-a256-0b6bba4fa732&gdpr=0&gdpr_consent=

0
145 B

10ms
9ms

Image
text/plain

70.42.32.159
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=ttd&uid=a7485659-1d87-4413-a256-0b6bba4fa732&gdpr=0&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 70.42.32.159 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Thu, 27 Jul 2023 12:37:56 GMT
Cache-Control: no-cache
X-TraceId: 8111526f07c76023ba3a41fde87e2afe
Content-Length: 0

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:56 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://sync.outbrain.com/cookie-sync?p=ttd&uid=a7485659-1d87-4413-a256-0b6bba4fa732&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 241

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 6996
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=0b73794e-84ac-4559-be38-ba486ef79b61

35 B
250 B

13ms
11ms

Image
image/gif

35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=0b73794e-84ac-4559-be38-ba486ef79b61
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:54 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Thu, 27 Jul 2023 12:37:54 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://usersync.gumgum.com/usersync?b=opx&i=0b73794e-84ac-4559-be38-ba486ef79b61
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 6996
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=0-4ec415cb-95e1-538d-6230-0ad19cdf4f4a$ip$5.181.234.134

35 B
250 B

11ms
11ms

Image
image/gif

35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=0-4ec415cb-95e1-538d-6230-0ad19cdf4f4a$ip$5.181.234.134
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:54 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=0-4ec415cb-95e1-538d-6230-0ad19cdf4f4a$ip$5.181.234.134
Date: Thu, 27 Jul 2023 12:37:54 GMT
Connection: keep-alive
Content-Length: 127
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 6996
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=oth&i=y-gJBd7gBE2pel0A2wVK.IudZi10brvltldvlq~A

35 B
250 B

23ms
22ms

Image
image/gif

35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=oth&i=y-gJBd7gBE2pel0A2wVK.IudZi10brvltldvlq~A
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:54 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Thu, 27 Jul 2023 12:37:54 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://usersync.gumgum.com/usersync?b=oth&i=y-gJBd7gBE2pel0A2wVK.IudZi10brvltldvlq~A
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 6996
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync...
https://usersync.gumgum.com/usersync?b=vnt&i=5ffed2df-4bd8-4892-8816-399f9a8960c6

35 B
250 B

13ms
12ms

Image
image/gif

35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=5ffed2df-4bd8-4892-8816-399f9a8960c6
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:55 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=vnt&i=5ffed2df-4bd8-4892-8816-399f9a8960c6
Date: Thu, 27 Jul 2023 12:37:54 GMT
Connection: keep-alive
X-CI-RTID: 79e2326c-05b8-4714-8e9e-e2f0755a0486
Content-Length: 108
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 6996
Redirect Chain

https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
https://usersync.gumgum.com/usersync?b=snc&i=2C61E9DF353D4A649FEA6028B8CD8B11

35 B
250 B

15ms
13ms

Image
image/gif

35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=snc&i=2C61E9DF353D4A649FEA6028B8CD8B11
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:55 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Thu, 27 Jul 2023 12:37:54 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 387832510
location: https://usersync.gumgum.com/usersync?b=snc&i=2C61E9DF353D4A649FEA6028B8CD8B11
access-control-allow-origin: https://rtb.gumgum.com/
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 6996
Redirect Chain

https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
https://usersync.gumgum.com/usersync?b=dit&i=di_85715b548d114da8bc4b5

35 B
250 B

17ms
16ms

Image
image/gif

35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=dit&i=di_85715b548d114da8bc4b5
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:54 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=dit&i=di_85715b548d114da8bc4b5
date: Thu, 27 Jul 2023 12:37:53 GMT
content-type: image/gif
server: b
content-length: 0
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 6996
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=u_587908ec-ee73-4995-b782-4d4a3a2a29c3&gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://stags.bluekai.com/site/23178?id=SHqIxsER5zzdNQS3bQL1&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LO...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2U2IOFEXQ42FKI2XU6TEJZIVGM3CKFGDC
https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=SHqIxsER5zzdNQS3bQL1

35 B
250 B

11ms
11ms

Image
image/gif

35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=SHqIxsER5zzdNQS3bQL1
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:56 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:55 GMT
Content-Type: text/html; charset=utf-8
Location: https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=SHqIxsER5zzdNQS3bQL1
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 103
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 6996
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://usersync.gumgum.com/usersync?b=idi&i=d8894ba5-35bd-4833-8e9c-b10a6d4f19ce

35 B
250 B

13ms
13ms

Image
image/gif

35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=idi&i=d8894ba5-35bd-4833-8e9c-b10a6d4f19ce
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:55 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=idi&i=d8894ba5-35bd-4833-8e9c-b10a6d4f19ce
access-control-allow-origin: *
date: Thu, 27 Jul 2023 12:37:55 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 6996
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://usersync.gumgum.com/usersync?b=pln&i=Eskvj2ED94C8&ev=1&pid=558355

35 B
250 B

22ms
14ms

Image
image/gif

35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=pln&i=Eskvj2ED94C8&ev=1&pid=558355
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:54 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
location: https://usersync.gumgum.com/usersync?b=pln&i=Eskvj2ED94C8&ev=1&pid=558355
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-848647674d-5zncp
expires: -1

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 6996
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sad&i=5547321580367140260

35 B
250 B

22ms
22ms

Image
image/gif

35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=5547321580367140260
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:54 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=sad&i=5547321580367140260
date: Thu, 27 Jul 2023 12:37:53 GMT
content-length: 0

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 6996 43 B
479 B 22ms
19ms Image
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=gg.com&id=u_587908ec-ee73-4995-b782-4d4a3a2a29c3

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:54 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: V3NSNG5WS8P8JCW1SM84
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 006A 34 KB
10 KB 8ms
6ms Script
text/html 23.52.162.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-162-21.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 5dd0435e368c584ecbb528386140f8c4231178419b214c661c6e86398041749d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Thu, 27 Jul 2023 12:37:53 GMT
Content-Encoding: gzip
Last-Modified: Thu, 27 Jul 2023 07:29:37 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=67914
Connection: keep-alive
Content-Length: 10114
Expires: Fri, 28 Jul 2023 07:29:47 GMT

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 221 B
316 B 94ms
92ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: d39374264ff208a1768077de9ec2787053a15ae3a23f354538d4944defc43306

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 27 Jul 2023 12:37:54 GMT
via: 1.1 google, 1.1 google
server: Google Frontend
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: 3ce4f332db96742324444485d1da29c8
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 221

OPTIONS
H2 200 encrypt
esp.rtbhouse.com/ Frame 0
0 124ms
88ms Preflight
text/plain 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://ehfmc-com.ngontinh24.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST, GET
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-max-age: 600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
content-type: text/plain; charset=utf-8
date: Thu, 27 Jul 2023 12:37:53 GMT
server: Google Frontend
vary: Origin
via: 1.1 google, 1.1 google
x-cloud-trace-context: 5461b937c050d55c6f1fece78955b147

GET
H2 200 esp Show response
oajs.openx.net/ 85 B
322 B 61ms
31ms Fetch
application/json 34.120.107.143
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&rid=esp
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.107.143 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 143.107.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: 61083c4f5bf24ed8fb73bfe020d0535c0938ea94ac10b3f20c834b34fc8b0f74

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-9wqHhOPOr6N6xDoSQsoO3H5jGeA"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

GET
H/1.1 204 increment Show response
id5-sync.com/api/esp/ 0
333 B 87ms
87ms XHR
text/plain 141.95.33.111
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.111 , Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:53 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
411 B 87ms
87ms XHR
application/json 162.19.138.119
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb7.51.0.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

17ff52196f6d147ccc560021018e6329460d0002ad9fdb85e8f3f311af7f1029

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:53 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H3 200 style.css
s0.2mdn.net/sadbundle/12141210611375748195/300x250/ Frame 993C 2 KB
706 B 5ms
5ms Stylesheet
text/css 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

769fd12d785f48070e37293c78ef078cc26ed36270824f7911bc85b458194469

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 08:36:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 14502
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 677
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 05:38:04 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jul 2024 08:36:11 GMT

GET
H3 200 bg.jpg
s0.2mdn.net/sadbundle/12141210611375748195/300x250/images/ Frame 993C 27 KB
27 KB 7ms
7ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/images/bg.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

747c27f02ee55cea13fa3ebf8aea25c575bf0826f889d288f587ae162db74e52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 08:44:23 GMT
x-content-type-options: nosniff
age: 14010
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28124
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 05:38:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jul 2024 08:44:23 GMT

GET
H3 200 script.js Show response
s0.2mdn.net/sadbundle/12141210611375748195/300x250/ Frame 993C 3 KB
1 KB 12ms
7ms Script
application/x-javascript 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5bb2ec26db15d3fd0c38d0011abecd6304d4cdf63911ef4e9fb997726f9d43d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 02:30:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 122870
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1246
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 05:38:04 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Jul 2024 02:30:04 GMT

POST
H/1.1 200 prebid Show response
id5-sync.com/api/config/ 135 B
553 B 88ms
88ms XHR
application/json 141.95.33.111
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb7.51.0.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.111 , Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

91d9858a3fbbbbb194b1de253ee64efccf4524e1f7289276deb4be8607995973

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:53 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 08FE 52 KB
17 KB 8ms
4ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb7.51.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 21832
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 27 Jul 2023 12:37:53 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 27 Jul 2023 06:34:02 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish
X-Cache: HIT
X-Cache-Hits: 42785
X-Served-By: cache-lga21943-LGA
X-Timer: S1690461474.916537,VS0,VE0

GET
H3 200 ad_blog..swf Show response
fundingchoicesmessages.google.com/f/AGSKWxUUgFYOGboPWcTroZRa2mVo6_bD6cQPDA7uO_zxMQrus64OhsDoS5-ifw6g_IlizFGW3_a5Tnx4ap67peQ1Ye6PUKhQx-BY7j20Zk_DpuB9jOOScfqlAdklacX7aBzZG1JE3XiMecC_osxflGhP9f-Gbu56r... 54 B
109 B 52ms
45ms Script
application/javascript 2607:f8b0:4020:804::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUUgFYOGboPWcTroZRa2mVo6_bD6cQPDA7uO_zxMQrus64OhsDoS5-ifw6g_IlizFGW3_a5Tnx4ap67peQ1Ye6PUKhQx-BY7j20Zk_DpuB9jOOScfqlAdklacX7aBzZG1JE3XiMecC_osxflGhP9f-Gbu56r9LbMRzBnRWZF6b5TSMmmqzU9qop8g7U/_&ad_height=/ad_blog..swf?clickthru=/pagecall_dfp_async..zm/ads/

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.4Ubkg9b2La8.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMzxO8dNppYuBqFIZtd8x-HCTZbimg/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

367fb270ba45c1eca10f45bf0c57ce412cad7f4aebd6e4fca40811a929d67e5b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-TFWPdjdhdygBYTxRqNCXrw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
content-security-policy: script-src 'report-sample' 'nonce-TFWPdjdhdygBYTxRqNCXrw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 144 KB
50 KB 78ms
70ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.4Ubkg9b2La8.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMzxO8dNppYuBqFIZtd8x-HCTZbimg/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b9e1c2175708675cbeaa759c248ec0b406374c9cf5f01ddbc905a91a876b61a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50815
x-xss-protection: 0
server: cafe
etag: 402485459122297868
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:53 GMT

POST
H3 204 AGSKWxVePXm0lc3dLSnp97HygheM6vwdhOZQ0Klsh22k2dcSzBMfETX3hrlgn7Q3Xaf-mi1hu2owsuNw6hVnwRTUF5MM18JaFgVR2EoaW6ik4ebowSqaMVt996O_8znMFy-33AGAJY4a2A== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 46ms
41ms XHR
text/html 2607:f8b0:4020:804::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVePXm0lc3dLSnp97HygheM6vwdhOZQ0Klsh22k2dcSzBMfETX3hrlgn7Q3Xaf-mi1hu2owsuNw6hVnwRTUF5MM18JaFgVR2EoaW6ik4ebowSqaMVt996O_8znMFy-33AGAJY4a2A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-5kROEBzAW8ofbMWE99KDuA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
content-security-policy: script-src 'report-sample' 'nonce-5kROEBzAW8ofbMWE99KDuA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sync
partners.tremorhub.com/ Frame A069
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=tremor_video_dbm&google_cm&google_dbm&gdpr=0
https://partners.tremorhub.com/sync?UIGL=CAESEGi14k6xcWwJiFZZm1tFpNs&google_cver=1&gdpr=0

43 B
176 B

76ms
11ms

Image
image/gif

2600:1f18:612b:4216:545b:f017:f638:2c9a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIGL=CAESEGi14k6xcWwJiFZZm1tFpNs&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDWo8rDAhi9zdXaATAB&v=APEucNUBhsEaFPNQV0dRbVu5e4R8fS5mbPl8-J0LpVDpyB9M-dOIvwsneHfycaGKsOmdaMFFO35ApYJOXAjfgsfdOBVfqkkXR-sTeS0gsYbDLjWrdfslE5c
Protocol: H2
Server: 2600:1f18:612b:4216:545b:f017:f638:2c9a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Thu, 27 Jul 2023 12:37:54 GMT
server: nginx
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://partners.tremorhub.com/sync?UIGL=CAESEGi14k6xcWwJiFZZm1tFpNs&google_cver=1&gdpr=0
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 294
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

partner
sync.search.spotxchange.com/ Frame A069
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm&gdpr=0
https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&uid=CAESEM5zCkaiGCrDD_aDwzylZVM&google_cver=1

43 B
419 B

14ms
13ms

Image
image/gif

192.35.249.137
SPOTX-IAD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&uid=CAESEM5zCkaiGCrDD_aDwzylZVM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDWo8rDAhi9zdXaATAB&v=APEucNUBhsEaFPNQV0dRbVu5e4R8fS5mbPl8-J0LpVDpyB9M-dOIvwsneHfycaGKsOmdaMFFO35ApYJOXAjfgsfdOBVfqkkXR-sTeS0gsYbDLjWrdfslE5c
Protocol: H2
Server: 192.35.249.137 Ashburn, United States, ASN11742 (SPOTX-IAD, US),
Reverse DNS
Software: /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:54 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: false
x-fe: 586
content-length: 43

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:53 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&uid=CAESEM5zCkaiGCrDD_aDwzylZVM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 317
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A069
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1...
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=Njg2M2RkZmItMmM3YS0xMWVlLWEwMmEtMWIyYjMxYzcwMzAz

170 B
188 B

41ms
40ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=Njg2M2RkZmItMmM3YS0xMWVlLWEwMmEtMWIyYjMxYzcwMzAz

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDWo8rDAhi9zdXaATAB&v=APEucNUBhsEaFPNQV0dRbVu5e4R8fS5mbPl8-J0LpVDpyB9M-dOIvwsneHfycaGKsOmdaMFFO35ApYJOXAjfgsfdOBVfqkkXR-sTeS0gsYbDLjWrdfslE5c

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 27 Jul 2023 12:37:55 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain
location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=Njg2M2RkZmItMmM3YS0xMWVlLWEwMmEtMWIyYjMxYzcwMzAz
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: false
x-fe: 478
content-length: 0

GET
H3 200 container.html Show response
3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 9948 6 KB
3 KB 30ms
12ms Document
text/html 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: cdn.confiant-integrations.net
URL: https://cdn.confiant-integrations.net/gptprebidnative/202307190925/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:51 GMT
expires: Fri, 26 Jul 2024 12:37:51 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 track
track1.aniview.com/ Frame 5574 0
121 B 46ms
11ms Ping
text/plain 3.208.210.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://track1.aniview.com/track?d=Chrome&cou=US&cos=Windows&r=ehfmc-com.ngontinh24.com&rs=ehfmc-com.ngontinh24.com&sid=87441&t=1690461468&cip=5.181.234.134&sn=&tgt=0&osv=10&bv=115.0&brn=Chrome&wi=640&he=360&app=&AV_PUBLISHERID=632d59d7b9689f25ad20b012&test=&d64=c7863de2af982b11f8b4bfa86b816b9e&d63=c7863de2af982b11f8b4bfa86b816b9e&aafaid=&proto=https&uid=1690461468559-988491749309-001223-002-005853&cha=0.7&stagid=64243eb70d27775aa706c3e7&stplid=6464d9ee2a474d871d00c945&d35=&d36=6.2.117&cb=96621201035&d39=&d65=Control&d66=8.4.0&d74=&apppkg=&d9=0000&d37=realtime&pt=2&d66=8.4.0&d74=&stagid=64243eb70d27775aa706c3e7&stplid=6464d9ee2a474d871d00c945&cvid=6489c099a112c52ea30fa782&cpid=6489c22cda5f60fd2e0d5fc2&str=autostart&AV_WIDTH=640&AV_HEIGHT=360
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=632d59d7b9689f25ad20b012
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.208.210.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-208-210-193.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 27 Jul 2023 12:37:55 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

POST
H2 200 track
track1.aniview.com/ Frame EF23 0
122 B 39ms
10ms Ping
text/plain 3.208.210.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://track1.aniview.com/track?d=Chrome&cou=US&cos=Windows&r=ehfmc-com.ngontinh24.com&rs=ehfmc-com.ngontinh24.com&sid=3267&t=1690461468&cip=5.181.234.134&sn=&tgt=0&osv=10&bv=115.0&brn=Chrome&wi=300&he=250&app=&AV_PUBLISHERID=632d59d7b9689f25ad20b012&test=&d64=a27e9cb5a9695d9ac36ac2e7edb277f2&d63=a27e9cb5a9695d9ac36ac2e7edb277f2&aafaid=&proto=https&uid=1690461468564-992617059309-001389-007-003444&cha=0.7&stagid=&stplid=&d35=&d36=6.2.117&cb=36888081687&d39=&d65=&d66=8.2.12&d74=&apppkg=&d9=0000&d37=realtime&pt=2&d66=8.2.12&stagid=&stplid=&cvid=&cpid=&str=external&AV_WIDTH=300&AV_HEIGHT=250
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=632d59d7b9689f25ad20b012
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.208.210.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-208-210-193.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 27 Jul 2023 12:37:55 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 57F8
Redirect Chain

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&gdpr=0&redir=true
https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1kZmlwN1ZSRTJ1R2xDME44cmZQdjRRV1Zua3ZWME16V35B&gdpr=0

170 B
188 B

38ms
37ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1kZmlwN1ZSRTJ1R2xDME44cmZQdjRRV1Zua3ZWME16V35B&gdpr=0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDWo8rDAhjXy9XaATAB&v=APEucNWHV58US9C4UKjwD8pUaTKXMJedEOxMYmEImrj8af7DFm_VCK6Zt0NQyrIekpSfy1RW7OkZoCyreTB3XTa1UmE4QFauEvVzM_p4VmBACCR5vh-Mc_k

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1kZmlwN1ZSRTJ1R2xDME44cmZQdjRRV1Zua3ZWME16V35B&gdpr=0
date: Thu, 27 Jul 2023 12:37:54 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.64
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET

wGbQAlJJ
sync-tm.everesttech.net/upi/pid/ Frame 57F8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_cm&google_dbm&gdpr=0
https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESEEmOvEnXxiq03jXOfYGzEBs&google_cver=1&gdpr=0
https://1f2e7.v.fwmrm.net/ad/u?_dv=2&dsp_user_mapping=true&127719=6b8bcc71db428e0a12d1a2a376a5e79&rdU=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D1169%26userId%3d%23%7bu...
https://ads.stickyadstv.com/user-registering?dataProviderId=1169&userId=e5be0_7260476750273148429&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=stickyads&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ads.stickyadstv.com/user-registering?dataProviderId=208&userId=a7485659-1d87-4413-a256-0b6bba4fa732&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/stv?gdpr=0&gdpr_consent=
https://ads.stickyadstv.com/user-registering?dataProviderId=817&userId=AACNS07JhMoAACkhYs-_rg&gdpr=0
https://pr-bh.ybp.yahoo.com/sync/stickyads/6b8bcc71db428e0a12d1a2a376a5e79?gdpr=0&gdpr_consent=
https://ads.stickyadstv.com/user-registering?dataProviderId=199&userId=y-pwbkk5lE2oMvJZOdlUhjXMyE2sFIJVnp72.7xSNY~A
https://cm.adgrx.com/bridge?AG_PID=freewheel&AG_SETCOOKIE
https://cm.adgrx.com/bridge.gif?AG_PID=freewheel
https://ads.stickyadstv.com/user-registering?dataProviderId=561&userId=6abd5532-2c7a-11ee-9042-8203411c076b
https://pixel-sync.sitescout.com/dmp/pixelSync?nid=103&gdpr=0&gdpr_consent=
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=103&gdpr=0&gdpr_consent=
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=2158e5d2-ac31-454d-af6e-d48bb416c5f4-64c26527-5553&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=2158e5d2-ac31-454d-af6e-d48bb416c5f4-64c26527-5553&partner_url=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataPr...
https://ads.stickyadstv.com/user-registering?dataProviderId=721&userId=2158e5d2-ac31-454d-af6e-d48bb416c5f4-64c26527-5553&gdpr=0&gdpr_consent=
https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D1580%26userId%3D$UID&gdpr=0&gdpr_consent=
https://ads.stickyadstv.com/user-registering?dataProviderId=1580&userId=1562212822517953672969
https://sync-tm.everesttech.net/upi/pid/wGbQAlJJ?gdpr=0&gdpr_consent=&redir=https://ads.stickyadstv.com/user-registering?dataProviderId=187&userId=${TM_USER_ID}&gdpr=0&gdpr_consent=

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 57F8
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=11
https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=NmI4YmNjNzFkYjQyOGUwYTEyZDFhMmEzNzZhNWU3OQ==&gdpr=0&gdpr_consent=

170 B
188 B

49ms
48ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=NmI4YmNjNzFkYjQyOGUwYTEyZDFhMmEzNzZhNWU3OQ==&gdpr=0&gdpr_consent=

Requested by

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:54 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=NmI4YmNjNzFkYjQyOGUwYTEyZDFhMmEzNzZhNWU3OQ==&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1690461474629041-133

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CBC0
Redirect Chain

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&gdpr=0&redir=true
https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1kZmlwN1ZSRTJ1R2xDME44cmZQdjRRV1Zua3ZWME16V35B&gdpr=0

170 B
188 B

39ms
38ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1kZmlwN1ZSRTJ1R2xDME44cmZQdjRRV1Zua3ZWME16V35B&gdpr=0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDWo8rDAhi9zdXaATAB&v=APEucNXgDoRh4blSGEp28sYPvokacm8DT7lalaVt4DYQ3FbKOeCqahILMDTIEuu-xu1JoAHj6ajkmbsplkBEffDm-WCpau_224s_C5lse7uqY9Faj249KP0

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1kZmlwN1ZSRTJ1R2xDME44cmZQdjRRV1Zua3ZWME16V35B&gdpr=0
date: Thu, 27 Jul 2023 12:37:54 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.64
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

bridge
cm.adgrx.com/ Frame CBC0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_cm&google_dbm&gdpr=0
https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESEEmOvEnXxiq03jXOfYGzEBs&google_cver=1&gdpr=0
https://1f2e7.v.fwmrm.net/ad/u?_dv=2&dsp_user_mapping=true&127719=6b8bcc71db428e0a12d1a2a376a5e79&rdU=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D1169%26userId%3d%23%7bu...
https://ads.stickyadstv.com/user-registering?dataProviderId=1169&userId=e5a2e_7260476750273148545&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/stv?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/stv?gdpr=0&gdpr_consent=&_bee_ppp=1
https://ads.stickyadstv.com/user-registering?dataProviderId=817&userId=AACNS07JhMoAACkhYs-_rg&gdpr=0
https://pr-bh.ybp.yahoo.com/sync/stickyads/6b8bcc71db428e0a12d1a2a376a5e79?gdpr=0&gdpr_consent=
https://ads.stickyadstv.com/user-registering?dataProviderId=199&userId=y-pwbkk5lE2oMvJZOdlUhjXMyE2sFIJVnp72.7xSNY~A
https://pm.w55c.net/ping_match.gif?st=FREEWHEEL&rurl=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D593&userId=_wfivefivec_
https://ads.stickyadstv.com/user-registering?dataProviderId=593&userId=rDiXmOQ61Qp0fC5
https://cms.quantserve.com/pixel/p-wLsaAfCW5Mb6X.gif?idmatch=0&gdpr=0&gdpr_consent=&us_privacy=
https://ads.stickyadstv.com/user-registering?dataProviderId=1588&gdpr=0&userId=hbvVBYW6hASevIFWg-ubUYC50AKeu4AAg755iWUo
https://cm.adgrx.com/bridge?AG_PID=freewheel&AG_SETCOOKIE&gdpr=0

43 B
415 B

4ms
4ms

Image
image/gif

173.231.178.83
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adgrx.com/bridge?AG_PID=freewheel&AG_SETCOOKIE&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDWo8rDAhi9zdXaATAB&v=APEucNXgDoRh4blSGEp28sYPvokacm8DT7lalaVt4DYQ3FbKOeCqahILMDTIEuu-xu1JoAHj6ajkmbsplkBEffDm-WCpau_224s_C5lse7uqY9Faj249KP0
Protocol: H2
Server: 173.231.178.83 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: Cowboy /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
server: Cowboy
content-type: image/gif
p3p: CP="NOI OTC OTP OUR NOR"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, proxy-revalidate
x-realserver-nx: lga-delivery-3
content-length: 43
expires: Thu, 23 Sep 2004 17:42:04 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:58 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://cm.adgrx.com/bridge?AG_PID=freewheel&AG_SETCOOKIE&gdpr=0
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1690461478653003-105

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CBC0
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=11
https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=NmI4YmNjNzFkYjQyOGUwYTEyZDFhMmEzNzZhNWU3OQ==&gdpr=0&gdpr_consent=

170 B
188 B

49ms
48ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=NmI4YmNjNzFkYjQyOGUwYTEyZDFhMmEzNzZhNWU3OQ==&gdpr=0&gdpr_consent=

Requested by

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:54 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=NmI4YmNjNzFkYjQyOGUwYTEyZDFhMmEzNzZhNWU3OQ==&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1690461474624058-294

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 79B6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_dbm&gdpr=0
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEDPPSiBHXpGyRvDPwf6TTCo&gdpr=0&google_cver=1

43 B
416 B

34ms
15ms

Image
image/gif

23.105.12.136
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEDPPSiBHXpGyRvDPwf6TTCo&gdpr=0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP_1exD12n0Y98yh5gEwAQ&v=APEucNX4tyTqdMYnIvlI9PG2HUV_sHAs9mR-p5yK8ZBugwtge-P4K-Y3jpRjG2tttROUQbTViqJU1mv2bFR5VW2X_YiIMWvMX4ozH7txhNuuxjCjEpBwZY4
Protocol: HTTP/1.1
Server: 23.105.12.136 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEDPPSiBHXpGyRvDPwf6TTCo&gdpr=0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 327
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 79B6
Redirect Chain

https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=GOOGLE_HOSTED_PI&gdpr=0&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_hm...
https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_hm=NTU0NzMyMTU4MDM2NzE0MDI2MA==&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEDPPSiBHXpGyRvDPwf6TTCo&gdpr=0&gdpr_consent=&google_cver=1

43 B
416 B

13ms
12ms

Image
image/gif

23.105.12.136
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEDPPSiBHXpGyRvDPwf6TTCo&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP_1exD12n0Y98yh5gEwAQ&v=APEucNX4tyTqdMYnIvlI9PG2HUV_sHAs9mR-p5yK8ZBugwtge-P4K-Y3jpRjG2tttROUQbTViqJU1mv2bFR5VW2X_YiIMWvMX4ozH7txhNuuxjCjEpBwZY4
Protocol: HTTP/1.1
Server: 23.105.12.136 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEDPPSiBHXpGyRvDPwf6TTCo&gdpr=0&gdpr_consent=&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 345
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame F5AB 0
22 B 26ms
24ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6WcRCYwOyiAxiqgsPjATAB&v=APEucNVP76EiM4OXOSCJvq1_XMqh094q04FiOGg8LxGyInA3bBULQJgCrwqHryNy6eOGB6U-mfzLIQHMhV-R3GDdbQbkNhjXZsU8xkvWLesMTugVGTy2_Rg

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:54 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 6763 85 KB
29 KB 78ms
77ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b5c05892bdce212e19d0503253b600faaeedca47fa2db97964d412c8c11934e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:54 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29781
x-xss-protection: 0
server: cafe
etag: 4315658989838864570
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:54 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6763 42 B
65 B 44ms
43ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Dzy_bnrti7nvavFWi463c89_RqgFXOacGk5mQclLxUDkC0z8FTuqMwdBM4n5mrJQThsyUJSoPdd5TiYgMJYqJsIFS1gKcgCyCuHF55fPouLahtURQ

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6763 0
22 B 47ms
42ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=332138546669845255&x=1&ct=76

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame 6763 3 KB
1 KB 17ms
12ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/window_focus_fy2021.js

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:40:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57461
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:40:13 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame 6763 20 KB
8 KB 18ms
13ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ecb4fb492aee0a820dfc4a395fb80e2ac2e864bbf38aa1ae28d6d70fb9e6da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78226
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 6763 0
0 56ms
51ms Image
text/html 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQBvjeVRgyo7Q_h5-LtmoIOlY6ZWJ-0nnaRc8-KN_flAjyLWo4Ypslqw4SqsTyvpF2NUuK_l4T-5B3-OjiX5m4zQFpyrw
Requested by: Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6763 179 KB
56 KB 47ms
42ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f294f48a5bc171da79776780d32c77ae3323a508cb595a56f116ecb7578a8e7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57383
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690198756579870"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:54 GMT

GET
H2 200 pixel
protected-by.clarium.io/ Frame 6763 68 B
244 B 15ms
10ms Image
image/png 54.86.168.92
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_T09oM2JUcnRiMm5IeU93R2syTFRPNVNXbzU0LzIzNjcyNTUwMTA6NzI4eDkw&v=5&s=v31h6blm3d3&id=eyJkZnAiOnsiYWQiOjI4MTkyMjk2LCJjIjpudWxsLCJsIjowLCJvIjoyMzY3MjU1MDEwLCJBIjoiLzIwODQyNTc2LDExNjUxODMwMS9JTjQ0Tk0vSU40NE5NLURESC5JIiwieSI6MTIxNzU5LCJjbyI6MCwicyI6Im1tdC04YWMzNjdiNC0xZmMxLTRlOWUtOTBhOC0yOTZhYTAwMzgxMGVfMV8xX2FkIn19&cb=1055651&h=ehfmc-com.ngontinh24.com&d=eyJ3aCI6IlQwOW9NMkpVY25SaU1tNUllVTkzUjJzeVRGUlBOVk5YYnpVMEx6SXpOamN5TlRVd01UQTZOekk0ZURrdyIsIndkIjp7Im8iOjIzNjcyNTUwMTAsInciOiI3MjgiLCJoIjoiOTAifSwid3IiOjJ9
Requested by: Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.86.168.92 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-86-168-92.compute-1.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/png
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
cache-control: no-store, no-cache, must-revalidate, max-age=0
server: nginx/1.18.0 (Ubuntu)
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame ADD9 42 B
64 B 59ms
58ms Fetch
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstHQwdMeHW635gePWJB37gdq_V384Hjd9bN9iO00R-RPal356CKFpsLglpHNcE32VLnCIOCs6SFKlEdyn11K9xxrGI0z3gG_MWdVVcRtPq6AJWSUHNgXIJOWJ5NgSIrrw8m_pUIpbBKIQ&sai=AMfl-YSreMFAUj-m3QuHdoq2yTSkyiwcHJInIhlAHpKOIw9tO4D5WvUBeijB-YJBsSneDXmn983Je2lavxY4VFzPTHcGZ5Vo5JAbEbwrbKC7e91ClizpZKjUHex1QtM&sig=Cg0ArKJSzM599bPssEUfEAE&cid=CAQSOwBpAlJWWyTklgCkEywftECmZYrlhJJYnD3RJVUFPHtNTJEE3xNdhHNKUxKsqKIfF4eWJ7K0NR6PG3joGAE&id=lidar2&mcvt=1511&p=0,0,280,336&mtos=1511,1511,1511,1511,1511&tos=1511,0,0,0,0&v=20230724&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3855717033&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1690461469723&rpt=2924&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CF6D
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGEpBlebo3w4_Jv4j2GDzlQeUL9LgGRkLboM_5wasOX...

170 B
188 B

39ms
39ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGEpBlebo3w4_Jv4j2GDzlQeUL9LgGRkLboM_5wasOXj3qrofdG5tEtiZUtvu2ELeHL7t2cy8v-WL1xS4K0rdVFP35fr4NksLs8

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:54 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-784-g0c0b2cf#rel-ec2-master i-0378fef7ed0d1fc56@us-east-1d@dxedge-app-us-east-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGEpBlebo3w4_Jv4j2GDzlQeUL9LgGRkLboM_5wasOXj3qrofdG5tEtiZUtvu2ELeHL7t2cy8v-WL1xS4K0rdVFP35fr4NksLs8
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CF6D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wk1KbElRQURfNHFEVUFCWQ==&google_gid=CAESEBO-kX1m54gvrbUJSMImTXs&google_cver=1&google_push=AaAOQGHdlGLl1JNhEJQj6aQYrtJK_RW4_X...

170 B
188 B

38ms
38ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wk1KbElRQURfNHFEVUFCWQ==&google_gid=CAESEBO-kX1m54gvrbUJSMImTXs&google_cver=1&google_push=AaAOQGHdlGLl1JNhEJQj6aQYrtJK_RW4_XOLt5gY84maA-GPwtbtXamIYkLhTHjABJRLYB6ukB8rJxBrQvZIjobT_bSXp448kzDP8g

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-lga21963-LGA
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1690461474.260476,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wk1KbElRQURfNHFEVUFCWQ==&google_gid=CAESEBO-kX1m54gvrbUJSMImTXs&google_cver=1&google_push=AaAOQGHdlGLl1JNhEJQj6aQYrtJK_RW4_XOLt5gY84maA-GPwtbtXamIYkLhTHjABJRLYB6ukB8rJxBrQvZIjobT_bSXp448kzDP8g
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CF6D
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESEGxvXSF98Q3DnE9CWVBjHFc&google_cver=1&google_push=AaAOQGHPfgWYwYTNYUrt6P-UMtK59VkIsu1mwe8S3sk3-hgOa7Opw-XjnGK_BCdRi8Jgt5IPZrDJ4MgU0z2PvN8uO9rSFsr6r4fguA
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==

170 B
188 B

37ms
36ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==
date: Thu, 27 Jul 2023 12:37:54 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CF6D
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEGiXZycTwgahC91LEZIk3-Y&google_cver=1&google_push=AaAOQGEcaY_0E6SU4uJtFIBqjR1AfdHHqE6zwj8vMZledlSF2hEd98Yw0gRYMDXXnTBS9D1lzCqeE0AE...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjYwNjMxMTM0Nzc1NTgwNTEwNA&google_push=AaAOQGEcaY_0E6SU4uJtFIBqjR1AfdHHqE6zwj8vMZledlSF2hEd98Yw0gRYMDXXnTBS9D1lzCqeE0...

170 B
188 B

40ms
39ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjYwNjMxMTM0Nzc1NTgwNTEwNA&google_push=AaAOQGEcaY_0E6SU4uJtFIBqjR1AfdHHqE6zwj8vMZledlSF2hEd98Yw0gRYMDXXnTBS9D1lzCqeE0AEh3rxzOGe1ly1q8YOgk1qQA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjYwNjMxMTM0Nzc1NTgwNTEwNA&google_push=AaAOQGEcaY_0E6SU4uJtFIBqjR1AfdHHqE6zwj8vMZledlSF2hEd98Yw0gRYMDXXnTBS9D1lzCqeE0AEh3rxzOGe1ly1q8YOgk1qQA
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CF6D
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEJYsuHs6s1O74JLGHus4zP8&google_cver=1&google_push=AaAOQGE--yz-CIaR4ygK1jE6dFTIJHInoYsgyp3yWigb74IOqZOIg0XqCEebzORrfnnAjaRNcCJ4Krmla6Mw50Q...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGE--yz-CIaR4ygK1jE6dFTIJHInoYsgyp3yWigb74IOqZOIg0XqCEebzORrfnnAjaRNcCJ4Krmla6Mw50...

170 B
188 B

39ms
39ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGE--yz-CIaR4ygK1jE6dFTIJHInoYsgyp3yWigb74IOqZOIg0XqCEebzORrfnnAjaRNcCJ4Krmla6Mw50Qe7mW4Y_U9sgQbjw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGE--yz-CIaR4ygK1jE6dFTIJHInoYsgyp3yWigb74IOqZOIg0XqCEebzORrfnnAjaRNcCJ4Krmla6Mw50Qe7mW4Y_U9sgQbjw
Date: Thu, 27 Jul 2023 12:37:54 GMT
Connection: keep-alive
Content-Length: 244
Content-Type: text/html; charset=utf-8

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame CF6D 0
12 B 45ms
44ms Image
text/html 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Iym8KN5TjtqXd6K6uvD1tDEHih0tOFDRh7jla5dnzBEyjXZmFC9kH9go0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:54 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 6F11 22 KB
8 KB 34ms
14ms Document
text/html 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 56320
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:59:14 GMT
expires: Thu, 25 Jul 2024 20:59:14 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 5EF1
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=atm&i=ZMJlIQAD_4qDUABY&gdpr=0&gdpr_consent=

35 B
250 B

25ms
11ms

Document
image/gif

35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=atm&i=ZMJlIQAD_4qDUABY&gdpr=0&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 27 Jul 2023 12:37:54 GMT
Expires: 0
Pragma: no-cache

Redirect headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Thu, 27 Jul 2023 12:37:54 GMT
location: https://usersync.gumgum.com/usersync?b=atm&i=ZMJlIQAD_4qDUABY&gdpr=0&gdpr_consent=
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-lga21963-LGA
x-timer: S1690461474.317785,VS0,VE0

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame 3DF0 170 B
188 B 54ms
40ms Document
image/png 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV81ODc5MDhlYy1lZTczLTQ5OTUtYjc4Mi00ZDRhM2EyYTI5YzM=&gdpr=0&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:54 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 1110 15 KB
6 KB 74ms
58ms Document
text/html 184.50.204.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.50.204.192 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-50-204-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 94061a925c5d84bf776554ac894020c407a9a4c89b979d538de3cf45591fe423

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=34768
content-encoding: gzip
content-length: 5606
content-type: text/html
date: Thu, 27 Jul 2023 12:37:54 GMT
expires: Thu, 27 Jul 2023 22:17:22 GMT
last-modified: Tue, 11 Jul 2023 09:39:35 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 64CF
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=ttd&i=a7485659-1d87-4413-a256-0b6bba4fa732

35 B
250 B

36ms
13ms

Document
image/gif

35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=ttd&i=a7485659-1d87-4413-a256-0b6bba4fa732
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 27 Jul 2023 12:37:54 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: private,no-cache, must-revalidate
content-length: 193
content-type: text/html
date: Thu, 27 Jul 2023 12:37:54 GMT
location: https://usersync.gumgum.com/usersync?b=ttd&i=a7485659-1d87-4413-a256-0b6bba4fa732
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame E039
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://usersync.gumgum.com/usersync?b=sus&i=ZMJlIsCo8YQAAMY4GvsAAAAA

35 B
250 B

13ms
13ms

Document
image/gif

35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=sus&i=ZMJlIsCo8YQAAMY4GvsAAAAA
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 27 Jul 2023 12:37:58 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Date: Thu, 27 Jul 2023 12:37:58 GMT
Location: https://usersync.gumgum.com/usersync?b=sus&i=ZMJlIsCo8YQAAMY4GvsAAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
Server: nginx
X-SO-Ads-Time: 3324
X-SO-Cluster-ID: 0
X-SO-HostName: m-ad38.dc4p.scaleout.jp
X-SO-IP: 5.181.234.134
X-SO-Key: ZMJlIsCo8YQAAMY4GvsAAAAA
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":0,"gdpr":false,"ipv4":"5.181.234.134","key":"ZMJlIsCo8YQAAMY4GvsAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad38"}
X-SO-LB-Hostname: m-tgng32.dc4p.scaleout.jp
X-SO-Upstream-ID: m-ad38

GET
H/1.1 204
No Content gumgum
cs.admanmedia.com/sync/ Frame 7656 0
0 53ms
6ms Document
text/plain 80.77.87.166
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://cs.admanmedia.com/sync/gumgum?puid=u_587908ec-ee73-4995-b782-4d4a3a2a29c3&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Daad%26i%3D%5BDSP_USER_ID%5D&gdpr=0&gdpr_consent=&ccpa=

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

80.77.87.166 Clifton, United States, ASN46636 (NATCOWEB, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: keep-alive
Date: Thu, 27 Jul 2023 12:37:54 GMT
Server: nginx
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 694A 0
25 B 57ms
49ms Image
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C-1kLHGXCZLyNKs7whAaWuKPYCt2XtNJwyMyag6QRx7Xpi90CEAEgjdXeJGDJxqmLwKTYD6AByKrF1gPIAQmoAwHIA8sEqgTxAU_Qn_U8Lz1YznY8f4tdrjaTqPxZa8lsXcBtY-FuABllEeXYt9tPKbkKpr2qOhsy5RBEo8DAxdE6q-5FpDcp-EFXqxuQ1LbXYp2SImxCLdjgMNyKjyq3uPWCF-kqheMLgUJQxkOw5PyWc64tWcdF2hvpEPYeCKJqpQ3SRELJO7F1lKs5IqbzgiJbq3qx0xMFbL6m2S6_YO5FIA6Q0LjmJHqg7n37a5K73tK4lKIRPsjTz6WTRsGqhnZwAJSMXvWtFTmBSpf6ffDk4AB_TtGXgcjzqmDP2HmMZn0O65G7lwlqjtBC6m4_4K2Khb5z55eCaibABL-c_pr5A5IFBAgEGAGSBQQIBRgEoAYugAfWj_CLAagH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEENazGdIIFAiAYRABGB8yAooCOgKAQEi9_cE6gAoByAsBmAzSsaCN7AO4E6EE2BMO0BUBgBcBshccChoIABIUcHViLTcxMDk4NjQyNTkzNDg5MzgYAA&sigh=tfG50kG_m5Q&uach_m=[UACH]&cid=CAQSOwBpAlJWg0FEZZTQ3MagvyLwX1u0NWW7xvyTFRUqkxqRl4M0ZxD80f0rpQJWfNm1sz21mjgt_C8yEP2NGAE&template_id=545&cbvp=2&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 27 Jul 2023 12:37:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 32B8 22 KB
8 KB 16ms
15ms Document
text/html 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 56320
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:59:14 GMT
expires: Thu, 25 Jul 2024 20:59:14 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H/1.1 200 1013.json Show response
id5-sync.com/g/v2/ 595 B
1 KB 95ms
91ms XHR
application/json 141.95.33.111
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/1013.json

Requested by

Host: monu.delivery
URL: https://monu.delivery/sitesplit/d3/smartzones/0.1.1/f/d/d82422-8575-448e-84fe-fa092518ca2d.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.111 , Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

5d2861d42809234618dc34dd968ce438e0153f3adb868a882645829add913586

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:53 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
p3p: CP="CAO PSA OUR"
access-control-allow-credentials: true

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E44D 42 B
64 B 58ms
51ms Fetch
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuNcaA6sULXJBmnXfSoWW7W4ZDjft4bd_tjpj0KRpGirBE5X0ueT4ETGfqiOvVD93KtbdytOzZUT7xZNQ1GZxJ1BKsSkKQRhApsHjItwmw1rM44jYWjg0p4catBNVX2veLx9SKeH34-Rw&sai=AMfl-YQ6fNkWoyrPZ9j6NBGrrIcfyXexP_iqtZtbBbpTLoLjgKexwgHOF_l-hE3cI_4pkl4L4pAA_t5r4qSqukzsJXJMIX938No2Ijc&sig=Cg0ArKJSzPzoTUThd5EUEAE&cid=CAQSKQBpAlJWzY0bIBzU6w2_RbHAj2CbW_j7xPxXhX1muXWicelitmPW9lwTGAE&id=lidar2&mcvt=1476&p=0,0,250,300&mtos=1476,1476,1476,1476,1476&tos=1476,0,0,0,0&v=20230724&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3855717033&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1690461469185&rpt=3581&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 235 B
618 B 48ms
44ms XHR
application/json 54.160.214.90
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.160.214.90 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-160-214-90.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 8a75abc9007ce78273922cfb7a5090d621831027efe950b8484864ac10aef2f8

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: no-cache
x-server: 10.40.1.207
access-control-allow-credentials: true
content-length: 235
expires: 0

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 694A 33 KB
33 KB 9ms
0ms Font
font/woff2 2607:f8b0:4006:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2003 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 04:45:59 GMT
x-content-type-options: nosniff
age: 546715
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 20 Jul 2024 04:45:59 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0ED6 0
22 B 43ms
43ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7704471699950&version=m202306200101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0ED6 0
22 B 44ms
43ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7704471699950&version=m202306200101&ct=76&x=1&cor=17570431935271586000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 0ED6 89 KB
37 KB 60ms
59ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BM2_-8sdiV7bhdF6fLeS2da7OELhHPiIeKDkTiX1VZNN27lDu8VVQx0_IONDrl-L7R7mI3iF_x0TeJG4vAF2swdnWmmw&cry=1&dbm_d=AKAmf-ArQjOvA1mC_5BVNvuJza0oAKSdh_HB5u73uM-MQwHUD5t54HC4jIEEKTe9DPjbOmeLwVwJwm3m5yrCbCQyxAjV-XWJgKY_s_9Psn-MGIWokvbroZL-r1LLA6lKRJ1guxXnw3q1WZA_dySK5STuxch116MheaKdw-xJR5BA8qiHDX-jRsf2IL51HJ0hr6TOXJbKLnSDpSCEgfUM714alypjILggOzJaEVn15B2D_uRYkQen_Z7YbNOWM-G5ZXZEsozc-Vj0zZQigxApjy4-tWezMkYZcNERV7BhpoCnSqcwzE6ugWtjRIalNR9DdvOaQ29EoCyO9N5FBewXqEPd32GdPHvd8hOSnHibijHK_YjxGINmRPikofEKdx3STq8Jl7p0lN8VqVVcsJppXihhnsFqCZffBkah6c7r-hF6ey7RgMFAL5-R2h0ORZBUZEQn64mH1FvtfKdUGBSGkv-E8dK3cnFCYi5AbPjpZ2tzytm5o4A2D4qFvSEK10Elg_33V8pEt79iz_WcEEQ6cLmFRzx8ssEmVZgZqGH2blCfropl-kquYVXSNxBuPZF4Dxihvq-7lV9b9iG4NpJ3Y5N9li5S1h_0gFL_BPw037YDu6Gvm6vYUFaCf8zQ5neVDpQ99n9Hi8B970CHZcYoReDoY4PaRON94MCnn2HunPBhc_Ik_FLRLJFcLMExR2DgDevL68rqvmT0CyF19s-4tT2AH4y42po6bKXZCmooVkQCUQ9T4kJh5JK4r9IXqW6eGPsRScTj3juo8czU6eammAsjm2MgRk5GMjrOALbj6L6gNyRtBBbm6sF6E5ts034XWea5EJJIxHOMpKjRjZiV3QQ29aLIaLB9QV9oE_6KsVJrTaeY_aS1uYd7tiUtwnfZasbcp17Yk-QPY6hHE08yUY4zAcA8YqNMPMTfwWtUpGtrslCvNCdDxvWBJ6AqrzFaK6ihBVBpFG746wA5AbYq5QaUXQp9fiOD-B-eOsNGaTEpO9eIVtijMDo9VI9EaYf8xAiHfWwJCrC5Z22OyfJ_AXnNt3I5UHbG8FcRSZ46Fp75jBWe52ObWGXKT3sr0WseJhH5yiP129Lgvon5Ot74gca5TaThHwrBpojxssHAYiMR3QvkbEll-wxkYDahMpZxPCppdv9uQ5N2qWJP0KThwUz-I1I2rrszoCWouzYOJssw3CnJlVjLOmSAhUlJtimhwpyiVnhDtsSVkdseg-prsJH39bCAuY_6i9XOSwh86uTCVMfd26-_i0rI-Cyb3FQaG6ERJHlnk9WhVG5uGbFXrTfcMXoLcfT3gKi5iTGzVz-yW4uB_cVlFQF34993Id6KL3-oDmcee6bgvjhosteyrShkbf97cbQ_7-36qsowZ577sSCVWovCKPDVy9vO0ZqBG6jvqQky986Kj6q82IKhiBa_iv9O0m-WlEcBz3vGzkWqrjubH_aBxj3MtpVD6ABUZShR8rzj8q-xeO5j65k_bGQ7zc06v8_qD2Z8SJm30xKsld1VWwIvtyM5DCDLvUNw3jXDlyrhsZCxkizkyUi0rH1srV8j_VL2hGJJahXI7pT4t0EY1ArLCBgulboDSuIDG1QwZFwdZfGqsJFHn_3mfikZ2pdvvas3ITV_W_m6RvilTRhrwWjEr3JD9GghV6tU15yIMt2PGSoT_1YO5k7uOZg-5_QJ_3eY31xAi_BCxNe-3O14BtcDddIW1Y2S--6887c6bcll-VImbIlOd6G7LWCYOyX7t2pnnIdGG5mVQ-wnjUbBBnnv_F-WGfnoQJxmOlEBzW-OUTpit5wDuIpF9JYDoNQA-76ba54d5zW-0vjL6-yrU9ATeKpyH6vLnwnS1CcTiysU2_znbSUsjtuNLHXAZ_wVbn1_aVF67eTg_RyaVwyb7vecn3IdJWq5ub3LhiOhQ669PVmHS4RqETbNZ1HVwURPjR-5IHBsmvx1dx8UkT2iOGx8wI7bmT26D-dwkCGFC80MFlECHqYqD8QSF-oYQ1NEc3GI9TwJsoO0NZBGxjC49mWIfxtpWpVkP9dOdVb8MplBNH1FS0uUddGc2Bbr1t5kcmzobrBbpwpcd_50DBMypwuCWnliqyAMQfhwndVU8-dqzOmRZpXDo1UH-Hzv6b-yoL4KwYDwWvoanIbPlQBjXSY-9YHbG0WDrxcIeVoBUqvAosEXZFytB9y3TRp0i9dFiTK5XH91u9T-M3K3mnDtXuFOCUCTm5Jch6fUqCbCbxo1lmh4gpY3l2jHHkDtk2wdkpAi4FlP3Tb4gVx1fG-qww_bR_QIiTVHjjmxvkWBCgG0E_SZQQIfjaPRdzZgGOWY1_l2mgxmHZC3arji3MohNIaKSmfcESVLcwiWiSRQPEomAZSgovBNg6zGiVl5Q-WnYd8U8LYC7pIl2iZBFNUNO3f77jfhTaYYU-kuWphP0D4f4pp8qqLMQ3rWV71wdsViOTRVU3oV--npDQaY1LVt0ymx8UivCXHD03bg1i6XMQ5qdhOzTiAD0aPqgWsz7M70qU5OWof45s1cWyWtZ_2GjysT0i_bYgIKPe9YT9NsPjBt63_W24uTUySQw0JQj0xKP29E8qOzWH9NmG9bfk1beylc9jbX8zlf5MQe7RFdjOlTgF31SEGcQqaXX1yNqlYp5VOeBoPQ3yi9CSn6LKUA2SlKPlfT51DTlcWUiJ9x6SpdBOq1kckWjHvalccsABl0ycjRNaaqbrbTFD4-C0eU3Lby8BqTVMCAs5vgj1SpY-B7_1--xvFvdPVgJUIHVe95VP_0PE57EF7Pf2GR9ml62Q_drslDkBn_9SPr7wPcVm0Lgrizat4V2CWbWBVZz6Ick6q9SfwcMlt3U4Tl5LI8j2VyLvpldxScY-U6NJnVN_Zb_8wdbGndgvHmhfyM8dHSqWvrVM8UqWGOL58EEFNvEsQtNGuQTiC1AHJPagpvf2W0Bs-HSlm5oholwF2tPJSrmPWJdHeRN7VPcHgFbjvsn52E8NLnvvQbakxF3nkI20cPYG8eH82eOzuMjRS1TMpM2fNNhL7-ifU627EagHoEuFxUi3uP5xd2Kd-s2Sr-y0N52P9sHMob8dXbjyKSxllGiPYQHctUDka6Lixwz5OPOL8gXPWEtEKYfWepj2IH6NvPCJJj5RTR7qEu0A2kxzT4yp_dbuEVyzfTovf9lkUYacPsBZW8W7Ieifms7R9BMyfzoGBstHul2z2JvNcEoz07f64FQfyN_gXFP4w_c6N-COOGNfDkgfY-CCNuG8jiGlwqL8wcFm21kT1goL-5mmi9AgQh08uBZmIoiT5QiVz1mDN66_ZwC2eyr1vqbjjUtYJyxvjWTe_SEr1OTzr4GUFNYFiAaVjQf09Qi6gLINBFwU_5yy-XDRw3Wvgnu8VZBrf2193K&cid=CAQSOwBpAlJWP9xjzqrT4AI-PCOW-d6AivBDaQ6AQkQC4k64Y2UOL4xMteFtDjEl4LI8PqhtCwhLW6R3G8KqGAE&dc_eid=31076402&dv3_ver=m202306200101&rfl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ds=l&xdt=1&iif=1&cor=17570431935271586000&adk=3434392781&idt=62&cac=0&dtd=206

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a2ec872c2f9abedf5e03d3b4efc2db24ef7d01ace521d1df6f1e022e1f5f00cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37766
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 44B4 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 30e4365e4fc7ee4b86d192257e953f6a9df2f69c08ca1dd4c03d2468eb30e04a

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 pixel;r=2117409629;labels=Lifestyles.f1wmpn59.*_ngontinh24_com;rf=0;a=p-00TsOkvHvnsZU;url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F;ref=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F;uht=2;fpan=1;fpa=P0...
pixel.quantserve.com/ Frame F52F 35 B
373 B 14ms
12ms Image
image/gif 2620:116:800b:21:1456:d0e1:7db4:a56b
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=2117409629;labels=Lifestyles.f1wmpn59.*_ngontinh24_com;rf=0;a=p-00TsOkvHvnsZU;url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F;ref=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F;uht=2;fpan=1;fpa=P0-158683139-1690461471851;pbc=;ns=1;ce=1;qjs=1;qv=c818c8ec-20230509111053;cm=;gdpr=0;us_privacy=1---;d=ngontinh24.com;dst=0;et=1690461473696;tzo=0;ogl=;ses=0e664118-a8fe-46d9-a328-4f11b43e9dab;mdl=

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800b:21:1456:d0e1:7db4:a56b , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D8C1 0
22 B 41ms
40ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8828823692926&version=m202307240101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D8C1 0
22 B 43ms
42ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8828823692926&version=m202307240101&ct=76&x=1&cor=4446582534515229000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D8C1 88 KB
36 KB 47ms
46ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BjtPdkCqHOQeAPIepUqpWScVX1V94foJVocGVRPub2uoy-6joQMvmPzn78U014NKZ0LMr8IkYNfyplq_mxmmHpRC5raA&cry=1&dbm_d=AKAmf-DmWWcfFi4wg2SheEq9Bd0Z0oENxDMfYlBCUhWFT6QZ0ueICcLMMru8SbW5OhgsptbbiS-imZB6jqfaLxOZVCK1u8y6rSMOpgmkGvRQdFt8bGybQhkx2Nstu2Q_t6PIe9xoxy-PeTGc4Veg4z6XXnlAmm3yC1o45xpNzFfALeZqbAJ7_ZlTHcp0mu5b93pOjgoBvZ-Tk13rIYF2TqaUqjCHC0CCxVBMf2p6QXVwlz_teIOWyGjWw2ubLswXtxOcenka8vqr-SMWS7J0NtsP6lByBe4WshxUcueAVWQl2Q6IC1nJyA7rjMy6vB72vZL2WfDG6T0io9ZT378YufWuKyl-NaXgH6Qfwf5gWmLzp_drLiR9svEKi1Uc1qa3FIx5mVh-hBq_vY7PJv-ZmZndDulEHXQMSAGMuGGgnn1mqdQqCDAtbyliJly2KGbGlqApncJHTfmT1zPDOD1n-Q1fMuIQIg5r2qRyRtiwzskLM7OBUFYEpi9w0zspKgXNAO42N2EHKz8neOwwlzy4WJtO8Twnoqqb2aTNwLlT68HqklcPwzslNe5VU6rXzu7uy_FnZ7eYgGjaEWSz3_XAGBj_iG13CNps9Wi_bPSmqlGPtSp3POZFPUak0p_4M1jt2pF98w7Mt12c-RgApE2G6mJ6xBR-3azCPfcx7NW01nglq4CRmy6em3GsywLBUAco_mqpvljAkRmY9Kn_VcCiPsxpOcDmUg-PSFYODVKNWyXbtxWYREQXcVF8sSGAVmJO2AtnyBOJ9uVnU1ev-ggAB9omZ_IJZVmNiKbVQKCRmPlHsMebcjKBxgYr8--Tkl0jzCSa5-995BCFikko4hRWhXLaGaIVoRYzRD23_4sjdo_D-HizpV8owp1QIzYi5ez5UloSuIb4P5XCKWZRKmHLjcQTX5dVQrrPyzckw2bP7ErdVp0ykU4Opz0em_FH5Pv5SKas8lMAaZZNrHIiE5BvIH3wLsd6c4ufvA7PBGVgehDmzlgfBcQfya6sBFU091zw0c_1GvHs9MDom1oDCClDEODe-MXzVGZuN5d7BNL5iSLAkNxDddZ3WIOhN2SheWaDlLsB54iRUkR3sB17I1_TQU1CQARayr0DKRo2d2X7hw57SUi-9nHu4FsxgFf0p6ME160AXPN3LSRh4YJrFMVJxT3iQsb6DkRPt-GBWKze3-AKal3K3v_OAASFmLM3qdbuYvGu5sWx_ftdugTjIG81Jy0yJ0Y8pvv9mgXYBR7Mz9i-UDyvRP1_BV4MfhWAYv1BFzvA9tXt4uM0cLHNvTQcHDAeLD0dE13yv3HLx4FzOYAHFi1Ftm-kZGTx0ptFYNGDdcqANVRTxevNOS16PdNyFwuGNuk5x4-6kigg3o89PwHF1uA5CAUV_sXlWVsVchkO6JfqXjSNMEd5ROzN9mHXmWFL5QRM7rDCsT4BphEhL4Sc7_o4LSuy445hR80Mx5IHR1utKUaxX8nJ1cPA28lInuBdZK5xnebZMwC3vrbX9u5SvVb6opMg9V7bdAYGRONMVg_biJunWjECP6_TrQf1dzdqPSbrt4zTKThi1_qd903YErDpd97TA_YLZvu-AyXHbt-UdkJgczGjE7Thf2WbNh1VwL_xoAGiqOYGEELzsZuRJmgapgRyKobz79JPiQG57LB6amOiq0EnWT9gOpI3BR1hD5HlHgk45-P8nEjl0iUPWHiWDcnZnM3VIDiI0fPl9UctmEmFnYe4d8PKFjRDH1D7zX17-bHZ_5mgB3MVz9EhdoxuJhVpj1xI7e9ZDKH_x8CYWxg5xEofino2VUoS24ifRYj3DpGZXuldn0UURXFuQ4XyojeKoUHbzz0LGlPaX08gwCzp65iLTGb_EXIiz5DO7kGkUSwR1x8MbY92TDtVsnA532nkccmaZN5OHTdibgIbgzqKCocDfcyRlv2YoRS7sOx05JmNE3MxuqEEJ5o1ClJ0j5jHlrFAcUpnWXuylsCe1MbSKYKUA_6jN90P0cH2jbtieQZpMiUwXgKEf6_6mJZVy50O9ngmDxyn8XSHmZP8V6D78broYrPHOmyor7JS4j6JFnfO2Mw1ldrK6Djk8LIOODbk5aTgWMEO2Q6BWD8x_Z4jRisCaHXL7NpjIL0Ssyh1PhYEOXNlPrzLtcbUWixgpCS8Vs8IAnByd9Z7LGk-Q7wKgg3toqHD-mqAIRZYYeaU1jeW0RBTuwvQoczLQ07-NkPsENvD8rUVJnerehGbzOuflWQqnQt0C7-BCY9bR3XlVbx1CZTpgg8TqNH9gygVP9eqats4weq9XYaQnjtTXYm1iHSgddYIG3hxJeisZAg7hn7gSpkrhb40Y5vfhN1MyDKFmLHqXXYNDq0yTi4xvWYdS79k-Hf4xWM9j6j2B5zoJfGEqi9pVN5fmuaTZNYndBTEH5U71SAYgzN3mkI07Qn6-UJklOf9AYsJ4OQa_UKzmmNA9vJan_19ZYaiAMy_h9bY8lBZvVvMUyvzabqcqCwxl8AyMUSpGZtfTzuSjnyCL5MSo6ck0Uneqs68BYqjsxCWv7W_hRWXBjPq3RIKPjKTCUj7j2i9WZ0AWDq9Y9f9mkYyCjdv1dqpB3oQrWGuSri5tCc50HRa8n5qnsx8i0M_6mZx5ynqmgZoJEMldRm9Ry7sLBq0gyBhK4CA0WJwYVbVaF-Ti3W8q_qKcmL7aLr2eVpMlEvQ4tGnmO4hhIAN835a-OxA4tf-KvJgQ6oQLQwTCOUPdL6veI_zq-dpV7dnwDGVvRAVOU3VDTYD2-OKhfU-yzlImarey-Ja9ASryb9A-9tls5i5tjbVJBss1TCuxEXjskeWGIL4aM4UcgXTx49hfFpMxaeltqpvRu0AyCU0lppUyPQl7GtoxiJTN4O3Q76yMDFfW2r2zU4LaeANDCS2ziPwrwvHhQCZwaT2rvpd73-J9ZIRzZYvQYSOG2orCpiqtd69qf21WFkTUQOjXzBvTSWh4fCddK5Bhlz683ywqtIG80I1qZmA7ufv2kxZPhQommRp1ZR_vTPPSh4U9rAJSqQWlLP2M97WcEAaCqoJUZ2dL0ZHIf5QRQAh_5X6YKZcwCC_paGmcJZNyRzGFCnokCUUTXBgEWVi67XK8_ND_TLEQ1k9hcDUFC-xDDVOhtajsbOCJZh9CvpVt_Y1hueUXmybrzcfSMzL72UIAS2-pADNxIkUNrofd9SPgWMllxSGs153WbzVD0RXfb7DDOHP8H6_m5Iqq0C9DAHfP8zWEUInjmORyZqSDijnq0yp3eJP1T-pHCmIJRCvOoQVbkmdo2rf_n8lYdtGJiVeVC-s0p1RmwZGtCmpFs3-nn4oWqxmaAHZEaJQLebIkWbe6_kO8eTqMyqQzYcYzKFFAXS1t8V1RddduH6QpQgWNc9Bu4YgDYPEqeliEwUbCBd0PwANWRjQs5LnTnkCwVMws-HWGtYCFw7FFPB1c6LXh0zoFySvIcVzEQE-NO5PjOSZ3QJH1c4Ruq0VOwOOZWdWRWF7b74fOH1fmDO2AoRQD6Air0gWXzUEi1K9_KlFn3MUf08VLaIJMCAII_xnLTUuPjWyZNGp_EmVrdK6qH4aXsd1mVc69MI5VvxtF9oob1p-nyivtw&cid=CAQSOwBpAlJWZKLHhTXzmfrVyXvl_Qw8rMKJIv9XM5VgYw-W3qfpaPtUZpGqdmzhxmXDLIPTrgOYpJj3MukjGAE&dc_eid=31076403&dv3_ver=m202307240101&rfl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ds=l&xdt=1&iif=1&cor=4446582534515229000&adk=1676851216&idt=75&cac=0&dtd=16

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0295cd239e86e8f583adc0139044720dd72edc8b4ac92585208b89ebf447e8f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37162
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 694A 0
55 B 401ms
396ms Ping
image/gif 2404:6800:4009:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~lkl543ko&c=7568049181108&slotId=3784024590554&qqid=CLyL5NrzroADFU44wQodFtwIqw&umsem=0&ape=1&ple=0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fwww.gstatic.com%252Fmysidia%252Fcac0c864edda0087bf141d240f6ef92e.js%253Ftag%253Dclient_fast_engine_2019&encoded_body_size=0&transfer_size=0
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/5529604523bf1021996c9e114ecf8778.js?tag=video_location/web_och
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4009:800::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 694A 0
55 B 399ms
396ms Ping
image/gif 2404:6800:4009:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=3~lkl545wi&c=7568049181108&slotId=3784024590554&qqid=CLyL5NrzroADFU44wQodFtwIqw&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fwww.gstatic.com%252Fmysidia%252F5529604523bf1021996c9e114ecf8778.js%253Ftag%253Dvideo_location%252Fweb_och&encoded_body_size=0&transfer_size=0
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/5529604523bf1021996c9e114ecf8778.js?tag=video_location/web_och
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4009:800::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 694A 0
55 B 399ms
396ms Ping
image/gif 2404:6800:4009:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=4~lkl545wj&c=7568049181108&slotId=3784024590554&qqid=CLyL5NrzroADFU44wQodFtwIqw&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fwww.gstatic.com%252Fmysidia%252F39d4397462e2693449f221f9915f9e59.js%253Ftag%253Dmysidia_one_click_handler_one_afma_2019&encoded_body_size=0&transfer_size=0
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/5529604523bf1021996c9e114ecf8778.js?tag=video_location/web_och
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4009:800::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 694A 0
55 B 398ms
395ms Ping
image/gif 2404:6800:4009:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=5~lkl545wj&c=7568049181108&slotId=3784024590554&qqid=CLyL5NrzroADFU44wQodFtwIqw&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fmts0.google.com%252Fvt%252Fdata%253Dc1xxk4aU9am7ghp2fmGo36TpGmN1XTvHzB-_a-Xd__2z2sz_PT7-pRS6ZTmRlMB70dJJHQmi5e1t0Res&encoded_body_size=0&transfer_size=0
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/5529604523bf1021996c9e114ecf8778.js?tag=video_location/web_och
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4009:800::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usermatchredir Show response
ssum-sec.casalemedia.com/ Frame 4FEC 43 B
632 B 40ms
13ms Document
image/gif 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 27 Jul 2023 12:37:54 GMT
Expires: 0
Keep-Alive: timeout=1, max=500
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 6317
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://usersync.gumgum.com/usersync?b=rth&i=8mnwWBfzUa8PcJcwrgYP&pi=gumgum

35 B
250 B

12ms
11ms

Document
image/gif

35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=8mnwWBfzUa8PcJcwrgYP&pi=gumgum
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 27 Jul 2023 12:37:54 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Thu, 27 Jul 2023 12:37:54 GMT Thu, 27 Jul 2023 12:37:54 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=8mnwWBfzUa8PcJcwrgYP&pi=gumgum
pragma: no-cache

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame BA77
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

10ms
7ms

Document
text/html

23.52.162.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-162-21.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 27 Jul 2023 12:37:54 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 27 Jul 2023 12:37:54 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

POST
H/1.1 200 1013.json Show response
id5-sync.com/g/v2/ 595 B
1 KB 96ms
95ms XHR
application/json 141.95.33.111
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/1013.json

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.111 , Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e73f3175769071823e3289f12469b188cc56f186e9dd3e3854bd772c23f28a69

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:54 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
p3p: CP="CAO PSA OUR"
access-control-allow-credentials: true

GET
DATA 200
OK truncated
/ Frame E968 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bf474abf1572f804996837fae61cb1bd84b9d46da6d43bd16939cf33a9b707cc

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 ice.js Show response
resources.infolinks.com/js/1870.002-3.027.ab.1874.021-3.027/ 186 KB
57 KB 25ms
22ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1870.002-3.027.ab.1874.021-3.027/ice.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1870.002-3.027.ab.1874.021-3.027/frame_content.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8032a22ce0e3929967e88df85bb84d8c9c078bb0b77dd5a816fcc9aad42364d7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:55 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 19 Jul 2023 11:07:11 GMT
server: cloudflare
age: 2761
etag: W/"2e87a-600d508883a22"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 7ed4efbb0a784388-EWR
expires: Sat, 26 Aug 2023 11:51:54 GMT

GET
H2 200 frame_inplace.js Show response
resources.infolinks.com/js/1870.002-3.027.ab.1874.021-3.027/ Frame 44B4 3 KB
1 KB 34ms
32ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1870.002-3.027.ab.1874.021-3.027/frame_inplace.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1870.002-3.027.ab.1874.021-3.027/frame_content.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 69ca030c293c098f15042fa5762f11e3749e9a8e69fd1a1cf48e7463f016a0a3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:55 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 19 Jul 2023 11:07:11 GMT
server: cloudflare
age: 3921
etag: W/"bee-600d508882e6a"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 7ed4efbb0a7d4388-EWR
expires: Sat, 26 Aug 2023 11:32:34 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2E8C 0
22 B 47ms
47ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7721995629649&version=m202306200101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2E8C 0
22 B 45ms
44ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7721995629649&version=m202306200101&ct=76&x=1&cor=6505049772523424000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2E8C 90 KB
37 KB 76ms
75ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A1WAuWCOOjZ8OYSwd2ZH5v0ySK6Q7DU-9NmMS_Ai7-5mwiQoq2UEOwriG-E61MkkVHAmFomE6bb01Pq-qb09gIovTl6w&cry=1&dbm_d=AKAmf-C7-oFo3PYEKrh4j_iBll-Kb_RsYIPsASu63InM66lA7j_XsRFhelaPlO7HaHke7QZlUe2qL1m5kBYWGGDX8RAHdNyt89Wns0mAx760eZw9oRaGyzP5RAlMaYhzPMKQATa7H7FQ_PXRg3CXsO9LwHUuKV6IJM6hHQZy4somYCxZ-2RFnKMbFeQMdq-ELgw5l8rGC4i5ZvWZ-Ec2AGCRfJPBxzgpj5d-iXJ6sGunoB6Zuu1ZeVBaWy3f28_xPbM8hkgbGEmI8bq_QrNW60oWHjbbaK8b3qvEw9754Di5AgrqZc2iDqVtUiyxjM_SGzBR3HU9u965if6HG4_om5LuVLhcX3YY2qhJzEDuA40NjCCqg-s77FY0QKSijljUC3cYah-46yNEHqzHAu5pTfJZIE8S4b6XXzJfFAYUwKhHT_Sm5CZemDDu1qHK35zvJr9FEXX0Nh3izg7hb3Q-oiw27Isa-AwtZioaBPtom_IjY6WROpb1cP1YiiMvfE2qTJDIZrR_080IG_a5tgrKFY07oQNtAfccuvXsbGXy1Gzj_jtI1dWqiKEC7WXeGaLF6E7nztJl-GsJy3vUX2UxoBZlzyjRRYiIbzqYCGg_N8O6_sYCOfpp7l4jEYKuQ5bGcPzsb9PWnbE3R95NMNOgHV4tNLW6TU4s1qa_7H_Snvvk28EvEr-Oc6H7MM2ezRRtFa4FYJoCD13ySpxZ32XdJRKS0-xXv4-oLXXOtf8iXIoEExsn-T8eOpwTgk0FF--WwE29AnSVjtt2pYYEiabeQEonKPSxlIywC6xOM6tkZ1JNb-DLqrzmnF5xkh-cF8mQETgDCxueqXVKRsJDmSdCHkcOznKXXAafcbDy3azumtg2Tbv2N2XdvchKLv4a92yFNtRjajTSO5_57hRaAAp8RW3o3Fc12b-OxBuCz0jiPxXYSXLwWk5C8kmHz0Qi4d15sQhBs_qBDy_ZJKR2njnquBXvOmH-Hc3mhDS3StviKC4Garmzz4288Jq3N9FlaGJYqlL2hwkRc8vRGfASBR7HrLm2GhcQeP7VB_vX6fXVY2Sg8ZN-SWwqH9Fb9GPHVkTlGbZyR0tblcme_jxqGN7Xd4RkxKAzuzC4-hZpvZ-F7By7NHNWCzidmKLmBlD1_tLy9dPAsmmyyGm8MR0_ncYFhEIatEeBRbPskX3Qwgd7RbwfSrpriKrQA3cyxvEcy_kypciB_hRMdBN48a5X-veyEPmUJejd7DZrR5-A5RD4Hhf1cGaiTpf81bRZH6anyEuu1U4i04iObdNG8_E0wfEYISvM7SXh5KAJgIUPjnf6WR9yIHz_WtDs7hisqOVDU_HQKdn9h1_vFSgrQpz-jR0zIDd5UeH3EKbKM5Q3gcVxGcC8UA0hAPvEqK6nGPLt8Tca9dYF347Dy8FcXkVsoiYqcKINg-xFkbW2bvtss7qXVX0YB-guzBArZd6n1ktz3zJsN533R2ZQlUFllXWaaAhxWjdjuX8NjiVo_CZnwTVuUxGK30N632IA9nNQfop0icukO2O4fAOBFQzg6wzvCTg2DRUZ39KCIpj6V1dcFgwyK__ddwPxI8aVTDUI4c_rJap2cfYNtfyV-SXRud_yjdnPdFzik_y2ULFQfo0dzSaWnY2EAX_P7E9at5IyaHhhdwKatIJvZzrVfnP-XJgxGWgU_v1AzYsCsZd8HdNYA0-IfBwE47ccuRMmwv-O-oBgDZ_SpWELRATa-v4h1nYT8R1-36RIJNlSL0b0AWdde4sCK9V5DQwxHXjNlSQpRc2si_kCDZipjdM2dQ59lgrYwt7hEt75te_NTto598pHa_dLqm09FaKseZI05_FhPAMQ7cfq1hchia61L-9eKHHpVbcqqHvvWyImggOg7ghqxlqz4A234YAJglAefOV5laPA9MdmKshT3BJsIap4_sE-8jLxh4eI4KP1gUyoxlDqcf7bl95ZtHT0EkJn90d1N8XqU4BFlTOdMmWgbNgwclFO-odn5pDqmwx5cYvJFPBj9Z4hjxWoUcW7B25IdeRdjsWfYJvpOdnAXCcHIMJAYRqs4Kz6q3K6Q0UDHmt06Fyyz6j642VOER34G39Tc2YKtfkL0zi4nNPjTtZMszjlkAN92onqI-F3MUJEUCntilq3uiR_FQ9EPesV-DP2jXI8m_P0anVOBRe77BY0aBDxhmtrd9Iw4dwHmEkp2F8HqUNpSCN5f1_2CCrs2IL_ENKn1_gktoNP8_uG59_2J5tAmQde7A9lMjFiAlpqJZZGRJf9auHot6gvygWpX1AOOs_YTeaQQ6Pj59sw39mXwavcP-bLuaIxKx1HeXZaHYeoDEbrJPwCtamW2zCbPR7dHEHtjHGinOrelV2XYm_t1d73uW-4V8L0UFqb2E1DQnCT-8guzSVnWLbooI9faXulSUc9o_6r0vgF1PkBieLp_g4C-RcKp82iNWLDzGA2B0UCCEvhAN-yhpkReEhZNwT7Ad9znWPyME8RHh6JNUrlPPGghKEowQHoEmlmjMw3EskJRRBk-c2_RgCxsDaQjk82sN83kiYYhSjHCd-o0bWRJUQAXhlOBqKQK_GN_i6XCDSNhAFSdSYTcCGHI0GusJfQgKwalzXtPgGjx1TDFa7TxPjfVhGsVGODfE2giQ_QNgHwq9GiYsyb5AG9WRP1Rpo8jEXvK2naEY9B0qX5uf0lkhX5ECmJ5OXUodrPi18SghG2bPUwPfKvmCQbHNQ19rVmduudxPu1dpF3rsNOR9CinBa9t6oqv_PcZv1PfXElROHlWR4t6od5BMAxkhv9gHMUn0-ystz0o4X5DjxfWZtjnIGnnl1tXBhQ0Xrz4LLOoZdvW94yeSXj1uvA2RYMEYaCUjIVIiD6aTHZeAbKGFGN4_iq64ymAnB29PCFnaM4trquqU1xhxMvYqkIDayNDSijp1iuXYxwmrJ_mdJ1HiZB394Phkqg2kLnpmuOyRsAaJma4kXDOnhLZS71OFdomfALMXSmsV9ch4QogD102SwRjXz9-cTadGo8O0BA8SDcpK8-CD1nkOwN_NDVejPh051uzhVI67VFGXP_LGZrVY-0sEuMv6GOvZalkoVroMQw9zObjHFC0TJY7JMHtuHA4_MubmXNvOViRZc05UeMpkFWqvivqcW8ld1gDB3lr2qSYB_JWWzL8LzgazBzzw_lApaNCFwnMMpKR9v6xjJ_-vS2tg4tsplaRWzsogMtq7mmlfgQRyYi1mcXfRyscmoMq264QMA-T8g3Xi3urtezdVY2lwRFzqKninY2RrTxdplbV1GI_iEo2Ps2tkG9wg5loNekcvM2LjjfoWPdXiEFcxxKKnZLosKbJX0DHuYeFeaSMrllWakyh_z5gk4VOqBiAdhV3y-QnwM0KIovg-nYnEBdcUEb&cid=CAQSOwBpAlJWJPkiFoHhPQB-lD2qRACMgIk7I8htIY3BN9RPIkNrZckk7W7PQrwD1B6n9t0eXVymSp2OXIlBGAE&dv3_ver=m202306200101&rfl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ds=l&xdt=1&iif=1&cor=6505049772523424000&adk=2180531708&idt=117&cac=0&dtd=38

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

249ded75556a1cc60af04be466ad4592c8e35ac4c1919bfefec77ea3f2b3c11a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37992
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4269 0
22 B 55ms
55ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6705814035621&version=m202306200101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4269 0
22 B 63ms
63ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6705814035621&version=m202306200101&ct=76&x=1&cor=18089128470098514000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 4269 89 KB
37 KB 59ms
59ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cvq6_NLtkEBxSRKuv9sKjWsUQEYuhiKhfUjjim3elmqapCF8trltgB9XdNJKYsPtGw7ah9yfewpjlMBmP6P6pebqN63Q&cry=1&dbm_d=AKAmf-BU4p_cJQhLDKFyL-FT-a3acn1vAeTbMmQwe5nVmt-a9F8IKzPkzgrs95XK6nZP0tm4hhmaDQ8UaU7SYuZYCKbamGYTbokzp2np2UIPovDjJKMXykONC269Y32mnj9kidrcGdCNi0zzvBJ4h2uIjQhgVZ14IUm7ZWAMviZVNR1LP8AfPtTwcZvlSCEtSO-tE82FSFgphbNq7DX3kMEKRc53shEmrdKBLaNT4KfciQRi-h4j0SDL5d3C2QKqFEuXz70aQDCwUri4uw40Why4yQAGaq9d48FR5g_XevdafJPnxKrMk7qYMHgoplk6pgJ7bSe6WozpWYvdAhNwVxyjc27B-b_7ZZTN2KRhUmmdYd_HHKiA2V4x2k37tssAMtZKcXBhGBFiPuEZNN-xsLhLK2ZqJWzqljs3pXoTbOwRV4OBfH0WV3EC_SIau_whqHJ98PgLO3dmZdVlSXKKFFoEdeizbZAohZPCxRuQTuTHqMAeOugh8gVh7CgO3sRs7_fKcLuM7ihE0A2A2jMgnzEuUQ2b4YP_VJfF7gdoIN69gMMtQaBSQFAC1lBaU7U7Cf8AgwJSxOWCcK0dOnVptXaeecor-mbRnmtBsLRg6VNQNSOSVWe92KS4IMexmG3NzRyGYOTIa8s9wKoMFaFll_ddyJTaVGWJMNMpZWz8L2jfKrCPCz4UmzSGcAZpjcCa8Qsgn_GqQcBwEpTxe-XFvOxNAhcr-NHTZkaauN7G2Tkb5D0EK2kmGljFderNOg1AwGdVUkeohMJ5GLSFD-lGRjUsrCNBocnRjjH3zaoB45KvxLy1c8q-korUWi4dt593qShrHl6u3DRfuMmlop0yCOK74kRnKdWtOPYamgKDIhTo8drQqvJ30I98VWP1_YtOtP6WMhB48LNv_hu3A5-eIKhjmkGMgsJeyidalkFGkZWj5blR52y35wPNeRxnv-8QXhX6Xu9rxwSPwsKO7K5Zlga6iZIbYlmWV9vkInatodSF_slxMiygPbIWcc9xz8P1qFFnbvX0gmwM-tQxDq6n1rTE2_yWLkzPjSXbMRLnALvHiOv4ypGtyy0kVo4xbhQnjCLSW7BxDG-OtLzwrRjQvWnNh3rfiKaAoZ138OM3EHn4x-EkFs9wLdo6Ah4EZ_6NuqskQiG4BzXswN3WTjV2Bh1ALB-LxHmc5m1gYsUFaNCKJXKpqJE7pfV8TPRCBmSNhZ0eCUOVUR3I2gji9mdjQt_KvPk-n1m4ufiMTPdHC9fMgAPXvPxCS-Aw5CqeXr_rPsneMP-i6E7hoybdP0qZ27RCsWVsiFRAerVQzB3AQUIJTlKIkG6oE0YMoyTZiN5EBeXA4xb8-HOH0o8nqpWuM6NQ8sNoqLxGRdFGECpkfC9aqX6rkqM3X4GyD6aOARWN5j9xPleOVD1_SXlGk-cMbETdsyeLUzEpymAXs88Ji8oYLSIgMf55BV23vH4XtY_HAu7xQ2Wb2nqzVJcwqPogsU4RPTYJPLkah13dx-hqYvGnccXkqwQTFLb7NEfAoiCVFLR0wXabxiK2KHp2MNaoi2-N5edzimMnsGxMN--e3XToWuQ1-2zmNXw6UC9Y4wFX2PYUOuNJqlRfGsjV-wrKnsAtNh5M3wGSpVIieiUGDAqh8OSnHl0wWNfRjrjR_zvMONINc0gfteLIlPAbTNzth39vboPrFXGFYlK5pveSWPV3zYGcon90tHl5QdLTixTPYW2LBO5tgxnkWxu4cQj5mb41Xrse6pYeS3_Uk4ov3fJN9bsSpNnEfRxiVB8gKZolf-Pt_JaIFl_SjVv6t1ZC9DPulIUWLoHIXspg3T_le_6C_8vkO2hotPr0RevlxbH_wFHA3DDzSlfHrrLGf7TyyrB6yj_tVT6x6glMBpD6xqrqzRg3YS4qbTIyyewDHFuTGEpfTckzD_YLdLPf4Of1fcT1cSpLtkpwM2Mbc-QE1LKQ83LaMvVCu4Rj5MnrXQyFtxKa9lX_fWP1EV8M5TtcbZrXcqw7mNGka8bRspjHwwUpy983JFC_zoQVyU2yqM4ipxAeJiQvFarcaLrwxu5_Ta3Ahrm2Y-XM4YupPqZLO7ZJcJk4S9pFR4Ejag7ITgf1tgG9MSBirfzF7sPCji5CiR7roDy2LR77XZGYLmlZNAhJasNJ8HMpzFYFK0mI0zoanDg_ZLqEOOfuYexX_GSpH7hHZvky0MVKK2XpW3Qn8oJyQXBALpZ5vbdMAR_zDNTRSvNpDH6yJ5o3uny-2485K1FkxiTU0GGDH-Rih_lu3rSZP8ACWws_Gau8R7tu6ghcgPhtVtP8R2HCkkHoIjMp98_m9cIB80j8gZNwLnL8dCsjSue0RULMB1WCfkopz8u9rUTuFAoulOHL1GQaq-pSqK2LcZrlcsGJJVVCFjXfgVNyYWGZDS4ngeGMx3y978dpnGxklsXws4XMl9L4_VNnX2X9urNU8ANXaIg0dS3keE0rM_6G_a4k3iOW8MtMmipMRSkUK9ExtYpuWwIQ2VdgzNEKYicqRr8t7wT6fKPLkEgHae09k4oOZ7pH7mRDAq84VRb9dCCwWjePIm7Yr9R6pahkbOhcQSD8F0FPhWbchl7ZYajRNZOv3fkAnD62nRLBqBPz1cJ0dHJV2P4RT49DJc54HFrj-ZzyFo7Xy4FXkjDdKvGe-JCNWCKFkVwns6rkeMh16uJB5wBZy3f8oPuqjq1XTmje7kFHSrpwf20woGifSYWrLoInMZ4BTIU32KiEEcC2r46DiMzRf98S5oP3zx2VViglP7JHngxCJbicQz9MvIt2r-P8jA3IrFhjj9L6HMj6DPYj9RpFMJhnE_VZpltRaxCeW-t_QVy2hmpLS_rfvMMzj-nitOzXnVDHXuQOM6p_s-1OUX73rCuQqOjWKu7_kkQrz0Ax3XA2Yb61-75RdiR6iLS5zTZhjP63KWd6W5TcCXlf6R4fLElFBcpBo7EarRzrhCGqhVoPdPdoLTSKqdvH2jOOBG-O399fN7O0mno_ayKnKxE9csya9Vbu9UVA6N2Rw0GIRolsc5GxOssbVHr2pzC0359TxpIwxIHKkRnqmLbJ9cssUmBEzPGLFE034JBrga28k7IWMultPiDm58voG30ijduffK4O475PZGxWz0E9o-9tPuZ8ejxbJrKklBcE4Mt-Zmk3SlKleRErl4cNHOU3vEuNRW6Uw4ZYcpHPIH6UmTd3-zNUXr_uFuLweaUeoJIqkTt16D3f3JRIcsTZICJkBhM9ZrsxnNQ8AEpRLF7UncVJDx6bs-ctbPtlLXDAjv5iQoOmKmSg3xjU2hN5zxp_t4aj-ESYbOXthmw3OJ9MqVqmnMLIv8HLWXC1E9LCRUADKjJz91cxVfs8coPGbpiwINt1YIy4y1fS96CiKMBVl7CQ&cid=CAQSOwBpAlJWinGi40gHk6UwXTvZnXh8pP9D9RMD36MQ3shZoeXtaGcbMkiE1alqQZmKfgH84jjmMbC-jkLBGAE&dv3_ver=m202306200101&rfl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ds=l&xdt=1&iif=1&cor=18089128470098514000&adk=2067630987&idt=74&cac=0&dtd=5

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a5e3daec3adfc9623c1d7ff2614fd2bd3bcb19ca316d09276149f8ae688d966

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37919
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cac0c864edda0087bf141d240f6ef92e.js Show response
www.gstatic.com/mysidia/ Frame 9948 9 KB
4 KB 13ms
12ms Script
text/javascript 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/cac0c864edda0087bf141d240f6ef92e.js?tag=client_fast_engine_2019

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6d046447e30e2ecffe5f823e770fca36fff69966f98f67b6fee1acc5c37bdb61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:51:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 56791
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3959
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 20:41:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 24 Oct 2023 20:51:24 GMT

GET
H3 200 5529604523bf1021996c9e114ecf8778.js Show response
www.gstatic.com/mysidia/ Frame 9948 138 KB
51 KB 14ms
13ms Script
text/javascript 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/5529604523bf1021996c9e114ecf8778.js?tag=video_location/web_och

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a347bd4b83684c7949b0c420f0a70d82fb84b8c2bc01b6f10086e44a960945c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 18:29:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 151733
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51995
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 20:41:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 23 Oct 2023 18:29:02 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 9948 14 KB
1 KB 38ms
36ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 27 Jul 2023 12:37:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 27 Jul 2023 11:33:18 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 27 Jul 2023 12:37:55 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame 9948 2 KB
905 B 19ms
17ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78228
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/ Frame 9948 23 KB
9 KB 19ms
17ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/abg_lite_fy2021.js

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93028274da1d373cd41165f6a442568ddd482370e8093e45d14a4ad0f6981f19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78228
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9132
x-xss-protection: 0
server: cafe
etag: 17712579318771444318
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame 9948 3 KB
1 KB 20ms
17ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/window_focus_fy2021.js

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:40:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57463
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:40:13 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/ Frame 9948 20 KB
8 KB 13ms
11ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230725/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ecb4fb492aee0a820dfc4a395fb80e2ac2e864bbf38aa1ae28d6d70fb9e6da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78227
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:54:08 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9948 179 KB
56 KB 57ms
55ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f294f48a5bc171da79776780d32c77ae3323a508cb595a56f116ecb7578a8e7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57383
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690198756579870"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:55 GMT

GET
H3 200 39d4397462e2693449f221f9915f9e59.js Show response
www.gstatic.com/mysidia/ Frame 9948 33 KB
14 KB 17ms
14ms Script
text/javascript 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/39d4397462e2693449f221f9915f9e59.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

67edbe1fe2a38ebf16fc36b42cc267e37f18629ec79feae7a177178bf6e24d89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 17:55:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 153757
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14179
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 20:41:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 23 Oct 2023 17:55:19 GMT

GET
H2 200 pixel
protected-by.clarium.io/ Frame 9948 68 B
244 B 14ms
11ms Image
image/png 54.86.168.92
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_T09oM2JUcnRiMm5IeU93R2syTFRPNVNXbzU0LzIzNjcyNTUwMTA6MzAweDMzMw==&v=5&s=v31h6blm4hl&id=eyJkZnAiOnsiYWQiOjI4MTkyMjk2LCJjIjpudWxsLCJsIjowLCJvIjoyMzY3MjU1MDEwLCJBIjoiLzIwODQyNTc2LDExNjUxODMwMS9JTjQ0Tk0vSU40NE5NLUREUy5DIiwieSI6MTIxNzU5LCJjbyI6MCwicyI6Im1tdC0zODljMmM3OS1jYjdkLTQ4MDAtOWYyYy05ZWU4NGM5MWRkMTFfMV8xX2FkIn19&cb=1271056&h=ehfmc-com.ngontinh24.com&d=eyJ3aCI6IlQwOW9NMkpVY25SaU1tNUllVTkzUjJzeVRGUlBOVk5YYnpVMEx6SXpOamN5TlRVd01UQTZNekF3ZURNek13PT0iLCJ3ZCI6eyJvIjoyMzY3MjU1MDEwLCJ3IjoiMzAwIiwiaCI6IjMzMyJ9LCJ3ciI6Mn0=
Requested by: Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.86.168.92 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-86-168-92.compute-1.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/png
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:56 GMT
cache-control: no-store, no-cache, must-revalidate, max-age=0
server: nginx/1.18.0 (Ubuntu)
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 8AB5 0
596 B 7ms
6ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
an-x-request-uuid: 2725ff0e-6b36-4db4-b35b-a51254a56145
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 694A 42 B
69 B 24ms
23ms Image
image/gif 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=ClCSjHGXCZLyNKs7whAaWuKPYCt2XtNJwyMyag6QRx7Xpi90CEAEgjdXeJGDJxqmLwKTYD6AByKrF1gPIAQmoAwHIA8sEqgT0AU_Qn_U8Lz1YznY8f4tdrjaTqPxZa8lsXcBtY-FuABllEeXYt9tPKbkKpr2qOhsy5RBEo8DAxdE6q-5FpDcp-EFXqxuQ1LbXYp2SImxCLdjgMNyKjyq3uPWCF-kqheMLgUJQxkOw5PyWc64tWcdF2hvpEPYeCKJqpQ3SRELJO7F1lKs5IqbzgiJbq3qx0xMFbL6m2S6_YO5FIA6Q0LjmJHqg7n37a5K73tK4lKIRPsjTz6WTRsGqhnYyAqQe9B8uYvQCXQx5NVxnrob5SFY5QMHbo07XFtkSYPqqI7qXj6G0FaePS7Eiw7VCAiU7S5QZgKZHCSfABL-c_pr5A6AGLoAH1o_wiwGoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7ECqAfKqbECqAfrpbEC2AcA0ggUCIBhEAEYHzICigI6AoBASL39wTqxCULjuzsKlAkdgAoBigr5AWh0dHBzOi8vY2xpY2tzZXJ2ZS5kYXJ0c2VhcmNoLm5ldC9saW5rL2NsaWNrP2xpZD01ODcwMDAwODI1NTU0OTkyOSZkc19hX2NpZD0yOTM4NTIwNzgmZHNfYV9jYWlkPTE5NjM4NDQ2ODI0JmRzX2FfYWdpZD0mZHNfYV9maWlkPSZkc19hX2xpZD0mZHNfYV9leHRpZD0mJmRzX2VfYWRpZD0mZHNfZV9tYXRjaHR5cGU9JmRzX2VfZGV2aWNlPWMmZHNfZV9uZXR3b3JrPXgmJmRzX3VybF92PTImZHNfZGVzdF91cmw9e3VuZXNjYXBlZGxwdXJsfZgLAcgLAeALAYAMAZgM0rGgjewDuAwB2gwRCgsQ0JaA6LC3ga6xARICAQOqDQJVU7gToQTYEw7QFQH4FgGAFwE&sigh=Vz5TQYEM_XU&cid=CAQSOwBpAlJWg0FEZZTQ3MagvyLwX1u0NWW7xvyTFRUqkxqRl4M0ZxD80f0rpQJWfNm1sz21mjgt_C8yEP2N&label=adresume

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200 371.json Show response
id5-sync.com/g/v2/ 595 B
1 KB 97ms
96ms XHR
application/json 141.95.33.111
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/371.json

Requested by

Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb7.51.0.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.111 , Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

5c88175a4c180d1f6b4f4a8d70ac24f341047920316c6f1ba0d82b1c69de4131

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:54 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
p3p: CP="CAO PSA OUR"
access-control-allow-credentials: true

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
411 B 95ms
94ms XHR
application/json 162.19.138.119
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb7.51.0.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

8df5c4beb2f88ebbc83708a089839dce0972ae346760225275ce35d64dfe4981

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ehfmc-com.ngontinh24.com
date: Thu, 27 Jul 2023 12:37:55 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6763 0
22 B 41ms
40ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9086132100662&version=m202306200101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6763 0
22 B 45ms
43ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9086132100662&version=m202306200101&ct=76&x=1&cor=332138546669845250

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 6763 76 KB
36 KB 54ms
53ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CniH6uQRZW3msEMco4ZnqpJ1PLIzsvbc3O7dWUisOU08RuwpJHrO3ukHAIC12Vz-s9DClWfII0xtvWNtiP32-yIM79tQ&cry=1&dbm_d=AKAmf-DqM3CxF4M67UG565S5Q5aVMLz70h25HJIRIvHL8EkLB9Qw9llw_db2Fw2p5VkMwVtPzqpxOWo6YAhWMvz5AI0ZGT4ljYTs6BtjHXK7njt4H3RubiZUL5OLaIseDx86vSctjjEShGZDFndW8x5TBz7rknYIz3fId6-ob13GVsVVQ3AFh8HKuVdBdDaw5PUAHgrHsK8YoeLaSa-WnF-vQy56KmQdj2UDlnurnry-RfK1W4iZx26TUM32WDa6u8F-XIY9nH1Tl4F6vO93d-7omaE4wL54iO92OouFt8IA6oMXjPSv2VsbTnTqe9I-Fij4WZZdjNTYGysM_mVQ9sexxbYWOrgEx0lE3fS-uNMGav47f-8YsEAmvcuzt75_dwIjoLKgES9shLPKXvU6OqJXaKqVE-ZWbnUETBN3wzvOJiz04MTVxjc2mLkp56p2bbtot5MRrM6BqR93bD5Vs8WhxKsCuehx9IWPvHYeG4Ft6EsmoFh-CGORg1fYhP2bRcvJlxzD_1wI7WHB3AxQ3Rx4a9po2o__5KBYuhzffPwJ8kCQo2ghxKEmS26j2wLTJJOtQffy7qNOaYmwzxPhC68lIagSuy_AjteD6hrRCyflTpq-EZZC7SYsU7zYeXgp59ZOA22hcxvyBkys0V825vdXW_qlZtx_YleVpVTDDbMdijDto-gHyfWptIxuKA5hJwGrZq0866Kz0IsMGsSyDChIm6Etn_Wqc7VlCG_NZdMj2ULo8XfsgFtZw4GB5e2zC58kgJrZnfEaqLDYqRHOM4moPT8L7c4OSh2Dk8os8J9a9bT35SMr6dSUBqz308ElIB6Kl25k67-1dDzGd8mSh4xd_zYJuEIuKo5ihfxG2vMHopHdHOhCLRbT2tIXwFDgHho0Bp2-5vEwDMt5BKnbCsWkuTAHZY9lJlPzvjSpxIZh8r5TzPosQaGz42ZkWPeHOlv6gXD9Of5xVB6CJFoFwwrFzgl8WBA-2jwApbVyYGuo_WmopNt0hT7XGWpsD4k1RqePjVnHLCmTDBB0w8r8V2yy4WJYyVm5TVKtmeNfbTmprLjsxNs4ZxVqUzzn2X_umDV2BiiEX00YH1yZyoNSF6KGzglUHD5FtOtQdDhyxJ69BxNFoynU7RPRVWB9W7FIohJUTld_J5R-nPWSCFS1LOnWYgPPbXqUe7phWPblPpXTZfDyXwFJnEMTcnhTeXjFCMbp2CFDcDGx52jfaCCX4ukwtAwEmhYRyXK-Ko9s4W3rGqHHD6IxvoU9k3LOIOTTd3OBYejdMVMz91fdRCll_85seOM5a39DpbEmKuPw9-VI6VtKzjJxyR1P1xOUlDynknYGkAEc0hPKByv_ao1f68fr6Uer2zy7SsLx0Yg8nZGSO8lxo3rfB2uxAnF5dMW8pKt-9R4pQknUPHW-Y3i1pprCuAdCMfZeas7-pxvDKa30Vk1rJLvO2NvjBITqK8Av3sBeO-yh2vIpd_bf9NuJdxHDZFKZeGA3g5KE4hdP-UYPCZkgt6bJIDxKKSAeN9Ez6vlveks9Z59Mxk_rNQqXm0KCiv9swQHq7Rgaoj_L90pwPAoC-KHyhi1adl24TdUjZzGwNUi8EDJFLL0rvzzjutESFuuxDDMv4QCCnZCXgIts7VPvHLZJaMvvS1W7z8GAen47fIWgY7e-NlfKyPWObeAGnU80yQ-ycL02zv8XJjpz6OBZYpxB_ARFk5dzMEgdgqr9zPOvlRke-OTauDNNJObTgwAnE3rspHkhYAe5XjbffUwFmfreefl-poT-qcTBEVoW4nvZ21uwiQTcqGrrRPdg6IwwhAd97b5ZH2-4NS-FY5bGET8OJE1i6AUbD0zvRYIrjWsxZB0vGKmVIOC7qikIdQq6uHblSxJx6_jUT3Jp_yQLxRo36jKzJHfr086lrWlp1u7pt3H4uSZTkcGjX63NmCQVNQT6VnabYJox6IpWZFCQEMIAB0V723lOXt_NyyGyYACZ4CfOM2aMlqHG4yiV5JpNUW15PKm7OuY-iCzCN3T08VWMUrFFjPpdCxzTLSP_WD3oz9PocFg6Rt_ObcieYdaPVLqxbm7D27MpMwWDv6e7muu9vImfihPCl4FvNI01HdPcQioWYhqhfI35zDUQdQgEVvN0TR73MiYig8MJa4MQzrwnl0PlxM86XuUwX7_nFpi7joFHmHZG6xW4vwFUG_j-OQvJpvegewTdqVPR7VAjEdNEw3f0-9JpJoWGM4y9esJ8QcTHzJZteLBNMPgfBxJUsnQtXhhVYwJ3JN1kSlpeVWS9ISUfUbm1WiItIRoe-eLKwg52QOvrdl6xwVon9F11r1FfvaVoqXBV_LqtvNRmR0yOhxwy2H5UJn0vzV0wAB1Q7pOwk8gvgF6J7UKW3BEKw4BRPOmvv8FvylqCy_H64NO_r88Zg2-4HfEYnx1Io7Gc3qUFwHiKTKZFPdXa2lrBguOHrTQkQrZ70IRYwkjjZOZ8u5aJklIZ8FQfzPoNP5a6HeWjS8AHRkRv6Kjqv95JQec4RoiEuroys4cGqm90A_yUZUPi9haYB5f9NeY254bn9kr8EHPaYcQ6P6gJqfobVKkNroLwAint76yBGbhecz38bkbR1_T6tHfnnjL9biBkTmJacN8hO8uV5fAYPRDaPEuwB-P9G4m1u82ME4E0uPFbopgayV9vMN2YhEZAyU8833HJpukJYyu861EL2y2ckBGDH0rjkyUddr10g26xdaMrB5m9MYCSgqkvQaTLWvMxYLybOFnfmAkZyLCQrZEe6O56bXUCX0WgR5EQ38gPejq4vVB6CXLZs_WfNj1IE1Fa5XNb8ImpZwR71BTe90C-9QXOJfhxFkTiqzjXC-WYgML18SDM87KQ2mhTf72y9KSzkthbYccpVLM3WWjdAlE57wqiRanhyqalP2rSlENZ3GyOrs8qqGQqBFF4gwpS6c7xW84lQVYlwwbCbcMqEYhqCSZJTtmU99bcH2VAwcmJte48rO2VwBDMQPhbWBfa79SpANiU8RcI0QXH30k_EPljCRFWGgQ5ufHZVLiqPoPyJTtvpiEQgKs39l2aMzKt-3DfACaAVgqkqDkSDH6vikGi1CLRhVeXcksrL0PLaw01EN_dWULTEMPM4eNIEzE_d1-Qw1Xh6S-zKf4KHMq0giOpVbST5Y_yaoc7r3buxs_S2MTNzCMkFevwdyz5vNbxjdSabOMmteaLqdAoG9-MqLk-yl6rLgX7QvorFdAwKqeHSZ4kYF4JYn9nSqDkBn_De35VFQT7eBPXdubte3Bk9XOwpzfzUHLSjeZFMHqYraF8v5kueGhE3PUy_BTfMkhi6cQfWYpj6IspK1UPl634Vu6xz8_7ylM_n39KWZmnUUFFdtvd79WARQgiGJ5_GjnTo7nC-717&cid=CAQSOwBpAlJW3dQ-QMz5GQqh2jjA9erD_ziRWv62M_GM0UVkWJjQaq85AphEjGrEO_OirnSv6qyeA14NZ9rBGAE&dv3_ver=m202306200101&rfl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ds=l&xdt=1&iif=1&cor=332138546669845250&adk=3516262639&idt=93&cac=0&dtd=6

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f6cd3e68e12d8fa6f283f1a44596eb0434d33946eb931786d0c21cd2316814c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36568
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame BA77 34 KB
10 KB 24ms
21ms Script
text/html 23.52.162.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-162-21.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 5dd0435e368c584ecbb528386140f8c4231178419b214c661c6e86398041749d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Thu, 27 Jul 2023 12:37:55 GMT
Content-Encoding: gzip
Last-Modified: Thu, 27 Jul 2023 07:29:37 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=67912
Connection: keep-alive
Content-Length: 10114
Expires: Fri, 28 Jul 2023 07:29:47 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 006A
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&gdpr=0&gdpr=0&khaos=LKL540WK-1B-DXU8
https://s.amazon-adsystem.com/ecm3?id=LKL540WK-1B-DXU8&ex=d-rubiconproject.com&status=ok&gdpr=0

43 B
479 B

17ms
16ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=LKL540WK-1B-DXU8&ex=d-rubiconproject.com&status=ok&gdpr=0

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:56 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 5JK7YF8SPS7ZX0YJSEAR
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s.amazon-adsystem.com/ecm3?id=LKL540WK-1B-DXU8&ex=d-rubiconproject.com&status=ok&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: d67ad46d58ddbab9fb03c088eabaaff8
Expires: 0

POST
H3 204 csi
csi.gstatic.com/ Frame EAD7 0
17 B 398ms
397ms Ping
image/gif 2404:6800:4009:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~lkl546o6&c=201128486213&slotId=100564243106.5&qqid=CP7litrzroADFYUQoQodsnIFnw&sei=44730425%2C44752538%2C75259414%2C420706098&nsei=44714510%2C44729911%2C44730426%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=ssc&ulv=1&ua_e=1
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/72f96481e1fa2f83db121c0d28854a9d.js?tag=gpa/dynamic_fig_web_banner_v2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4009:800::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:55 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

8191335062100591434
tpc.googlesyndication.com/simgad/ Frame EAD7
Redirect Chain

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgODohfnmlwEQsAkY9AQyCCyAXQkugKv1
https://tpc.googlesyndication.com/simgad/8191335062100591434

1 MB
1 MB

15ms
13ms

Image
image/png

2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8191335062100591434

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1dd24dd0538f6f3b607075ec32f4f2c8b0e819e97e58dacca1d9c9d6d3e1e708

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 02:28:23 GMT
x-content-type-options: nosniff
age: 36573
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1140763
x-xss-protection: 0
last-modified: Mon, 07 Mar 2022 10:31:05 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 26 Jul 2024 02:28:23 GMT

Redirect headers

date: Thu, 27 Jul 2023 02:28:23 GMT
x-content-type-options: nosniff
server: cafe
age: 36572
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://tpc.googlesyndication.com/simgad/8191335062100591434
content-type: text/html; charset=UTF-8
cache-control: public, max-age=2592000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 26 Aug 2023 02:28:23 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame D8C1 111 KB
39 KB 5ms
3ms Script
text/javascript 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Origin: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 02:37:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36032
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 28 Jul 2023 02:37:23 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/elements/html/ Frame D8C1 11 KB
4 KB 13ms
12ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/elements/html/omrhp.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:33:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57850
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:33:45 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/ Frame D8C1 30 KB
11 KB 12ms
11ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/abg_lite.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0b2c524428c1a3604e3d1cdc61c2ae371a8f2fc767f801180fcf892db9e07c3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:51:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78366
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11572
x-xss-protection: 0
server: cafe
etag: 5014499061205845695
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:51:49 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame D8C1 41 KB
13 KB 12ms
12ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:39:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57527
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Jul 2024 20:39:08 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame D440 15 KB
6 KB 12ms
12ms Document
text/html 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=ehfmc-com.ngontinh24.com&gdpr=0&gdpr_consent=&us_privacy=1---

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:55 GMT
server: Kestrel
server-processing-duration-in-ticks: 835722
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame E968 0
27 B 36ms
35ms Image
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C1XW9G2XCZL_sDYWhhAWy5ZX4CYGG-sBx7fiEnL8Rs7Cto4MXEAEgjdXeJGDJxqmLwKTYD6AB1qbA_QLIAQmoAwHIA8sEqgTbAU_QDaPgpvJgU-pN93QKrg0A20FMIDg7UOfWkgpv_CrLS-Zfu2BwOu3zZ1oRuTzvyDHnwDuOU5LbkXVNCaG2w-q5ZkE_wCfo2JpXj0AJsa_RBOkDEC-5GShzE7L-g1f9Owa59MVcK5ksj-8uXjIuqd68j8KknBlnQH02DdW7I9hKMzEKSZsfpiFc8kqNoMzCONyrKK57X9I-av4i9330aPROx32qISSA5x2a_O5L-ojGDgbU1ipUXXyMlmjtRo6Wq8YJbwVor_1B51NYkbfRzePfkWVXUK-NAQ5UA8AEmazt1LcEkgUECAQYAZIFBAgFGASgBi6AB9Xj4weoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBDqmSPSCBQIgGEQARgfMgKKAjoCgEBIvf3BOoAKAcgLAZgMscXs1LcEuBODBNgTDtAVAZgWAYAXAbIXHAoaCAASFHB1Yi03MTA5ODY0MjU5MzQ4OTM4GAA&sigh=ZZ2RQmpdwag&uach_m=[UACH]&cid=CAQSGwBpAlJWuhmwbHp-DJLm-VMt4vdgXNpG7AsjeRgB&template_id=515&cbvp=2&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 27 Jul 2023 12:37:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 tweenmax_2.0.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 993C 113 KB
38 KB 37ms
37ms Script
text/javascript 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_2.0.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/script.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62afec092c21b138eeb1fc55859f60c19dd12ca3c02bdfeb336a820b016a547b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38915
x-xss-protection: 0
last-modified: Tue, 19 Jun 2018 18:02:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 27 Jul 2023 12:37:56 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame E44D 0
0 44ms
43ms Fetch
image/gif 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstXJPr4FJAINtWr1trKG4L4ljGM4_ObsL849yyEFmVDl0k4evBIjNhxQrBTQ-sVzZaAqo2t_bd4BNXJkafJx1GEnd31F1aUQRJXyX7o71CNDg4HhlHz6t5DCAylhjkvUSQ7UObFFWnVvtNteTPMOlgTs2kFQU-qZ56IdPiawp3fNhbQ3sQPFKudXHSNz1C3Lfu7gUhm99jImM7fc1Hw0JxPKF80PMdu-KCASeVwXzsft1MXIj_2yTzxhxClrqnKAxHKlqJI7KDn7-tQyeL0bT4wu7dU5RH5zufnSWgWpgZ1eg9H0zsQs8yR1hJClv4MmM0sJaeRmqaaWXrVA7ltZkTH-bf5Wk2PJd6zM1wuY4yfugob9kariIIf5r8T6kmNBMC3BIOnYBolSTmSUHjd6Ts-yCwkiO4liFzre6VwBrBAM7gYbehfAlQmwA1Wd0N71RJ6ZTerZRaIcanGmONx_1jW6tINJCyZod0W0naxkQafCAoqozDZjN4QiTdcgZdQo_k_5nngfOwStSZdLmsPmGAtFv9sZOarNOdo5cDwZMslvopHcEuOnUs5i-JZe8_wDKbfimaVwmlYbuoepj2EPXsSp-Cxnppz7WVq6Pr4rA5_WN1LGUyNCn7h4Q3IN0ZxL9RBgg5kjlAOoJ_RcvdEW-UPvDMEh0IgOOQ6VVmZft-aKNzKOdLCXFCTcB5dMer4UptxvWOLdaD3kwmZ6ikBsmi_FFIslhY6UKxbW9sKSr8PxGM1DMcmKJhopK4zcd0Lf60vw6jQpp1JxH8W9g9Xgz1KOFzZLybvh9V7qyUPTHfFiZ4lwwUiK0OfOK51U9dNj3stfnX73BnINvNk6_5bb2vtglltMEhZdjpChj_NX78VX_L-JbuiW9mpuHCobV3LyfzR9fR72YXxF-iAoEsHYfa57-eWVXTeqbd7H3VK71R2RS3w8y5buj0hWAOiyd0C-LYFK2iPpbmHIaesUfjTzFot9zVCHAJKmbUEzSTKNF04m9zwe2YomT2nsUtF4xehuQJ-fCp9jkvFkW4YtFOKcQ_e2l_IfUwLvLKpb2Tq0unPbi6CQR56P5SHpTxM-zp_Msf7YJQ6nPEB_WI5k3akx7SZIdzsLKupAVtDWUTFf7E8uuP61MdHINE9KMsaqCWeYOKd51TcfZjfGqvxhfjo25zT4GMy_H7jMA1Z8uRvxvZbOTiYLEth2r2y8dJaNQk8VrjQ5OsIpxVYsRpItyLbRMmuJd-1WnKmJpuXgrqiwKoAFuwd0nzk3OjYVRT1rfhwXMp8hBwLoqxSxyx08EVLPuxW-gu8y-YoMia4nSKE5TVO9Jg&sai=AMfl-YS1twfUOy0ovnbWkFZUXcucP8O5V3r8MOi5l_zJPcXdKlwtOulpLzu0xQw94mXlRb-DJ47osnHq_xaydkZTKaQnzrGvKCM_nwnuYR9jwAA5265u1EI6O9HP44sL0kiZDqzMM-lxc1zKYowDEAZtEFmTY2NfYym3mVwGYpScqflk4YCaQof2aFTGOzKH1g3q66jy5vg9wbIZV_sH4027QyGxYED-nUfhGKSa2f8&sig=Cg0ArKJSzKOaKkPrO_oNEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=4704&vt=11&dtpt=2916&dett=3&cstd=1783&cisv=r20230725.74528&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:56 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 27 Jul 2023 12:37:56 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 08FE 0
596 B 15ms
15ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:56 GMT
an-x-request-uuid: b04591be-292b-4ede-ba38-2bad527b8773
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 694A 42 B
69 B 25ms
25ms Image
image/gif 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 2E8C 111 KB
39 KB 6ms
5ms Script
text/javascript 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Origin: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 02:37:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36033
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 28 Jul 2023 02:37:23 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/elements/html/ Frame 2E8C 11 KB
4 KB 15ms
15ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/elements/html/omrhp.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:33:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57851
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:33:45 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/ Frame 2E8C 30 KB
11 KB 12ms
11ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/abg_lite.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0b2c524428c1a3604e3d1cdc61c2ae371a8f2fc767f801180fcf892db9e07c3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:51:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78367
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11572
x-xss-protection: 0
server: cafe
etag: 5014499061205845695
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:51:49 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 2E8C 41 KB
13 KB 18ms
12ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:39:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57528
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Jul 2024 20:39:08 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 4269 111 KB
39 KB 7ms
6ms Script
text/javascript 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Origin: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 02:37:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36033
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 28 Jul 2023 02:37:23 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/elements/html/ Frame 4269 11 KB
4 KB 34ms
33ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/elements/html/omrhp.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:33:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57851
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:33:45 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/ Frame 4269 30 KB
11 KB 30ms
25ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/abg_lite.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0b2c524428c1a3604e3d1cdc61c2ae371a8f2fc767f801180fcf892db9e07c3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:51:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78367
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11572
x-xss-protection: 0
server: cafe
etag: 5014499061205845695
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:51:49 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 4269 41 KB
13 KB 42ms
12ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:39:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57528
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Jul 2024 20:39:08 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 0ED6 111 KB
39 KB 5ms
4ms Script
text/javascript 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Origin: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 02:37:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36033
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 28 Jul 2023 02:37:23 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/elements/html/ Frame 0ED6 11 KB
4 KB 12ms
11ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/elements/html/omrhp.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:33:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57851
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:33:45 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/ Frame 0ED6 30 KB
11 KB 18ms
17ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/abg_lite.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0b2c524428c1a3604e3d1cdc61c2ae371a8f2fc767f801180fcf892db9e07c3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:51:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78367
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11572
x-xss-protection: 0
server: cafe
etag: 5014499061205845695
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:51:49 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 0ED6 41 KB
13 KB 19ms
18ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:39:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57528
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Jul 2024 20:39:08 GMT

GET
H3

206

videoplayback
r2---sn-ab5l6nkd.gvt1.com/ Frame EAD7
Redirect Chain

https://redirector.gvt1.com/videoplayback?id=fec28ac6f2d4f8c9&itag=18&source=web_video_ads&requiressl=yes&cmo=secure_transport=yes&ip=0.0.0.0&ipbits=0&expire=1690468668&sparams=ip,ipbits,expire,id,...
https://r2---sn-ab5l6nkd.gvt1.com/videoplayback?id=fec28ac6f2d4f8c9&itag=18&source=web_video_ads&requiressl=yes&ip=0.0.0.0&ipbits=0&expire=1690468668&sparams=expire,id,ip,ipbits,itag,mh,mip,mm,mn,m...

1 MB
1 MB

79ms
35ms

Media
video/mp4

2607:f8b0:4006:3::7
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r2---sn-ab5l6nkd.gvt1.com/videoplayback?id=fec28ac6f2d4f8c9&itag=18&source=web_video_ads&requiressl=yes&ip=0.0.0.0&ipbits=0&expire=1690468668&sparams=expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,requiressl,source&signature=69A146842CACE97AD958CA4477060E6B2F85F053.4B8B5FB96F23367B88C9E8E9FB69D08DAA8D1C4E&key=cms1&cms_redirect=yes&mh=py&mip=2a0d:5600:24:1500:1012:1f8c:488d:1ea0&mm=28&mn=sn-ab5l6nkd&ms=nvh&mt=1690460294&mv=u&mvi=2&pl=48

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

2607:f8b0:4006:3::7 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

4108383f511f64504659feca1e4c398d2cdea7912a09ea7d5c5d4aee76c14205

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

client-protocol: quic
date: Thu, 27 Jul 2023 12:37:56 GMT
x-content-type-options: nosniff
last-modified: Wed, 12 Jul 2023 19:36:47 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
Content-Range: bytes 0-1470640/1470641
cache-control: private, max-age=6892
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 1470641
expires: Thu, 27 Jul 2023 12:37:56 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:56 GMT
x-content-type-options: nosniff
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://r2---sn-ab5l6nkd.gvt1.com/videoplayback?id=fec28ac6f2d4f8c9&itag=18&source=web_video_ads&requiressl=yes&ip=0.0.0.0&ipbits=0&expire=1690468668&sparams=expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,requiressl,source&signature=69A146842CACE97AD958CA4477060E6B2F85F053.4B8B5FB96F23367B88C9E8E9FB69D08DAA8D1C4E&key=cms1&cms_redirect=yes&mh=py&mip=2a0d:5600:24:1500:1012:1f8c:488d:1ea0&mm=28&mn=sn-ab5l6nkd&ms=nvh&mt=1690460294&mv=u&mvi=2&pl=48
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 724
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 006A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&gdpr=0
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEHdztYiEbvMxyrqqhU9Bo04&google_cver=1

42 B
723 B

544ms
136ms

Image
image/gif

8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEHdztYiEbvMxyrqqhU9Bo04&google_cver=1
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol: HTTP/1.1
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 8f31d5fb12ac7ec11f837ad8263e0f6c
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:56 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEHdztYiEbvMxyrqqhU9Bo04&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 337
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 006A
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NjRmMzdmMjY2MDAzNTc3Yjk3OWNhY2EzMzQyODg3MjNmM2FjN2VhOQ&gdpr=0

170 B
188 B

40ms
37ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NjRmMzdmMjY2MDAzNTc3Yjk3OWNhY2EzMzQyODg3MjNmM2FjN2VhOQ&gdpr=0

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NjRmMzdmMjY2MDAzNTc3Yjk3OWNhY2EzMzQyODg3MjNmM2FjN2VhOQ&gdpr=0
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 2dd9fa24169fa04536d533da131679f8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 006A
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&gdpr=0
https://pr-bh.ybp.yahoo.com/sync/rubicon/G9A_M_pahIGbqC5j-F0pmMn5EUdSAgOZEtemQ7w0kco?csrc=&gdpr=0
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-pJyz_29E2oLbMy84occ3Od7D1sAWnkLO0CqckQ--~A

42 B
723 B

177ms
143ms

Image
image/gif

8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-pJyz_29E2oLbMy84occ3Od7D1sAWnkLO0CqckQ--~A
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol: HTTP/1.1
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 636a4452fa95aad32992c06634d4089f
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Thu, 27 Jul 2023 12:37:57 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-pJyz_29E2oLbMy84occ3Od7D1sAWnkLO0CqckQ--~A
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 006A
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=a7485659-1d87-4413-a256-0b6bba4fa732&gdpr=0&gdpr_consent=&expires=30

42 B
723 B

136ms
136ms

Image
image/gif

8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=a7485659-1d87-4413-a256-0b6bba4fa732&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol: HTTP/1.1
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 636a4452fa95aad32992c06634d4089f
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:56 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=a7485659-1d87-4413-a256-0b6bba4fa732&gdpr=0&gdpr_consent=&expires=30
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 289

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 006A
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr=0
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=pUIeaqpNTsa44nOiIYIlmQ&rk=usync-na&gdpr=0
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=pUIeaqpNTsa44nOiIYIlmQ&gdpr=0

43 B
479 B

25ms
24ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=pUIeaqpNTsa44nOiIYIlmQ&gdpr=0

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:57 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: M3NFDPW1XQJG1N058DH2
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=pUIeaqpNTsa44nOiIYIlmQ&gdpr=0
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 636a4452fa95aad32992c06634d4089f
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 006A
Redirect Chain

https://token.rubiconproject.com/token?pid=36584&gdpr=0
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LKL540WK-1B-DXU8&gdpr=0

0
144 B

69ms
62ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LKL540WK-1B-DXU8&gdpr=0
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:56 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 139B07116EA64A04A1A1098A5EBB576E Ref B: EWR30EDGE1612 Ref C: 2023-07-27T12:37:57Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYBdzvawEGSsUwjzExxBw==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LKL540WK-1B-DXU8&gdpr=0
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 2dd9fa24169fa04536d533da131679f8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 006A
Redirect Chain

https://token.rubiconproject.com/token?pid=25470&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TEtMNTQwV0stMUItRFhVOA==&gdpr=0
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&gdpr=0&google_gid=CAESECIBZlV3PtEEjgV1_JiF5Ck&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEtMNTQwV0stMUItRFhVOA==&google_push=&gdpr=0

170 B
188 B

44ms
43ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEtMNTQwV0stMUItRFhVOA==&google_push=&gdpr=0

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEtMNTQwV0stMUItRFhVOA==&google_push=&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 8f31d5fb12ac7ec11f837ad8263e0f6c
Expires: 0

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame 006A 43 B
855 B 451ms
170ms Image
image/gif 67.220.226.232
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&gdpr=0

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

67.220.226.232 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:56 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 3GR7TJX6KEPMWX9Z5N6K
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 7FB0 1 KB
647 B 18ms
16ms Document
text/html 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 58808
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:17:48 GMT
etag: 48472445140208031
expires: Thu, 27 Jul 2023 20:17:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 23A9 599 B
703 B 53ms
43ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 093626f49d96d77fee2eeae8dcf270e261de117e17b820356a12c6112b0bf50d

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 396
content-type: text/html
date: Thu, 27 Jul 2023 12:37:56 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

POST
H3 204 AGSKWxVePXm0lc3dLSnp97HygheM6vwdhOZQ0Klsh22k2dcSzBMfETX3hrlgn7Q3Xaf-mi1hu2owsuNw6hVnwRTUF5MM18JaFgVR2EoaW6ik4ebowSqaMVt996O_8znMFy-33AGAJY4a2A== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 44ms
43ms XHR
text/html 2607:f8b0:4020:804::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVePXm0lc3dLSnp97HygheM6vwdhOZQ0Klsh22k2dcSzBMfETX3hrlgn7Q3Xaf-mi1hu2owsuNw6hVnwRTUF5MM18JaFgVR2EoaW6ik4ebowSqaMVt996O_8znMFy-33AGAJY4a2A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Kab7ghMNotAbj_V_Rx3cMw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:56 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Kab7ghMNotAbj_V_Rx3cMw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxVePXm0lc3dLSnp97HygheM6vwdhOZQ0Klsh22k2dcSzBMfETX3hrlgn7Q3Xaf-mi1hu2owsuNw6hVnwRTUF5MM18JaFgVR2EoaW6ik4ebowSqaMVt996O_8znMFy-33AGAJY4a2A== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 59ms
58ms XHR
text/html 2607:f8b0:4020:804::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVePXm0lc3dLSnp97HygheM6vwdhOZQ0Klsh22k2dcSzBMfETX3hrlgn7Q3Xaf-mi1hu2owsuNw6hVnwRTUF5MM18JaFgVR2EoaW6ik4ebowSqaMVt996O_8znMFy-33AGAJY4a2A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce--KO7zQZ0JuQRW8xJP4Yp4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:56 GMT
content-security-policy: script-src 'report-sample' 'nonce--KO7zQZ0JuQRW8xJP4Yp4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxVePXm0lc3dLSnp97HygheM6vwdhOZQ0Klsh22k2dcSzBMfETX3hrlgn7Q3Xaf-mi1hu2owsuNw6hVnwRTUF5MM18JaFgVR2EoaW6ik4ebowSqaMVt996O_8znMFy-33AGAJY4a2A== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 56ms
54ms XHR
text/html 2607:f8b0:4020:804::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVePXm0lc3dLSnp97HygheM6vwdhOZQ0Klsh22k2dcSzBMfETX3hrlgn7Q3Xaf-mi1hu2owsuNw6hVnwRTUF5MM18JaFgVR2EoaW6ik4ebowSqaMVt996O_8znMFy-33AGAJY4a2A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Wp_zNzZFnWfm5QjbyUrONg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:56 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Wp_zNzZFnWfm5QjbyUrONg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxV4NStbbDCRCtQ3zywsQRJ2mEiSB499oHqzA1zqUBDpog88NxTN-8rkDbUEa8jabesRpqUq1Sw-ecvN_5CCiPJKw5eZbmWqRT0fpO0CKXMmAQZKRixiY6yFsor2mRYJOCrg6p5rrg== Show response
fundingchoicesmessages.google.com/f/ 4 KB
2 KB 60ms
60ms Script
application/javascript 2607:f8b0:4020:804::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxV4NStbbDCRCtQ3zywsQRJ2mEiSB499oHqzA1zqUBDpog88NxTN-8rkDbUEa8jabesRpqUq1Sw-ecvN_5CCiPJKw5eZbmWqRT0fpO0CKXMmAQZKRixiY6yFsor2mRYJOCrg6p5rrg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjkwNDYxNDc2LDMyMTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vZWhmbWMtY29tLm5nb250aW5oMjQuY29tLyIsbnVsbCxbWzgsIjRVYmtnOWIyTGE4Il0sWzksImVuLVVTIl0sWzE5LCIyIl0sWzE4LCJbW1swXV1dIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a06914792084314bea9e1f31fb1c7708bc2b9bce29feb6fcdc6397cbcdc3f489

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-tsICujvlAWT4bWXnYZujGQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:56 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-tsICujvlAWT4bWXnYZujGQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js Show response
pagead2.googlesyndication.com/bg/ Frame 6F11 37 KB
14 KB 11ms
11ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4f9e4b1838819f2fdbc6eea07e712886701f71a49ff22a445a9be3d5c7d806

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:38:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57578
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14628
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jul 2024 20:38:18 GMT

GET
H3 200 XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js Show response
pagead2.googlesyndication.com/bg/ Frame 32B8 37 KB
14 KB 15ms
14ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4f9e4b1838819f2fdbc6eea07e712886701f71a49ff22a445a9be3d5c7d806

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:38:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57578
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14628
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jul 2024 20:38:18 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 1110 2 KB
3 KB 64ms
12ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=9081179&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: ca42d8391902ea4b3a448cc32c6a23048748b2b4e05075264dac814e0c4a490c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Thu, 27 Jul 2023 12:37:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E15E 1 KB
647 B 43ms
11ms Document
text/html 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 58808
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:17:48 GMT
etag: 48472445140208031
expires: Thu, 27 Jul 2023 20:17:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 2E8C 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 72f15ed169307b5d177c30e48a02c169289cb478e4708db1987453efce64591e

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame D8C1 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1f7124be4ac37cd330e0c1a2d8642ec530cd62cdbdb3b9bd1cdb87945850a145

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 49C6 1 KB
647 B 16ms
12ms Document
text/html 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 58808
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:17:48 GMT
etag: 48472445140208031
expires: Thu, 27 Jul 2023 20:17:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 9504 1 KB
647 B 41ms
12ms Document
text/html 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 58808
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:17:48 GMT
etag: 48472445140208031
expires: Thu, 27 Jul 2023 20:17:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 0ED6 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0a64f897c861028a39b652b4d331d7dc8e0dbee661f957f63c5d41656dc12744

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 4269 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b6643c8f05a4e9f3b69d7572a78e2aba57e62ef066caf350e5e5052bd5837177

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 10925881766127972509
tpc.googlesyndication.com/simgad/ Frame 9948 110 KB
110 KB 17ms
16ms Image
image/jpeg 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10925881766127972509

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b858be02dc3216e4755794100bd1f703f5cc3ea767c30bc4db21bde4e0c92c63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 12:57:37 GMT
x-content-type-options: nosniff
age: 85219
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 112390
x-xss-protection: 0
last-modified: Wed, 03 May 2023 18:47:31 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 25 Jul 2024 12:57:37 GMT

GET
H3 200 12385176290511739714
tpc.googlesyndication.com/simgad/ Frame 9948 3 KB
3 KB 18ms
17ms Image
image/png 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12385176290511739714?w=100&h=100

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

69734d13741cc5ca9265f7ad17cce7f10b368114c1987b9090ff432bf023f881

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 17:36:02 GMT
x-content-type-options: nosniff
age: 68514
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3164
x-xss-protection: 0
last-modified: Wed, 21 Aug 2019 22:06:28 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 25 Jul 2024 17:36:02 GMT

GET
H2 200 data=ND2Oocuue5esw60BsUbOwqsVB08HEAGsAthShMzV-c93gK_c6JekZEcJ92L2QoeFWyXncaxnBnFs6mx1QQ
mts0.google.com/vt/ Frame 9948 45 KB
45 KB 41ms
40ms Image
image/png 2607:f8b0:4020:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mts0.google.com/vt/data=ND2Oocuue5esw60BsUbOwqsVB08HEAGsAthShMzV-c93gK_c6JekZEcJ92L2QoeFWyXncaxnBnFs6mx1QQ

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ddaaa1485813026c0fb6c2c3b27e9876ee1528a8e65a9e82e1becb4da260fdbc

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'; base-uri 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:56 GMT
content-security-policy: script-src 'none'; object-src 'none'; base-uri 'none'
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
server-timing: gfet4t7; dur=26
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46180
x-xss-protection: 0
x-server-version-bin: CggIBBCb54KmBg==
server: scaffolding on HTTPServer2
etag: 0c3f0e7fa0e727737
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2995
expires: Thu, 27 Jul 2023 13:27:51 GMT

GET
DATA 200
OK truncated
/ Frame 9948 301 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 651fc5051db295a80ef0ec8faf17ab61562ea6e220be33a1a127263e3681a491

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 9948 418 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ebd902c796e15c5ea443dff52f3581b7b0076a00fcf4acce32983a48d27d877f

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H/1.1 200 371.json Show response
id5-sync.com/g/v2/ 595 B
1 KB 96ms
94ms XHR
application/json 141.95.33.111
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/371.json

Requested by

Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/libs/prebid/avpb7.51.0.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.111 , Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

a55f3c63b31e82fd8a07d1dbd1ac963a1e4a377ab3da29eec85c66d549d2115a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:55 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
p3p: CP="CAO PSA OUR"
access-control-allow-credentials: true

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/ Frame 6763 30 KB
11 KB 12ms
11ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/abg_lite.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0b2c524428c1a3604e3d1cdc61c2ae371a8f2fc767f801180fcf892db9e07c3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 14:51:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78367
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11572
x-xss-protection: 0
server: cafe
etag: 5014499061205845695
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 14:51:49 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/elements/html/ Frame 6763 11 KB
4 KB 11ms
11ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230725/r20110914/elements/html/omrhp.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:33:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57851
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Aug 2023 20:33:45 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6763 0
0 56ms
56ms Fetch
image/gif 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuwOn_HeXkKgU7KbLPBrYZbudMqYmCG7dglkeHvR98K3Kf85olwIIuWOIyoVrxRJEDSdfqEq5bh_GSAVQM7CFJYKql6laMo7oj03ZmWf0cNmSITfyIJVgdFLzsdiqN87dwFozsxt2XxNpmbUxPz_vJ4sCHKVbtDhFAqGGA_hBuNItYl_sH-JiQI1j7woHCjgRwubgo9WDSGxWEY8_-nNVceeIykU_aHkJCqw9EeRqtngkvlVK6q4AqT4o9_jAHs5p7-kh3uiaU6Iv3GdUP0msRL8mpuPjbr2tlfAd11t2DY2sgeR5vMvkVgYOHbvEnFbji3v2vbaE3uh4tmPORTWr_Q74AiqkDHplma7sdG3xbUNfBVseYyrDqPmixShHXsYcms4T9FcsXu6fdkPPW2c9tO6xWWHvrbj8TJugaJSxu16_8jTOYf3ynTPnNqiDydl5gfue16trMeTSNIcpTv-01XQhDff6gto0xmRcjtyTXbGaYQexwovh545GObYC58EifmMIZnx0mLMPDa3zHwSXcM6MGXBd4GiT4SYXjcJZkXHvPSuMnJSEA7a7_b_m9f2P1EbHBx2j-jxuNn-W3XQ-n2zSa0-ncjlnWspHCNk3jRjaOcQ9S4xGNc6TGPM6LRYvkXd8ohGJK9GXlx1-YcK_gNQGTE6LlUSPJvo08sQ1KWL2EQHPxIqp38tOY-Xzr4bYMDg99AHBIM8HYktsSyNw43wA8QT7EH9qA02XlR3Ur-xcgYfeB9AR7O5n8QrfUOktSDFlQL32WU5b7_XU9rvNm7Vd74YkdGJcnyjIv2JCaKIxgT8Sgk65Fn5vteN0n0R0fWU570vef1EsjRNB2N9JHHHGehPnb9vAaSLoLupYpuh4cmcuAn4npytoTtZzmX8hyVPbfYrpI9ywOrupPQ4xbJTwKeyJCiS4-9thPY2MCB-U1BLjxMoenZ_PcVVPtFyVoLv11QqjQ8Yh59C83ykZAA0cvDrDsXX-WMnDKwKgeTVlGplgTMpSJq5X2y4iLcqIKn75zxJsaDBPQuevXCfCebvHbj0xKfKdilP0nAsmpLEsMbuea6mxf4UGySvEM5kKFBoh1idZFoHAVAJ0onZgSulK7OTx9APOKSKXsvgW3NmM69JbOzh57xjzpge7twi18lc7oXf3CeG3JIDvIc_cAtXM6dML0cVZvc_F4giZEnj4dBuU0HXBz6rqFqn7Aqfm-7GRwPerSC0OPrP3EVSpHoErToFYQRdWWOPqyJK7Nlk4mB60LvvTsnI_ohFv7rCRfeiOKi3OlWyNBv3rYYlPEFh5AvSdNyS1gy4rYJ_GCsx9rDEwcn&sai=AMfl-YQy2NXuNMkiah0LWP9SfTM1mx-gtbYflLSTmBtAwcjjCuerbC3jfv_t4RYKT9FOECNMQNcoPhvZfBJH91nLr-VVgYIDNyRY582eV5iZw-VnyUOO_nCjqVcVtbwMIfrIbNYxxRn7MGas3Y2CYChvs6Os44ARbKPTpfDLY4rN2J1paBEhaRnA3CyinjGKVXy4eD2kzQp29H7-Llo9Afx12RBOF3Le8AKO38G_oVAFfyyHJsg-nf2Us6cTUMDRgHzfovcY&sig=Cg0ArKJSzCsDs0KwcNgWEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20230725.42222&arae=0&ftch=1&adurl=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CniH6uQRZW3msEMco4ZnqpJ1PLIzsvbc3O7dWUisOU08RuwpJHrO3ukHAIC12Vz-s9DClWfII0xtvWNtiP32-yIM79tQ&cry=1&dbm_d=AKAmf-DqM3CxF4M67UG565S5Q5aVMLz70h25HJIRIvHL8EkLB9Qw9llw_db2Fw2p5VkMwVtPzqpxOWo6YAhWMvz5AI0ZGT4ljYTs6BtjHXK7njt4H3RubiZUL5OLaIseDx86vSctjjEShGZDFndW8x5TBz7rknYIz3fId6-ob13GVsVVQ3AFh8HKuVdBdDaw5PUAHgrHsK8YoeLaSa-WnF-vQy56KmQdj2UDlnurnry-RfK1W4iZx26TUM32WDa6u8F-XIY9nH1Tl4F6vO93d-7omaE4wL54iO92OouFt8IA6oMXjPSv2VsbTnTqe9I-Fij4WZZdjNTYGysM_mVQ9sexxbYWOrgEx0lE3fS-uNMGav47f-8YsEAmvcuzt75_dwIjoLKgES9shLPKXvU6OqJXaKqVE-ZWbnUETBN3wzvOJiz04MTVxjc2mLkp56p2bbtot5MRrM6BqR93bD5Vs8WhxKsCuehx9IWPvHYeG4Ft6EsmoFh-CGORg1fYhP2bRcvJlxzD_1wI7WHB3AxQ3Rx4a9po2o__5KBYuhzffPwJ8kCQo2ghxKEmS26j2wLTJJOtQffy7qNOaYmwzxPhC68lIagSuy_AjteD6hrRCyflTpq-EZZC7SYsU7zYeXgp59ZOA22hcxvyBkys0V825vdXW_qlZtx_YleVpVTDDbMdijDto-gHyfWptIxuKA5hJwGrZq0866Kz0IsMGsSyDChIm6Etn_Wqc7VlCG_NZdMj2ULo8XfsgFtZw4GB5e2zC58kgJrZnfEaqLDYqRHOM4moPT8L7c4OSh2Dk8os8J9a9bT35SMr6dSUBqz308ElIB6Kl25k67-1dDzGd8mSh4xd_zYJuEIuKo5ihfxG2vMHopHdHOhCLRbT2tIXwFDgHho0Bp2-5vEwDMt5BKnbCsWkuTAHZY9lJlPzvjSpxIZh8r5TzPosQaGz42ZkWPeHOlv6gXD9Of5xVB6CJFoFwwrFzgl8WBA-2jwApbVyYGuo_WmopNt0hT7XGWpsD4k1RqePjVnHLCmTDBB0w8r8V2yy4WJYyVm5TVKtmeNfbTmprLjsxNs4ZxVqUzzn2X_umDV2BiiEX00YH1yZyoNSF6KGzglUHD5FtOtQdDhyxJ69BxNFoynU7RPRVWB9W7FIohJUTld_J5R-nPWSCFS1LOnWYgPPbXqUe7phWPblPpXTZfDyXwFJnEMTcnhTeXjFCMbp2CFDcDGx52jfaCCX4ukwtAwEmhYRyXK-Ko9s4W3rGqHHD6IxvoU9k3LOIOTTd3OBYejdMVMz91fdRCll_85seOM5a39DpbEmKuPw9-VI6VtKzjJxyR1P1xOUlDynknYGkAEc0hPKByv_ao1f68fr6Uer2zy7SsLx0Yg8nZGSO8lxo3rfB2uxAnF5dMW8pKt-9R4pQknUPHW-Y3i1pprCuAdCMfZeas7-pxvDKa30Vk1rJLvO2NvjBITqK8Av3sBeO-yh2vIpd_bf9NuJdxHDZFKZeGA3g5KE4hdP-UYPCZkgt6bJIDxKKSAeN9Ez6vlveks9Z59Mxk_rNQqXm0KCiv9swQHq7Rgaoj_L90pwPAoC-KHyhi1adl24TdUjZzGwNUi8EDJFLL0rvzzjutESFuuxDDMv4QCCnZCXgIts7VPvHLZJaMvvS1W7z8GAen47fIWgY7e-NlfKyPWObeAGnU80yQ-ycL02zv8XJjpz6OBZYpxB_ARFk5dzMEgdgqr9zPOvlRke-OTauDNNJObTgwAnE3rspHkhYAe5XjbffUwFmfreefl-poT-qcTBEVoW4nvZ21uwiQTcqGrrRPdg6IwwhAd97b5ZH2-4NS-FY5bGET8OJE1i6AUbD0zvRYIrjWsxZB0vGKmVIOC7qikIdQq6uHblSxJx6_jUT3Jp_yQLxRo36jKzJHfr086lrWlp1u7pt3H4uSZTkcGjX63NmCQVNQT6VnabYJox6IpWZFCQEMIAB0V723lOXt_NyyGyYACZ4CfOM2aMlqHG4yiV5JpNUW15PKm7OuY-iCzCN3T08VWMUrFFjPpdCxzTLSP_WD3oz9PocFg6Rt_ObcieYdaPVLqxbm7D27MpMwWDv6e7muu9vImfihPCl4FvNI01HdPcQioWYhqhfI35zDUQdQgEVvN0TR73MiYig8MJa4MQzrwnl0PlxM86XuUwX7_nFpi7joFHmHZG6xW4vwFUG_j-OQvJpvegewTdqVPR7VAjEdNEw3f0-9JpJoWGM4y9esJ8QcTHzJZteLBNMPgfBxJUsnQtXhhVYwJ3JN1kSlpeVWS9ISUfUbm1WiItIRoe-eLKwg52QOvrdl6xwVon9F11r1FfvaVoqXBV_LqtvNRmR0yOhxwy2H5UJn0vzV0wAB1Q7pOwk8gvgF6J7UKW3BEKw4BRPOmvv8FvylqCy_H64NO_r88Zg2-4HfEYnx1Io7Gc3qUFwHiKTKZFPdXa2lrBguOHrTQkQrZ70IRYwkjjZOZ8u5aJklIZ8FQfzPoNP5a6HeWjS8AHRkRv6Kjqv95JQec4RoiEuroys4cGqm90A_yUZUPi9haYB5f9NeY254bn9kr8EHPaYcQ6P6gJqfobVKkNroLwAint76yBGbhecz38bkbR1_T6tHfnnjL9biBkTmJacN8hO8uV5fAYPRDaPEuwB-P9G4m1u82ME4E0uPFbopgayV9vMN2YhEZAyU8833HJpukJYyu861EL2y2ckBGDH0rjkyUddr10g26xdaMrB5m9MYCSgqkvQaTLWvMxYLybOFnfmAkZyLCQrZEe6O56bXUCX0WgR5EQ38gPejq4vVB6CXLZs_WfNj1IE1Fa5XNb8ImpZwR71BTe90C-9QXOJfhxFkTiqzjXC-WYgML18SDM87KQ2mhTf72y9KSzkthbYccpVLM3WWjdAlE57wqiRanhyqalP2rSlENZ3GyOrs8qqGQqBFF4gwpS6c7xW84lQVYlwwbCbcMqEYhqCSZJTtmU99bcH2VAwcmJte48rO2VwBDMQPhbWBfa79SpANiU8RcI0QXH30k_EPljCRFWGgQ5ufHZVLiqPoPyJTtvpiEQgKs39l2aMzKt-3DfACaAVgqkqDkSDH6vikGi1CLRhVeXcksrL0PLaw01EN_dWULTEMPM4eNIEzE_d1-Qw1Xh6S-zKf4KHMq0giOpVbST5Y_yaoc7r3buxs_S2MTNzCMkFevwdyz5vNbxjdSabOMmteaLqdAoG9-MqLk-yl6rLgX7QvorFdAwKqeHSZ4kYF4JYn9nSqDkBn_De35VFQT7eBPXdubte3Bk9XOwpzfzUHLSjeZFMHqYraF8v5kueGhE3PUy_BTfMkhi6cQfWYpj6IspK1UPl634Vu6xz8_7ylM_n39KWZmnUUFFdtvd79WARQgiGJ5_GjnTo7nC-717&cid=CAQSOwBpAlJW3dQ-QMz5GQqh2jjA9erD_ziRWv62M_GM0UVkWJjQaq85AphEjGrEO_OirnSv6qyeA14NZ9rBGAE&dv3_ver=m202306200101&rfl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&ds=l&xdt=1&iif=1&cor=332138546669845250&adk=3516262639&idt=93&cac=0&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 27 Jul 2023 12:37:56 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:56 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 6763 41 KB
13 KB 12ms
12ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:39:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57528
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Jul 2024 20:39:08 GMT

GET
H3 200 528348308845545142
s0.2mdn.net/simgad/ Frame 6763 9 KB
9 KB 4ms
4ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/528348308845545142

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

99a5efd4ae1520dbceaedea2e67dbf81054859c84153951d783ecf5fc44a98a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 22 Jul 2023 14:30:17 GMT
x-content-type-options: nosniff
age: 425259
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8772
x-xss-protection: 0
last-modified: Fri, 17 Mar 2023 18:11:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Jul 2024 14:30:17 GMT

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/ Frame 23A9
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=fa30aec2-f7be-4088-93a2-3273952b5b2b
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=1955&partner_device_id=fa30aec2-f7be-4088-93a2-3273952b5b2b

95 B
438 B

40ms
33ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=1955&partner_device_id=fa30aec2-f7be-4088-93a2-3273952b5b2b

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

ec2-3-225-218-10.compute-1.amazonaws.com

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:57 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

date: Thu, 27 Jul 2023 12:37:56 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=1955&partner_device_id=fa30aec2-f7be-4088-93a2-3273952b5b2b
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58294/ Frame 23A9 0
342 B 21ms
20ms Image
text/plain 3.225.218.10
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=d28a5eb7-74d3-4746-8a64-6baf31046e4e

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.225.218.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS/9.1.10.64 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:56 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.64
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

396846.gif
idsync.rlcdn.com/ Frame 23A9
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D%7BOPENX_ID%7D
https://id.rlcdn.com/464246.gif?partner_uid=a988a258-61fe-4b6f-863a-2a569f3cfbff
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=a988a258-61fe-4b6f-863a-2a569f3cfbff

42 B
60 B

32ms
31ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=a988a258-61fe-4b6f-863a-2a569f3cfbff
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Thu, 27 Jul 2023 12:37:57 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=a988a258-61fe-4b6f-863a-2a569f3cfbff
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 23A9
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=7437480408642019502

43 B
61 B

75ms
42ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=7437480408642019502
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
an-x-request-uuid: 042b2e5c-917d-4c4e-aa6a-907c45144c8c
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=7437480408642019502
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 23A9
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=4093334856250701331&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

72ms
41ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=4093334856250701331&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=4093334856250701331&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:56 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

sid Show response
mug.criteo.com/ Frame D440
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=ngontinh24.com&sn=ChromeSyncframe&so=3&topUrl=ehfmc-com.ngontinh24.com&bundle=NX82RF9DSGxqbEFRODg0WWxkN0dSWmdSa0d1UmxOMU0yM25aYXdwSkQ3N...
https://mug.criteo.com/sid?cpp=hxlWQ3xQc3V5VWVZQjgvbnhKSVJOb3paMk9nU2ZadDlpUzNSVUwwTUE3S3J4ZHljbkE3ZGFHeFJaVmdYM2dIQzFMOGFDUVdxVUpabURpUHkydnphMGEwd3I1MllIU3Z0NlQzMTg1NXNSaUszejJkV05MQW9ZVUkxbTk3Wj...

422 B
653 B

65ms
5ms

Fetch
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=hxlWQ3xQc3V5VWVZQjgvbnhKSVJOb3paMk9nU2ZadDlpUzNSVUwwTUE3S3J4ZHljbkE3ZGFHeFJaVmdYM2dIQzFMOGFDUVdxVUpabURpUHkydnphMGEwd3I1MllIU3Z0NlQzMTg1NXNSaUszejJkV05MQW9ZVUkxbTk3WjJhM3diSHFzVThBMU0rT3pETVppNnA0c3hlNG5lb0VXeGQrYVd2MnZQT0ZaL3o1bzROdXQ5cFV1WFFEbkovakc4ZnFDSEZ5bm1teE1IeWNqa2tMQTdhZWtGdi8rK0dFditYMGtuNjQ4RExzaFMyNjZ2azNCK0w5aXFQYnhOV2gra0N6eDlSQUQ0Y2dyV0xUMFI4MmlPeURGSlFzbjh2NmlnNVJYdk1YUC9ERnVUNUpCc0hzdz18&cppv=2

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

cf1167fd8b02c77c0fd0da7fe31cb432b36d6687ec330497c040c80df341ffca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:56 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 854287
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:56 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=hxlWQ3xQc3V5VWVZQjgvbnhKSVJOb3paMk9nU2ZadDlpUzNSVUwwTUE3S3J4ZHljbkE3ZGFHeFJaVmdYM2dIQzFMOGFDUVdxVUpabURpUHkydnphMGEwd3I1MllIU3Z0NlQzMTg1NXNSaUszejJkV05MQW9ZVUkxbTk3WjJhM3diSHFzVThBMU0rT3pETVppNnA0c3hlNG5lb0VXeGQrYVd2MnZQT0ZaL3o1bzROdXQ5cFV1WFFEbkovakc4ZnFDSEZ5bm1teE1IeWNqa2tMQTdhZWtGdi8rK0dFditYMGtuNjQ4RExzaFMyNjZ2azNCK0w5aXFQYnhOV2gra0N6eDlSQUQ0Y2dyV0xUMFI4MmlPeURGSlFzbjh2NmlnNVJYdk1YUC9ERnVUNUpCc0hzdz18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 428856
content-length: 0
expires: 0

POST
H3 204 csi
csi.gstatic.com/ Frame 9948 0
17 B 394ms
394ms Ping
image/gif 2404:6800:4009:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~lkl547g2&c=5556173689242&slotId=2778086844621&qqid=CN-07dzzroADFUijnwod2IEIKg&sei=44730425%2C44752538%2C75259414%2C420706098&nsei=44714510%2C44729911%2C44730426%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=ulc&ulv=1&ua_e=1
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/5529604523bf1021996c9e114ecf8778.js?tag=video_location/web_och
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4009:800::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/10215220780491718443/35978-4_PG_BRD_HADA_300x600_PR_LM_4_04-2023/ Frame A82D 74 KB
20 KB 5ms
4ms Document
text/html 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10215220780491718443/35978-4_PG_BRD_HADA_300x600_PR_LM_4_04-2023/index.html?ev=01_250

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6e0c014d044f379c5b1645c547c5c8fb34f8127268af02b6e5b42582a9f43b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 520431
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 20160
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 21 Jul 2023 12:04:05 GMT
expires: Sat, 20 Jul 2024 12:04:05 GMT
last-modified: Mon, 24 Apr 2023 19:14:20 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame D8C1 0
0 53ms
52ms Fetch
image/gif 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsubISz8OPTbrHPKutHPPMpITqLQWn8ePc3dc4ma7y4M_B_0xsaDr_8krr4zkEDiBEo4f1036HVNHX_LWpcQhKO5Wfzta6Fqo0GRP1nn45AsPgaeeSYo8Itv65aunUA-NvWwirsL4GfBPG5IAdEkqJxvtuINIXrHSCwa0rkeLjkWcCNyLfKGHHu-_rvqQWmNQONtCX4yH3vlHIsEG-D0xNXCF4CzZh2O5vYaANJuBtGhhyPFRAx73SYALaXZV4QBCnEWcQbpnhqvg8-OYbqaO6DjC06ZEVmwGGHexif577TXyWxoPG83SDekgXYsVBJKnKrNMdF3cT8tJ8MTP-W9hlxyJKgmKNwx898NIde6XCuI5d3HZ88qKcMKbTzOT3cTD-v4gnpmT89uku0jD9OhX5D_k2rdKAqF2euinI3_ZLwTy6CFMCxChBhIr6kxc-2v3DOO9sfShg6X0QvMS8N3BbOg3i2xIm8aS6-t7PKSSS4WoS-a7niyr-fpuWsIibM1mN1t1TUzpEu5Gxl1wQIKRkVezUIjpCVId8qacIsG33r1W5R5qZRGEy3kOpwdmucQ4UpbolxHMDGHejKB8-0kg9EwDJ8FtDvpIsRhburJr9wziHR0P1wmSa3qXXya4ldm2XVOREF34YaPjj9xu75iHovRBzg_DcjA8ftqBzdXazxHFC_DfOFgYiZs7WDBpXRlZZDb8iR9HaqDq9jFmwfv4wZVXO9surMMf52sRGek6wrhHqEdhZ_V3tnBKPQ28XcXx920VojJ3XwFNsZAJehk6L0-Cy3dwALhRdkOyEqtm8Z9_H10_2_v_B36Dys5Bx2j_jxnuW5cWAUChh6GY6BrDeCub92D8ILqBIGb4VxyxQlSkuDYRSooAUpmPS93A4klqjPszQZguTmxbiucbkD2qQWTgUkJ0qXB6NYMoawfGGon3VH0NQvRWppRAROQ6oTUaUSwEj1KdELfkhC8UojvzVjjGL9FK6nz_qmQ5ozG8tHEu3LhuQ5uAS7vL7e7yBkiDD1WDB-Sl-6XMKfh8hqwddWno3yNvpG4IrOG71OxnhY2ObZ1GMDldebI8PluQegapY9WqZuQ5jreXBZW1tbENbIuZlpc_cMPbkj6gNZ4ycrPOs92LAA3kldMmNDf-G9w2EWSv0GpLKuVFo2JigIiRCf_tIe4dJRAEdsXwfz1xZlyaYLgwGpSswR12mO6XujJBan1m1WnlnPP8vBsSSLXHnP7JIkiyA7nmDOecJYN9yOC0Pp17GJkih-qZq5So-pEE4W_HrDzyDzktQ5JuvVDwsWxe7WHQQ&sai=AMfl-YShww8JQb1kwHDObjutDIMnZTqufu9anQ43rbVtNQkiLP0FMCfAu6WeecTcH0a14w9xyyYC-lxFPz41YGYejbRS3BAd4tYjv2CZow1Z7vpQiGEdJZtiZ6rfdS00Z87REfyeP7Zwjq0twagVO86Py5b3f1zTDHQPq6nnuhE--mLL7-prNmKrun5MBlmYEqUF31LT4jgYKs8Is0XnuzBA-HfM6X1f7E6n9rAVWbIls6_0e3sXr4kImb40A1RhpMg2eXD6&sig=Cg0ArKJSzKXX9gB0MqUfEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=934&cbvp=1&cstd=925&cisv=r20230725.81447&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 27 Jul 2023 12:37:56 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:56 GMT

GET
H2 200 manage Show response
router.infolinks.com/usync/ Frame 748E 10 KB
2 KB 67ms
38ms Document
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1870.002-3.027.ab.1874.021-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c771162e2783a0c6bbe0ce5d38af1976ee795e6adb627de0e8cd99ecb55b8732

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store
cf-cache-status: DYNAMIC
cf-ray: 7ed4efc6fc624388-EWR
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Thu, 27 Jul 2023 12:37:56 GMT
p3p: CP="NON DSP NID OUR COR"
server: cloudflare
via: 1.1 google

GET
H2 200 lcmanage Show response
router.infolinks.com/usync/ 281 B
303 B 76ms
39ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/lcmanage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1870.002-3.027.ab.1874.021-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b6660e47c90a0a23c1d33cd0fb530c3fedd4f734518f6c747ddf2d0d436d1b06

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:56 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/javascript;charset=ISO-8859-1
p3p: CP="NON DSP NID OUR COR"
cache-control: no-store
cf-ray: 7ed4efc6fc634388-EWR

GET
H2 200 gsd Show response
router.infolinks.com/ 327 B
493 B 73ms
40ms Script
text/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/gsd?evt=afterGSD&pid=3245929&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&jsv=1870.002-3.027.ab.1874.021-3.027&_cb=16904614769200
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1870.002-3.027.ab.1874.021-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8cc8d454de6b998c85d40a949a092147d8dbad625785e8fd552e004d9b94c8b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:56 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/javascript;charset=UTF-8
p3p: CP="NON DSP NID OUR COR"
cache-control: max-age=0
cf-ray: 7ed4efc6fc654388-EWR
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 8B1F 1 KB
647 B 13ms
11ms Document
text/html 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 58808
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:17:48 GMT
etag: 48472445140208031
expires: Thu, 27 Jul 2023 20:17:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 44B4 0
0 51ms
29ms Fetch
image/gif 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssQ8Pyq2zgcn1OLKTkcrOET41OCgCjVUzMCW8NUsYOq4CcCEqHVNkHIfu1BN9sfegYHUG8XejljsKWK_CopJZ5Uy8LbZeSggXmHcSJJYChtwp7NuqZ-OJvP4x6ubGvOGxh1SsWxokIaiZdDDD4nCBf95jfVohjORH-a0C_xIafHiY81uxQATGSed1_VEh6D9CxU7mdnrHQy4i2e0G-75_AS0zLy1wUG87nKh3eYu78UGEJhzMaYJqKsx2WIx2vsyl83PvpdipaFkxLjzSbCY5uITHg6A7Jmbj5upMUi5KEMR5uJ3CkpShj7_-ZGIj7UVSHRRwPMEJZw1AVhkHGi5GFaAS314sW0ikM&sai=AMfl-YQw7haookogVkwaBsLzWywDZK8H9YWax7fF08npKuYqlN1HSwYG76tuoP8tHxS3eLSWGo0Vynq_mqKGUqw3BbMi6WOXIOZ-2S-FqIRDpm7R1GULTXLDE6BRUryQLQ&sig=Cg0ArKJSzAHdyBU50gSpEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:57 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 27 Jul 2023 12:37:57 GMT

GET
H3 200 XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js Show response
pagead2.googlesyndication.com/bg/ Frame 84CD 37 KB
14 KB 16ms
16ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4f9e4b1838819f2fdbc6eea07e712886701f71a49ff22a445a9be3d5c7d806

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:38:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57579
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14628
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jul 2024 20:38:18 GMT

GET
H3 200 XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js Show response
pagead2.googlesyndication.com/bg/ Frame 2E0A 37 KB
14 KB 22ms
22ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4f9e4b1838819f2fdbc6eea07e712886701f71a49ff22a445a9be3d5c7d806

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:38:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57579
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14628
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jul 2024 20:38:18 GMT

GET
DATA 200
OK truncated
/ Frame 6763 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8b9b1a6e7ff4845868c3ff4776276639d35564783dbacc70e8da600c581fef38

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/15571588451724435493/ Frame 03E9 39 KB
6 KB 102ms
42ms Document
text/html 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a8f299300ecffa53ddc4beca35444ad98fec33d8d00fe75b9f9f7db88483423f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 116874
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5836
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 04:10:03 GMT
expires: Thu, 25 Jul 2024 04:10:03 GMT
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0ED6 0
0 58ms
57ms Fetch
image/gif 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvMTIkxnUxA8nMV69WlyQFZ9UNBymjUKkAdS5--6gTMd7C-S6pR-A7CGBl7l0WOk8_kNNGsVnwR4l1ix94NwPsTWnzCOVCdo9UZ4D5fNCZd7ttZUMSb_JHIZt0U-9otE1zUlHKgeTSatSsIsjqivBW72XEyV3krBSaltLFHKpxDpuKaxShaBPeiD_i1QVD7wQosQCBW6NDPNJ2S6HB5hdY-5Vek3GquWEN1Jm8D-ESCJd7GPzLYAzlEoEQhM9LeQ-dixfytzCKwY5gIBpayTw2fnD0yIJyaS60ybZNunkW-irUjkSlV3Kt9y9N-i9MpA-XeECsPOKGdzgMXC_EppJQnSEj0P3bjLPePLLGm08kdfCz6rWHkZaWGWG4P6xaqNWF_mlmGvx6wPpEDPEdFiy_CjTUwF4AR59edD6nTJ8xcSCnOJve2XugF8mIarmSLYkdyWjMdMCm3ATR5QpFkV0DSRDKzj_abu3PLB7SeTGUr6xgFR_hUq4LEQ2uW27bkqEh0EMC7VGTpDC2MSKw6eY3HstgCOMu43o1AqH_70K5YVWHBHBpHunOW7CqXqmnFblQTW5PubIIGvFOIz8_QTfS7MWFAc2iPoiUxfpPPtNSuQbl30mMLGhw1Ex94bJChGZ-LcuHrRMBSR44Yg7lQWUEhGD7WNYslZnr8q66gFz3WIbMN6zyeuF8gP8_PEOQghnb18Jogr43bHGDEIi_jrQ4-2vY0n5Py2hp4mJz-cRH-fVozTF32G2Bx_yltbXk1tWU5DU0OZWJEXzfHfmAsx-5VjIrMVuYPv1-myirhyDHCfPCqHq-P8FWNcSMjevj7v2WkYMFEcJlq5JLJTpC693fmBJx3U0_w4BNkCNvXSMlC0Gcw_p1yFz9bFiBAGmfa0VKmDiI8Obofo7egAZP97CLZDbtXYLsv3lAoT0smuvp6p-UUTbtj6Yvb81KsqrjPtOeeuPSMMuzZlVWS7su4TRKE50TcY2lfwpA_jHjO3oiNDHaOw845Egex7BF5DCsDXzbsgkrv5PEcbkpf4m7Ibyt92gAdvBSez751T136YnjXBPfUu5i6GVu6AiS-jRo8YzrbQ0uaIUYW11Xk20k96jOMvS-0EwAQ3JAaYlinpWX_C7yIGpjyJORupE4BUN9gLXGpuK6GP8psKmdIs6MWye0tJfhY7tMHmko6BstUhfohnWqN-F2D_-5Ca16x5xULTcUsaCpwNVnnwRxsXjhWdJojH5nRfOhq6_5PUFVRkPECwU1VshjrmcAnBgU-xyMJPCd_Se2Q0pnYI3GI8D2koSTHa8CfaQ4ZsbfPawKWpaakzQGKpnM&sai=AMfl-YRERAYDI92P-7YNnKwqewUpjjtvpQyZ5Zriy45YyFJ0AYJDIR_dJFtPAXjVPlzolddyiztmFUPix4ABSavhuTLQWSKfPc44WH7pUiKeWoAUgleLB09tlU_LLL8pZ1KmZlUE8Huty7NnDeRRPi3aSwjwUX3jHcDYfQFgYuWGEMDz3vXvCqi2-BrtK7L5kOd9QVfsGnggd5HftS86JMiuj7Y-V8CCgZ0knRCtzrAumFKPsDMJP173APJ_yiRYRzrcJA0F&sig=Cg0ArKJSzFu5YZFLNycIEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=834&cbvp=1&cstd=831&cisv=r20230725.15158&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 27 Jul 2023 12:37:57 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:57 GMT

GET
H2 200 ca
choices.truste.com/ Frame 0ED6 27 KB
27 KB 365ms
0ms Image
text/javascript 108.138.106.40
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=1&c=digitas01cont1&w=160&h=600

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.106.40 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-205-121-138.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 13:14:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 8c17de0f985b9ec9dbef8f79e2137106.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: JFK50-P3
cross-origin-embedder-policy: unsafe-none
age: 84206
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: XLRXXefY_8JOe-17CJlQrm381fMnl1avkgr5QFKohN1joxdxiUuUDQ==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

firstevent
hpe.demdex.net/ Frame 0ED6
Redirect Chain

https://hpe.demdex.net/event?d_event=imp&d_src=615807&d_creative=182974254&d_placement=353148678&d_campaign=28995437
https://hpe.demdex.net/firstevent?d_event=imp&d_src=615807&d_creative=182974254&d_placement=353148678&d_campaign=28995437

42 B
940 B

22ms
15ms

Image
image/gif

54.205.121.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hpe.demdex.net/firstevent?d_event=imp&d_src=615807&d_creative=182974254&d_placement=353148678&d_campaign=28995437

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Server

54.205.121.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

DCS: dcs-prod-va6-2-v049-004ff9d9d.edge-va6.demdex.com 4 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: r7dgUDpuS+Y=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-va6-1-v049-09eb2e65b.edge-va6.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: eEYJ1lmJRig=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://hpe.demdex.net/firstevent?d_event=imp&d_src=615807&d_creative=182974254&d_placement=353148678&d_campaign=28995437
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H3 206 videoplayback
rr3---sn-ab5sznzr.googlevideo.com/ Frame 9948 2 MB
0 24ms
16ms Media
video/mp4 2607:f8b0:4006:13::8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rr3---sn-ab5sznzr.googlevideo.com/videoplayback?expire=1690490273&ei=IWXCZMOZEMLZgwOVsaC4CA&ip=2a0d:5600:24:1500:1012:1f8c:488d:1ea0&id=26146dd05a4ab5f9&itag=18&source=youtube&requiressl=yes&mh=43&mm=31&mn=sn-ab5sznzr&ms=au&mv=m&mvi=3&pl=48&susc=gvp&acao=yes&ctier=L&mime=video/mp4&vprv=1&dur=64.203&lmt=1688220683180057&mt=1690460491&txp=5530434&sparams=expire,ei,ip,id,itag,source,requiressl,susc,acao,ctier,mime,vprv,dur,lmt&sig=AOq0QJ8wRAIgZXlf2v8P-_x3Zg7SS3lmunMyStXcA2GH50t-OonzjMYCIFsLEwVmecOlsFumcxXMtdqyixDFyyMrbFs_SD3W8ikx&lsparams=mh,mm,mn,ms,mv,mvi,pl&lsig=AG3C_xAwRgIhANagLvgC5wJ9VxvikmAkJpc9oDcvQEodY2q6fOtUW6jeAiEA39rqTR485IzB4jwSrx47jVTdcGA9nwCMmJb4F4Wn7qg=&cpn=h7YSnWIK0cP1GFDe

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:13::8 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Range: bytes=0-

Response headers

client-protocol: quic
date: Thu, 27 Jul 2023 12:37:57 GMT
x-content-type-options: nosniff
last-modified: Sat, 01 Jul 2023 14:11:23 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
Content-Range: bytes 0-4355505/4355506
cache-control: private, max-age=28496
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 4355506
expires: Thu, 27 Jul 2023 12:37:57 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 271F 1 KB
649 B 101ms
44ms Document
text/html 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 58809
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:17:48 GMT
etag: 48472445140208031
expires: Thu, 27 Jul 2023 20:17:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BA77
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&khaos=LKL540WK-1B-DXU8
https://usersync.gumgum.com/usersync?b=mag&i=LKL540WK-1B-DXU8

35 B
250 B

12ms
11ms

Image
image/gif

35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=mag&i=LKL540WK-1B-DXU8
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:57 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://usersync.gumgum.com/usersync?b=mag&i=LKL540WK-1B-DXU8
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 8f31d5fb12ac7ec11f837ad8263e0f6c
Expires: 0

GET
DATA 200
OK truncated
/ Frame 9948 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e2bc784bdecd1c52cba2a6752db7e00db02a2c98234d8bb06e43b5f8c5df14e1

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 DcmEnabler_01_247.js Show response
s0.2mdn.net/879366/ Frame A82D 29 KB
10 KB 10ms
9ms Script
text/javascript 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10215220780491718443/35978-4_PG_BRD_HADA_300x600_PR_LM_4_04-2023/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

467a5b06cb117035f7882e8c71d80e093f04ce586c1ac2b84e7e4adf978edb30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10215220780491718443/35978-4_PG_BRD_HADA_300x600_PR_LM_4_04-2023/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 07:27:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18611
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10136
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 28 Jul 2023 07:27:46 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 7FB0
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1&google_push=AaAOQGFgyi6HqkpYVc9940uKS_wdFagnrEDC44HgwgtMxKf0u5nWvWgsej03b0p6A5r9yOLaetYJ50BT1SARCMs2u7zr--UweFI
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NDA5MzMzNDg1NjI1MDcwMTMzMQ==&gdpr=0&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1

43 B
398 B

27ms
25ms

Image
image/gif

2620:112:f002:bbbb::21
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1
Requested by: Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2620:112:f002:bbbb::21 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 7FB0 35 B
364 B 35ms
19ms Image
image/gif 2620:116:800b:21:1456:d0e1:7db4:a56b
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEDXXZ9o2cGYteqPrFbtbIJs&google_cver=1&google_push=AaAOQGGAVp2J5_530htr-kVNHLqCAO8wUkv9q6luQbgHCk1D3X8kImr5BrSYPIzDtdBZpGnimmADeuXBizNErVBbz1HppRDtjw

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800b:21:1456:d0e1:7db4:a56b , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7FB0
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGGICNz_M8x5EN9WQZDX-wOn5zrtWUGsuTLI_1BfJjO...

170 B
188 B

52ms
38ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGGICNz_M8x5EN9WQZDX-wOn5zrtWUGsuTLI_1BfJjOllZrbyvUX-kxPaxe1ndNGoF686bjZze0bXuCVHHDsZD88vds4XqA

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:56 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-784-g0c0b2cf#rel-ec2-master i-06ab807539f95a9b8@us-east-1b@dxedge-app-us-east-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGGICNz_M8x5EN9WQZDX-wOn5zrtWUGsuTLI_1BfJjOllZrbyvUX-kxPaxe1ndNGoF686bjZze0bXuCVHHDsZD88vds4XqA
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7FB0
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wk1KbElRQURfNHFEVUFCWQ==&google_gid=CAESEBO-kX1m54gvrbUJSMImTXs&google_cver=1&google_push=AaAOQGE7AOmIX2WF-kDj7VTqTRsEW5OO2M...

170 B
188 B

49ms
41ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wk1KbElRQURfNHFEVUFCWQ==&google_gid=CAESEBO-kX1m54gvrbUJSMImTXs&google_cver=1&google_push=AaAOQGE7AOmIX2WF-kDj7VTqTRsEW5OO2MyWPuYvDkxEOhTMXXYozmGhsKz59P5JscHpHLPVXbVNn1MQ0vvxZup9GrBGHQnbAp8

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-lga21963-LGA
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1690461477.189593,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wk1KbElRQURfNHFEVUFCWQ==&google_gid=CAESEBO-kX1m54gvrbUJSMImTXs&google_cver=1&google_push=AaAOQGE7AOmIX2WF-kDj7VTqTRsEW5OO2MyWPuYvDkxEOhTMXXYozmGhsKz59P5JscHpHLPVXbVNn1MQ0vvxZup9GrBGHQnbAp8
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7FB0
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESEGxvXSF98Q3DnE9CWVBjHFc&google_cver=1&google_push=AaAOQGFPDKiM6k51Z0K_eQ4FjFYExaTLpAY4rQsDE-MYXZW7vMvsXmrglnYYBMSB5KzMdEFcEDiKatPP8xEwi3trtpQd0hsHQvM
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==

170 B
188 B

55ms
47ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==
date: Thu, 27 Jul 2023 12:37:57 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7FB0
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEPX02IOAklvX6AwbwUgrtoU&google_cver=1&google_push=AaAOQGF4PH4mfkowYxBIYNLyCx-QTdm8t0-T0zBMsgsuQVZg7jOeVqaSe2IXdF3hVAd6e8eZEwb-xyCC4FX_mpoajrrw...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGF4PH4mfkowYxBIYNLyCx-QTdm8t0-T0zBMsgsuQVZg7jOeVqaSe2IXdF3hVAd6e8eZEwb-xyCC4FX_mpoajrrwD4sdMEg&google_hm=-mALptxYQeekGoMuaCwDDw==

170 B
188 B

56ms
48ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGF4PH4mfkowYxBIYNLyCx-QTdm8t0-T0zBMsgsuQVZg7jOeVqaSe2IXdF3hVAd6e8eZEwb-xyCC4FX_mpoajrrwD4sdMEg&google_hm=-mALptxYQeekGoMuaCwDDw==

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGF4PH4mfkowYxBIYNLyCx-QTdm8t0-T0zBMsgsuQVZg7jOeVqaSe2IXdF3hVAd6e8eZEwb-xyCC4FX_mpoajrrwD4sdMEg&google_hm=-mALptxYQeekGoMuaCwDDw==
Date: Thu, 27 Jul 2023 12:37:57 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7FB0
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEJYsuHs6s1O74JLGHus4zP8&google_cver=1&google_push=AaAOQGFhVtutdd64gzvq9YBH4HSdRkA5sEeovjqHh6dB2NHqZ_7nJNg_MRYIW2awGMz7QPJOATI0W-wLp-EFnAf...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGFhVtutdd64gzvq9YBH4HSdRkA5sEeovjqHh6dB2NHqZ_7nJNg_MRYIW2awGMz7QPJOATI0W-wLp-EFnA...

170 B
188 B

55ms
46ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGFhVtutdd64gzvq9YBH4HSdRkA5sEeovjqHh6dB2NHqZ_7nJNg_MRYIW2awGMz7QPJOATI0W-wLp-EFnAf1Z_-wAga0fwA

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGFhVtutdd64gzvq9YBH4HSdRkA5sEeovjqHh6dB2NHqZ_7nJNg_MRYIW2awGMz7QPJOATI0W-wLp-EFnAf1Z_-wAga0fwA
Date: Thu, 27 Jul 2023 12:37:57 GMT
Connection: keep-alive
Content-Length: 241
Content-Type: text/html; charset=utf-8

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 7FB0 0
12 B 48ms
40ms Image
text/html 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LHpq7Rp7cs41Mm-3AKWDG4-mDrdLNL84q4LHpW91lt2qW8Rg9oev9oDD1SrKj6z4LGLMie

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame ADD9 0
25 B 50ms
49ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=5574524923590&version=m202306200101&ct=76&x=1&cor=9848365699106064000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E44D 0
25 B 42ms
41ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=7562879887687&version=m202306200101&ct=76&x=1&cor=3579400355349208600

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6763 0
0 106ms
102ms Fetch
image/gif 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuwOn_HeXkKgU7KbLPBrYZbudMqYmCG7dglkeHvR98K3Kf85olwIIuWOIyoVrxRJEDSdfqEq5bh_GSAVQM7CFJYKql6laMo7oj03ZmWf0cNmSITfyIJVgdFLzsdiqN87dwFozsxt2XxNpmbUxPz_vJ4sCHKVbtDhFAqGGA_hBuNItYl_sH-JiQI1j7woHCjgRwubgo9WDSGxWEY8_-nNVceeIykU_aHkJCqw9EeRqtngkvlVK6q4AqT4o9_jAHs5p7-kh3uiaU6Iv3GdUP0msRL8mpuPjbr2tlfAd11t2DY2sgeR5vMvkVgYOHbvEnFbji3v2vbaE3uh4tmPORTWr_Q74AiqkDHplma7sdG3xbUNfBVseYyrDqPmixShHXsYcms4T9FcsXu6fdkPPW2c9tO6xWWHvrbj8TJugaJSxu16_8jTOYf3ynTPnNqiDydl5gfue16trMeTSNIcpTv-01XQhDff6gto0xmRcjtyTXbGaYQexwovh545GObYC58EifmMIZnx0mLMPDa3zHwSXcM6MGXBd4GiT4SYXjcJZkXHvPSuMnJSEA7a7_b_m9f2P1EbHBx2j-jxuNn-W3XQ-n2zSa0-ncjlnWspHCNk3jRjaOcQ9S4xGNc6TGPM6LRYvkXd8ohGJK9GXlx1-YcK_gNQGTE6LlUSPJvo08sQ1KWL2EQHPxIqp38tOY-Xzr4bYMDg99AHBIM8HYktsSyNw43wA8QT7EH9qA02XlR3Ur-xcgYfeB9AR7O5n8QrfUOktSDFlQL32WU5b7_XU9rvNm7Vd74YkdGJcnyjIv2JCaKIxgT8Sgk65Fn5vteN0n0R0fWU570vef1EsjRNB2N9JHHHGehPnb9vAaSLoLupYpuh4cmcuAn4npytoTtZzmX8hyVPbfYrpI9ywOrupPQ4xbJTwKeyJCiS4-9thPY2MCB-U1BLjxMoenZ_PcVVPtFyVoLv11QqjQ8Yh59C83ykZAA0cvDrDsXX-WMnDKwKgeTVlGplgTMpSJq5X2y4iLcqIKn75zxJsaDBPQuevXCfCebvHbj0xKfKdilP0nAsmpLEsMbuea6mxf4UGySvEM5kKFBoh1idZFoHAVAJ0onZgSulK7OTx9APOKSKXsvgW3NmM69JbOzh57xjzpge7twi18lc7oXf3CeG3JIDvIc_cAtXM6dML0cVZvc_F4giZEnj4dBuU0HXBz6rqFqn7Aqfm-7GRwPerSC0OPrP3EVSpHoErToFYQRdWWOPqyJK7Nlk4mB60LvvTsnI_ohFv7rCRfeiOKi3OlWyNBv3rYYlPEFh5AvSdNyS1gy4rYJ_GCsx9rDEwcn&sai=AMfl-YQy2NXuNMkiah0LWP9SfTM1mx-gtbYflLSTmBtAwcjjCuerbC3jfv_t4RYKT9FOECNMQNcoPhvZfBJH91nLr-VVgYIDNyRY582eV5iZw-VnyUOO_nCjqVcVtbwMIfrIbNYxxRn7MGas3Y2CYChvs6Os44ARbKPTpfDLY4rN2J1paBEhaRnA3CyinjGKVXy4eD2kzQp29H7-Llo9Afx12RBOF3Le8AKO38G_oVAFfyyHJsg-nf2Us6cTUMDRgHzfovcY&sig=Cg0ArKJSzCsDs0KwcNgWEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=645&vt=11&dtpt=643&dett=2&cstd=0&cisv=r20230725.42222&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:57 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 27 Jul 2023 12:37:57 GMT

GET
H2 200 b9pj45k4 Show response
sync-tm.everesttech.net/upi/pid/ Frame BA57 85 B
236 B 100ms
0ms Document
image/png 151.101.130.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 85
content-type: image/png
date: Thu, 27 Jul 2023 12:37:57 GMT
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-lga21963-LGA
x-timer: S1690461477.443385,VS0,VE8

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 6A53
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=970314641601922599

42 B
292 B

49ms
2ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=970314641601922599
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 12:37:57 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Thu, 27 Jul 2023 12:37:57 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=970314641601922599
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H/1.1 200
OK dcm Show response
s.amazon-adsystem.com/ Frame E078 43 B
855 B 83ms
21ms Document
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=80101931-A35F-4E27-9F09-B0912A7ADA85&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 27 Jul 2023 12:37:57 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: GZ09NKRC0NBSCCF83E34

GET
H2

200

usersync Show response
router.infolinks.com/dyn/ Frame 9808
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFDTlMwN0poTW9BQUNraFlzLV9yZw&gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Csyn%2Cpm&bee_sync_current_partner=adx&b...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Csyn%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AACNS07JhMoAACkhYs-_rg&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Csyn%252C...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Csyn%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=5547321580367140260&gdpr=0&gdpr_consent=
https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AACNS07JhMoAACkhYs-_rg&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26userid%3D5547321580367140260%26gdpr%3D0%26gdpr_consen...
https://match.prod.bidr.io/cookie-sync?gdpr=0&userid=5547321580367140260&gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=3&ev=A...
https://sync.technoratimedia.com/services?srv=cs&pid=73&uid=AACNS07JhMoAACkhYs-_rg&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26userid%3D5547321580367140260%26gdpr%3D0%26gdpr%3D0%...
https://match.prod.bidr.io/cookie-sync?gdpr=0&userid=5547321580367140260&gdpr=0&gdpr=0&bee_sync_partners=pm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=4
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AACNS07JhMoAACkhYs-_rg&gdpr=0
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=5ffed2df-4bd8-4892-8816-399f9a8960c6&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=60809&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fusersync%3Fpmuservalue%3D80101931-A35F-4E27-9F09-B0912A7ADA85&us_privacy=%24%7BUS_PRIVAC...
https://router.infolinks.com/dyn/usersync?pmuservalue=80101931-A35F-4E27-9F09-B0912A7ADA85

0
181 B

42ms
42ms

Document
text/plain

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/dyn/usersync?pmuservalue=80101931-A35F-4E27-9F09-B0912A7ADA85
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store
cf-cache-status: DYNAMIC
cf-ray: 7ed4efcd9a5f4388-EWR
content-length: 0
date: Thu, 27 Jul 2023 12:37:58 GMT
p3p: CP="NON DSP NID OUR COR"
server: cloudflare
via: 1.1 google

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 27 Jul 2023 12:37:56 GMT
location: https://router.infolinks.com/dyn/usersync?pmuservalue=80101931-A35F-4E27-9F09-B0912A7ADA85
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H/1.1 200 usersync Show response
usersync.gumgum.com/ Frame 174B 35 B
250 B 69ms
11ms Document
image/gif 35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=pbm&i=80101931-A35F-4E27-9F09-B0912A7ADA85
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 27 Jul 2023 12:37:57 GMT
Expires: 0
Pragma: no-cache

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 1110
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=gBAZMaNfTiefCbCRKnrahQ%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

15 KB
15 KB

80ms
75ms

Image
text/html

184.50.204.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 184.50.204.192 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-50-204-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:57 GMT
content-encoding: gzip
last-modified: Tue, 11 Jul 2023 09:39:35 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=34765
accept-ranges: bytes
content-length: 5606
expires: Thu, 27 Jul 2023 22:17:22 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 1110
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=80101931-A35F-4E27-9F09-B0912A7ADA85
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=7f4728db-c546-4885-91eb-59bdc0ffdd33%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=a7485659-1d87-4413-a256-0b6bba4fa732&ttd_puid=7f4728db-c546-4885-91eb-59bdc0ffdd33%2C%2C

95 B
123 B

30ms
29ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=a7485659-1d87-4413-a256-0b6bba4fa732&ttd_puid=7f4728db-c546-4885-91eb-59bdc0ffdd33%2C%2C

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:58 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=a7485659-1d87-4413-a256-0b6bba4fa732&ttd_puid=7f4728db-c546-4885-91eb-59bdc0ffdd33%2C%2C
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 359

GET
H2 200 xuid
eb2.3lift.com/ Frame 1110 37 B
355 B 112ms
0ms Image
image/gif 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7976&xuid=80101931-A35F-4E27-9F09-B0912A7ADA85&dongle=u6nf&gdpr=0&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif
date: Thu, 27 Jul 2023 12:37:57 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

insync
thrtle.com/ Frame 1110
Redirect Chain

https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=80101931-A35F-4E27-9F09-B0912A7ADA85&gdpr=0&gdpr_consent=
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=80101931-A35F-4E27-9F09-B0912A7ADA85&vxii_pid=12&vxii_pid1=10067&vxii_rcid=e33b53ac-681f-4798-88ad-c47b74b39d99

43 B
294 B

12ms
12ms

Image
image/gif

54.158.81.123
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=80101931-A35F-4E27-9F09-B0912A7ADA85&vxii_pid=12&vxii_pid1=10067&vxii_rcid=e33b53ac-681f-4798-88ad-c47b74b39d99
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 54.158.81.123 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-158-81-123.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
date: Thu, 27 Jul 2023 12:37:57 GMT
content-length: 43
content-type: image/gif

Redirect headers

location: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=80101931-A35F-4E27-9F09-B0912A7ADA85&vxii_pid=12&vxii_pid1=10067&vxii_rcid=e33b53ac-681f-4798-88ad-c47b74b39d99
date: Thu, 27 Jul 2023 12:37:57 GMT
content-type: text/html; charset=utf-8
content-length: 211
p3p: CP="NOI OUR BUS UNI COM NAV"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 1110
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEAGMUW3YzCbPS3qeUtiWMhM&google_cver=1
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://sonata-notifications.taptapnetworks.com/web/cookie/bidswitch/sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=0&gdpr_consent=&gdpr_pd=
https://x.bidswitch.net/sync?dsp_id=413&ssp=pubmatic&user_id=csonata_ea2030d5-63c2-4da8-95ff-a9cfd262b27f&bsw_param=fa600ba6-dc58-41e7-a41a-832e682c030f&expires=10&gdpr=0&gdpr_consent=&gdpr_pd=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=0&gdpr_consent=&gdpr_pd=

1 B
185 B

15ms
15ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=0&gdpr_consent=&gdpr_pd=
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Thu, 27 Jul 2023 12:37:58 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=0&gdpr_consent=&gdpr_pd=
Date: Thu, 27 Jul 2023 12:37:58 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 1110
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:89A587D6428942BFB7DBA431CAFC20D7
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMTUmdGw9MTI5NjAw&piggybackCookie=cuid_669f4410-2c7a-11ee-93db-12a7adfcdbeb&gdpr=0

42 B
328 B

18ms
12ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMTUmdGw9MTI5NjAw&piggybackCookie=cuid_669f4410-2c7a-11ee-93db-12a7adfcdbeb&gdpr=0
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 12:37:58 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMTUmdGw9MTI5NjAw&piggybackCookie=cuid_669f4410-2c7a-11ee-93db-12a7adfcdbeb&gdpr=0
date: Thu, 27 Jul 2023 12:37:58 GMT
content-type: text/plain

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 1110
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=a7485659-1d87-4413-a256-0b6bba4fa732&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}

0
210 B

41ms
8ms

Image
text/plain

162.248.18.32
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 162.248.18.32 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:57 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
date: Thu, 27 Jul 2023 12:37:56 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 1110
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=4093334856250701331&gdpr=0&gdpr_consent=&us_privacy=
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}

0
41 B

54ms
19ms

Image
text/plain

162.248.18.32
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 162.248.18.32 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:56 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
date: Thu, 27 Jul 2023 09:00:46 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 80101931-A35F-4E27-9F09-B0912A7ADA85
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 1110 43 B
604 B 108ms
0ms Image
image/gif 2600:1f18:4e9:5a07:2f1b:1600:f704:2559
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/80101931-A35F-4E27-9F09-B0912A7ADA85?gdpr=0&gdpr_consent=

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a07:2f1b:1600:f704:2559 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:57 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 1110
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=80101931-A35F-4E27-9F09-B0912A7ADA85&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-UIk_QIBE2uVwqkxy13zWhX35XD1yFkQ-~A&gdpr=0

0
261 B

260ms
8ms

Image
text/plain

162.248.18.34
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-UIk_QIBE2uVwqkxy13zWhX35XD1yFkQ-~A&gdpr=0
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:57 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-UIk_QIBE2uVwqkxy13zWhX35XD1yFkQ-~A&gdpr=0
date: Thu, 27 Jul 2023 12:37:57 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.64
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame E15E
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1&google_push=AaAOQGESDGRcopZnUsQqr29WP_sq1oPocUMli0hX7NzRXFOFLwz9sz8EBkR5-GUJn4XpixWMOKcV6IotQrsGwBkHQJFnCWTYcOF7Uw
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NDA5MzMzNDg1NjI1MDcwMTMzMQ==&gdpr=0&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1

43 B
398 B

26ms
26ms

Image
image/gif

2620:112:f002:bbbb::21
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1
Requested by: Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2620:112:f002:bbbb::21 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E15E
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGEoAZrjA8V_6Gt-LM2weXtVoYIJf0K-AwcMMw0E7I5...

170 B
188 B

50ms
42ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGEoAZrjA8V_6Gt-LM2weXtVoYIJf0K-AwcMMw0E7I5DHIfsMRuQ5m8Y5ULLBBkK8oBguKWxC90S0a7FtB7Nhjmd3KlqDe7yeg

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:56 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-784-g0c0b2cf#rel-ec2-master i-06ab807539f95a9b8@us-east-1b@dxedge-app-us-east-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGEoAZrjA8V_6Gt-LM2weXtVoYIJf0K-AwcMMw0E7I5DHIfsMRuQ5m8Y5ULLBBkK8oBguKWxC90S0a7FtB7Nhjmd3KlqDe7yeg
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E15E
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wk1KbElRQURfNHFEVUFCWQ==&google_gid=CAESEBO-kX1m54gvrbUJSMImTXs&google_cver=1&google_push=AaAOQGFs1p-riZCOhCnbu0btxUYOOZFFqe...

170 B
188 B

44ms
44ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wk1KbElRQURfNHFEVUFCWQ==&google_gid=CAESEBO-kX1m54gvrbUJSMImTXs&google_cver=1&google_push=AaAOQGFs1p-riZCOhCnbu0btxUYOOZFFqe77qIzaeQTZiq2ob4-cdcxGBOy6iHwgVo7j84GmV8Zj2z5GGkS_M9kqm0HKVTXPQSeSeQ

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-lga21963-LGA
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1690461477.443253,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wk1KbElRQURfNHFEVUFCWQ==&google_gid=CAESEBO-kX1m54gvrbUJSMImTXs&google_cver=1&google_push=AaAOQGFs1p-riZCOhCnbu0btxUYOOZFFqe77qIzaeQTZiq2ob4-cdcxGBOy6iHwgVo7j84GmV8Zj2z5GGkS_M9kqm0HKVTXPQSeSeQ
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E15E
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEHOhJH0HgTsAsDdQcUg_RNw&google_cver=1&google_push=AaAOQGEaWInEMS8v2GCEPhH6ue3HA5W8PYgbpeDLKuNbxjdm-lMdvF_SaCLFJL27A8XcHce2w6v7h2Kcbshj0haZPD...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=YTc0ODU2NTktMWQ4Ny00NDEzLWEyNTYtMGI2YmJhNGZhNzMy&google_push&gdpr=0&gdpr_consent=&ttd_tdid=a7485659-1d87-4413-a256-0b6bba4fa732

170 B
188 B

41ms
40ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=YTc0ODU2NTktMWQ4Ny00NDEzLWEyNTYtMGI2YmJhNGZhNzMy&google_push&gdpr=0&gdpr_consent=&ttd_tdid=a7485659-1d87-4413-a256-0b6bba4fa732

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=YTc0ODU2NTktMWQ4Ny00NDEzLWEyNTYtMGI2YmJhNGZhNzMy&google_push&gdpr=0&gdpr_consent=&ttd_tdid=a7485659-1d87-4413-a256-0b6bba4fa732
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 423

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E15E
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESEGxvXSF98Q3DnE9CWVBjHFc&google_cver=1&google_push=AaAOQGHVjOcd9ywk3Ncs1nx7P9RLq65idfFNhaE0pzErjJnE0KaB3khbMqEoeFZswP2AbOGPEE6MlUMHcIqAzYO2QPyjfTa5WeZpMg
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==

170 B
188 B

41ms
40ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==
date: Thu, 27 Jul 2023 12:37:57 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E15E
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEPX02IOAklvX6AwbwUgrtoU&google_cver=1&google_push=AaAOQGE6MqYMoKuu5MjTI9P4AqTK69w4gdfHN2wZGqKbDUURCsXuiAA160xPl3XcSSViUtEjcPRgSjfH4T-jRyVUiEzA...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGE6MqYMoKuu5MjTI9P4AqTK69w4gdfHN2wZGqKbDUURCsXuiAA160xPl3XcSSViUtEjcPRgSjfH4T-jRyVUiEzAPh97aPgaXg&google_hm=-mALptxYQeekGoMuaCwDDw==

170 B
188 B

42ms
42ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGE6MqYMoKuu5MjTI9P4AqTK69w4gdfHN2wZGqKbDUURCsXuiAA160xPl3XcSSViUtEjcPRgSjfH4T-jRyVUiEzAPh97aPgaXg&google_hm=-mALptxYQeekGoMuaCwDDw==

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGE6MqYMoKuu5MjTI9P4AqTK69w4gdfHN2wZGqKbDUURCsXuiAA160xPl3XcSSViUtEjcPRgSjfH4T-jRyVUiEzAPh97aPgaXg&google_hm=-mALptxYQeekGoMuaCwDDw==
Date: Thu, 27 Jul 2023 12:37:57 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E15E
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEJYsuHs6s1O74JLGHus4zP8&google_cver=1&google_push=AaAOQGEjPPWoSz3KUDi5fGaPJqFpAcaz4F2e63lfuZ58jBKGOkVBspTsWwWeHf8NNkS-N8tiUVjoq_5eDmVmMDb...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGEjPPWoSz3KUDi5fGaPJqFpAcaz4F2e63lfuZ58jBKGOkVBspTsWwWeHf8NNkS-N8tiUVjoq_5eDmVmMD...

170 B
188 B

51ms
43ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGEjPPWoSz3KUDi5fGaPJqFpAcaz4F2e63lfuZ58jBKGOkVBspTsWwWeHf8NNkS-N8tiUVjoq_5eDmVmMDb0mOtzpbaOKoK4Lw

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGEjPPWoSz3KUDi5fGaPJqFpAcaz4F2e63lfuZ58jBKGOkVBspTsWwWeHf8NNkS-N8tiUVjoq_5eDmVmMDb0mOtzpbaOKoK4Lw
Date: Thu, 27 Jul 2023 12:37:57 GMT
Connection: keep-alive
Content-Length: 244
Content-Type: text/html; charset=utf-8

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame E15E 0
12 B 113ms
53ms Image
text/html 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13J9Sk7GXxrlOZVTBJkRD4rTy_xF4wJxY2M0f6GkqOsal-UC2mVzRv_Pgj-06FQElVbWppOM

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 t1.png
s0.2mdn.net/sadbundle/12141210611375748195/300x250/images/ Frame 993C 3 KB
3 KB 73ms
19ms Image
image/png 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/images/t1.png

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e42bcb0ceeb3202608a562c5691a4f54c7acf77042f6066cc846caaa5ab3356e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 03:06:44 GMT
x-content-type-options: nosniff
age: 34273
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3468
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 05:38:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jul 2024 03:06:44 GMT

GET
H3 200 t2.png
s0.2mdn.net/sadbundle/12141210611375748195/300x250/images/ Frame 993C 4 KB
4 KB 73ms
20ms Image
image/png 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/images/t2.png

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

731ad32c6dd2e1ac8b4c3f2019759a088dbc07039f43c9ec602ce27c9a1111fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 03:31:38 GMT
x-content-type-options: nosniff
age: 32779
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3724
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 05:38:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jul 2024 03:31:38 GMT

GET
H3 200 t3.png
s0.2mdn.net/sadbundle/12141210611375748195/300x250/images/ Frame 993C 2 KB
2 KB 73ms
20ms Image
image/png 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/images/t3.png

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b9ac237d9ea59e54126d414e34eb04ecd007fad053f43ffeb676516753aad1f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 02:49:45 GMT
x-content-type-options: nosniff
age: 35292
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1823
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 05:38:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jul 2024 02:49:45 GMT

GET
H3 200 ctacopy.png
s0.2mdn.net/sadbundle/12141210611375748195/300x250/images/ Frame 993C 1 KB
1 KB 79ms
26ms Image
image/png 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/images/ctacopy.png

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7087453e5a36a5eb35a60ce948e703ddc5edff4ff70b178dd4d2998b239f49eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 10:57:50 GMT
x-content-type-options: nosniff
age: 524407
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1088
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 05:38:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 20 Jul 2024 10:57:50 GMT

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/12141210611375748195/300x250/images/ Frame 993C 2 KB
2 KB 79ms
26ms Image
image/png 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/images/logo.png

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d590fb3bed41b262d3bb5e9228207e006b10e35e8ec6673aa84e91d2133aa1ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:36:02 GMT
x-content-type-options: nosniff
age: 57715
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1620
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 05:38:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Jul 2024 20:36:02 GMT

GET
H3 200 logo_end.png
s0.2mdn.net/sadbundle/12141210611375748195/300x250/images/ Frame 993C 2 KB
2 KB 89ms
36ms Image
image/png 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/images/logo_end.png

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5913799d30962c3704a29118559c0cc4336e9472795b86a6d11a68f2b4f1a838

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 22 Jul 2023 02:03:24 GMT
x-content-type-options: nosniff
age: 470073
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1805
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 05:38:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Jul 2024 02:03:24 GMT

GET
H3 200 laptop.png
s0.2mdn.net/sadbundle/12141210611375748195/300x250/images/ Frame 993C 6 KB
6 KB 89ms
37ms Image
image/png 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/images/laptop.png

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e59e87efe302d3cf20711250deacec70bfc081206d272a0e12e67b09302ab8eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12141210611375748195/300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:17:03 GMT
x-content-type-options: nosniff
age: 58854
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5679
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 05:38:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Jul 2024 20:17:03 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 49C6
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1&google_push=AaAOQGGEk3PVkowipD6lrrwWJJYqDU6WSvJF6G4MVD6eufAAs7GPBrAnGfBh7Zjz2Lh5UFtWO4XHpiqaUxt-vm9OMKtVEHMphDkq
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NDA5MzMzNDg1NjI1MDcwMTMzMQ==&gdpr=0&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1

43 B
398 B

27ms
26ms

Image
image/gif

2620:112:f002:bbbb::21
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1
Requested by: Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2620:112:f002:bbbb::21 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 49C6
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEDXXZ9o2cGYteqPrFbtbIJs&google_cver=1&google_push=AaAOQGFaVlt1LEoDig0XdFoJbwWQE_Bs4dlDvIJ6uToxjLPGnVTxFpCc9E...
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AaAOQGFaVlt1LEoDig0XdFoJbwWQE_Bs4dlDvIJ6uToxjLPGnVTxFpCc9EyH9DPqxSdd4D9k-Fm9HFxygp8fWWt-ecPN4vea9vM&google_hm=uerpIMz...

170 B
188 B

45ms
35ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AaAOQGFaVlt1LEoDig0XdFoJbwWQE_Bs4dlDvIJ6uToxjLPGnVTxFpCc9EyH9DPqxSdd4D9k-Fm9HFxygp8fWWt-ecPN4vea9vM&google_hm=uerpIMzcwoGQ8qhzKPiaKA

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AaAOQGFaVlt1LEoDig0XdFoJbwWQE_Bs4dlDvIJ6uToxjLPGnVTxFpCc9EyH9DPqxSdd4D9k-Fm9HFxygp8fWWt-ecPN4vea9vM&google_hm=uerpIMzcwoGQ8qhzKPiaKA
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 49C6
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGEJaJBmYbW5nPaNGvLNepJwP_t1tIO-IuBMyhmQpA4...

170 B
188 B

40ms
40ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGEJaJBmYbW5nPaNGvLNepJwP_t1tIO-IuBMyhmQpA4g7rhrQh_TEX5zxhJP8zIpQ22zwqpilvTJVbVaS72XoakuPwIsCCH-

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:57 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-784-g0c0b2cf#rel-ec2-master i-0378fef7ed0d1fc56@us-east-1d@dxedge-app-us-east-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGEJaJBmYbW5nPaNGvLNepJwP_t1tIO-IuBMyhmQpA4g7rhrQh_TEX5zxhJP8zIpQ22zwqpilvTJVbVaS72XoakuPwIsCCH-
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 49C6
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wk1KbElRQURfNHFEVUFCWQ==&google_gid=CAESEBO-kX1m54gvrbUJSMImTXs&google_cver=1&google_push=AaAOQGETNjNWB9LUYBcg6WruJNRH1nPhta...

170 B
188 B

43ms
42ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wk1KbElRQURfNHFEVUFCWQ==&google_gid=CAESEBO-kX1m54gvrbUJSMImTXs&google_cver=1&google_push=AaAOQGETNjNWB9LUYBcg6WruJNRH1nPhta0nrvL4R3sH_lIPc5q5yiG3m0k9g1EoRIi_0-fwAuaK4e83LS7drFuyLfaAlZIf_1yP

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-lga21963-LGA
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1690461477.443228,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wk1KbElRQURfNHFEVUFCWQ==&google_gid=CAESEBO-kX1m54gvrbUJSMImTXs&google_cver=1&google_push=AaAOQGETNjNWB9LUYBcg6WruJNRH1nPhta0nrvL4R3sH_lIPc5q5yiG3m0k9g1EoRIi_0-fwAuaK4e83LS7drFuyLfaAlZIf_1yP
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 49C6
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESEGxvXSF98Q3DnE9CWVBjHFc&google_cver=1&google_push=AaAOQGHz5Za5vMYTOownoB3yStJ3POO9peHHtUpn3Q0Z1VfYfrJpTvGDr9oTt7R8cHXSA7Ak4_NzFp7ICZmvVBkerkguv3tMkQc
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==

170 B
188 B

39ms
38ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==
date: Thu, 27 Jul 2023 12:37:57 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 49C6
Redirect Chain

https://rtb.adentifi.com/CookieSyncAdX?google_gid=CAESEGwWO3TrA9Jw_LxqPq5aUJA&google_cver=1&google_push=AaAOQGGEqMuCwTDF2novEtLXpntsQlHs7cx8l8feMC1TD_YLZk1XOhW0uYjjnmfE1awNlUzN07fOfwlqwVHwfNVa5_03D...
https://cm.g.doubleclick.net/pixel?google_nid=adtheorent&google_hm=Zp9EECx6Ee6T2xKnrfzb6w&google_push=AaAOQGGEqMuCwTDF2novEtLXpntsQlHs7cx8l8feMC1TD_YLZk1XOhW0uYjjnmfE1awNlUzN07fOfwlqwVHwfNVa5_03DNY...

170 B
188 B

50ms
46ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adtheorent&google_hm=Zp9EECx6Ee6T2xKnrfzb6w&google_push=AaAOQGGEqMuCwTDF2novEtLXpntsQlHs7cx8l8feMC1TD_YLZk1XOhW0uYjjnmfE1awNlUzN07fOfwlqwVHwfNVa5_03DNYHPJag&google_redir=https%3A%2F%2Frtb.adentifi.com%2FCookieSyncAdXCheck&google_ula=6802874232

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=adtheorent&google_hm=Zp9EECx6Ee6T2xKnrfzb6w&google_push=AaAOQGGEqMuCwTDF2novEtLXpntsQlHs7cx8l8feMC1TD_YLZk1XOhW0uYjjnmfE1awNlUzN07fOfwlqwVHwfNVa5_03DNYHPJag&google_redir=https%3A%2F%2Frtb.adentifi.com%2FCookieSyncAdXCheck&google_ula=6802874232
date: Thu, 27 Jul 2023 12:37:57 GMT
content-type: text/plain

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 49C6
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEPX02IOAklvX6AwbwUgrtoU&google_cver=1&google_push=AaAOQGFOpyUYx82SS0YOGh7wu_m6ApE1YiRKmBLLGiymhmWcDnXeF8KErKnSgrza520lb5k_KmMhB5G9vtjoII8aVBHQ...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGFOpyUYx82SS0YOGh7wu_m6ApE1YiRKmBLLGiymhmWcDnXeF8KErKnSgrza520lb5k_KmMhB5G9vtjoII8aVBHQ-B17TY6l&google_hm=-mALptxYQeekGoMuaCwDDw==

170 B
188 B

39ms
37ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGFOpyUYx82SS0YOGh7wu_m6ApE1YiRKmBLLGiymhmWcDnXeF8KErKnSgrza520lb5k_KmMhB5G9vtjoII8aVBHQ-B17TY6l&google_hm=-mALptxYQeekGoMuaCwDDw==

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGFOpyUYx82SS0YOGh7wu_m6ApE1YiRKmBLLGiymhmWcDnXeF8KErKnSgrza520lb5k_KmMhB5G9vtjoII8aVBHQ-B17TY6l&google_hm=-mALptxYQeekGoMuaCwDDw==
Date: Thu, 27 Jul 2023 12:37:57 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 49C6 0
12 B 100ms
52ms Image
text/html 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LuX1RkpBml4j-m_b30DpznoXEYTXxW0xcYFq6w15zgkRJOEkRiLikJTYH2e65rAQEhjrwq

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/5357816647124024566/ Frame 2069 40 KB
6 KB 83ms
22ms Document
text/html 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

448ccd36d2a197b09fd2d4238ca2322943a2760933bad452b74caee18621d53c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 30979
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 6158
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 04:01:38 GMT
expires: Fri, 26 Jul 2024 04:01:38 GMT
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2E8C 0
0 115ms
70ms Fetch
image/gif 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss8_JT9Kg2zpEkMh2hxvsuTsbaNLJ3PtEmE6R_c-B33ou_dNUzvKqmsDO6pNO2fxhIlTE-KAlJLZqdic6TfzT-GN4-_E4JD_hUfFhA6MeLRPsjIDI7vQPvNSybFmDgrgzQ-F2HbVSZWQPTYhTZlO2dClSHtgHiNdMIcu-e85ObuookNHpfLzOtj8Kaaq7E-QmDe-MxkFzkm_7uxgzmCcj4eXhHcizrduQza4bc8qJtMHxKSUKxXa7CJtu-NXSFtjw0VzPd0XB9T9B4Q5YmZv5wLBnlKP7sqljefG5zkPxyEvbUFD0XCknyqrmDq5L0Q3raPfvUOMTsGjKdE1sfpOXtkR96Cl9uFHhvG-HOZL3wv_WFKWkBM34mBEdVBtszhoriObVXfzNaQK4Ilc2LRaTl4R5asFe-PWZUtneYoAW8ZkyVWQ8DEOsnlzgt4iRya26gZCI6mOH-KAsgLWRoaillt6YftizpKlyhvCTxFCl4FVVsdN5j_MhSVyD9_NX5x_FzG-0pzZE47C3ZC1Gdwj-zXjyjrKMgM-EiFWVg9Kw1S7oqeWEK1yeUHqOrxxc5ozac6NQF6Rq3EeDMeh6DbC6yZ-hk5Q_bakWrCep-CF7jqKxT_3hf1sKlU0Jj-P2qL4ZG9q71edCnRbgKPQ_bluqfyybXVMr6tbNPB14YjGvbNXgu43nZt9Nv-D-GiTKeA8RV2aFYfxFGijawW5TVoxaXEew2Op-8KNB0UL7--r2UkfwFjHUyUjX2bGvSNeNZs815cMnB_zvdqGHYWlhqjwbr9PAPqGxqkMnh22wLM5o4QZ3Cr0Zk6h2nxX2nMUWCTc_LU4d7YIcZ5IRxkqF3nASieQMtLjT8RFfn9hoWW7idHVRvypMeq0WeET-QzxRPa_3N-tnu98z2WgcB9LCdl0URooKTVcUgy1s6onusnQQeExhrj8TKyBlwEIVCTaV7Yae7zWDS2nHpiHR-tY3JcnijSLXFDY4KFmK3WgTZTYmlvaDmUuv7NmGRfu5FcTRSrjvlNXNpHuABqzIYsxoprJJ01jJBhg38EVLfHoUW6FGW7qf7mVAXBCdPw8WukndBu7jLTLe-5rAUEh_VHFcaHfiaxtitFf-UMv_jdRs-hHvU-X7S828cVjhUXOI9q3r-YZORMSFTJ-m8xvd-s1v70RuYsQfGfmmal3hKlQGNZNeRoLv7gWMFgtEhBSjwk3yAitG1EC2TshvZraVcB66urZtJ84Lzqx_gVhznrJddl0R_i-iuqql17wotDUbpHCMuJfMCJABxLzzR2mrXJz5DwJUX_MGww7OrhTfd-HUlEDXvMW5wYFg&sai=AMfl-YQDvjL0n32pvHYhtAY_2FQ3jJwZbDoq5NHDIQ4eFWSchiduW-0VbxoJ3kZfl84KnNk0oREz7IvzgCSqdlSGPD88Hrk_0ILzHoNXqZSlC3ZWn8yjuZRtKoyWC52TboKpXxmqrGfcDi0cpXa5BzhmJB9lJ5Pe-Hhlf74G3vVdSCXO71c_LOCfJrtEVqDvI7eo1xaL6qU0MO9n6d19gIrbkXPVK3C0q_Vbg86UwIeDCgzAxzoILm5WSb-mB9t2bGknmf86&sig=Cg0ArKJSzDvN38UMRMU5EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1310&cbvp=1&cstd=1307&cisv=r20230725.38354&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-54-205-121-138.compute-1.amazonaws.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 27 Jul 2023 12:37:57 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:57 GMT

GET
H/1.1

200
OK

firstevent
hpe.demdex.net/ Frame 2E8C
Redirect Chain

https://hpe.demdex.net/event?d_event=imp&d_src=615807&d_creative=185894140&d_placement=353175703&d_campaign=28995437
https://hpe.demdex.net/firstevent?d_event=imp&d_src=615807&d_creative=185894140&d_placement=353175703&d_campaign=28995437

42 B
940 B

21ms
15ms

Image
image/gif

54.205.121.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hpe.demdex.net/firstevent?d_event=imp&d_src=615807&d_creative=185894140&d_placement=353175703&d_campaign=28995437

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Server

54.205.121.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v049-09eb2e65b.edge-va6.demdex.com 4 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 5p9YD7FmRJ4=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-va6-1-v049-09eda62f6.edge-va6.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: hOfOn2tQSTs=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://hpe.demdex.net/firstevent?d_event=imp&d_src=615807&d_creative=185894140&d_placement=353175703&d_campaign=28995437
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 ca
choices.truste.com/ Frame 2E8C 27 KB
27 KB 57ms
0ms Image
text/javascript 108.138.106.40
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=1&c=digitas01cont8&w=728&h=90

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.106.40 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 10:13:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 8c17de0f985b9ec9dbef8f79e2137106.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: JFK50-P3
cross-origin-embedder-policy: unsafe-none
age: 8668
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: dSdgBpSNmK5fQ_iyeApSsMniXhMN4fLmF15jZoTEzCYbf-LaOpWSHA==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/15571588451724435493/ Frame 71B3 39 KB
6 KB 73ms
20ms Document
text/html 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a8f299300ecffa53ddc4beca35444ad98fec33d8d00fe75b9f9f7db88483423f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 116874
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5836
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 04:10:03 GMT
expires: Thu, 25 Jul 2024 04:10:03 GMT
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4269 0
0 107ms
68ms Fetch
image/gif 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstLZTOgKU94c_i3-2ak0XPa6eiB5jyKAP_MHziCCQg_pyE-g0x7MLSwkUq8yfhyF7ZThv3cecnOYGiRzudog_B0cprrqBjg-EAAMll0yu6LG3EOtLsv3QHqelkpEZignnpA5wJ76QOmLw4plzKk6gm2H5WKN7CKqh-gtX002oEH_2iEMkEm4gFnKiGl-2fJQavTGxujiFpSimwJdiZM3f9t-3eic2yqGJ0NciG0TkQ5JTTsm8pvMiHROceuG_1nUibFQdPH5wTAc4q1YjkQe2sQUQ_9Hv0vsOTR3mn6vqf9HlLq-WzQ2k8k4H_whv-4n_rk0885PiLIhmRoL1Nad8CI2chREXzw1dVdP4OWuPVxBjbNjpDzEkHyfXaFtztHDzIrGaFMKbBDMIyXnYbcgLOVaVhlgxzeDhgPbEDjYUXcr9oS-9eZq2pRJ5LC3wTosjuf6Owz1XkADZ2BgN5cu54ahlt95tzB55z1o29JJTuNcsOQqwiP2ftB9nYG0Gf-bjVCWJxHm7HEgXdwEtPLkGZYIs_V7BRGRLGvespNlQMyVvq7KIfXz6SRBYR0sXZeZchpxkgDDgMELb90Zq6DgvIaYKOAZXxNU2_PChg2OMMsadWNx6QGPL7zRiXC1lP_dwXoUk9c7uIcXv5FjvmC18sxxsVQcV1D5sG9d93NLaKySMxIEADSqkHTmmtUs2Kh0ulCsA9Jwx1pSCHiSe38xUvWsPeOBvka9MLMG6hphVCakQ_KDQ_FIr5PfNTWf_bL4ZN6YltpH84kIkneyg-TeKHSU5B2JIlrI7NiACHQzUbCBKD9LEgFcJEb7hEwjsyd2G37-mlt3r_ErHfOL1_mgtiq9I9YltuA-3NoTqIq-2qX8Nl0I0PJ83JzRsIf1smy2dAexQiW4YhMeAVDNZYRzHdcmyKDrOtZSZFVeWaFPFeZ2bOVL4ZA0hOnG0Do_GPx6PWHKGNCnRdZiHa6l554SrRyYJZu3ruiSnya3pb-IwgY7i1PP4MhkJ4mRwSs67TUcSiuxss2H3b9y_ICv0Tb3TKMgsMNgu0Ma8EmmIzPpnNcE6u0PZUxuxkYhu00v6o192WQo7fiIM9GYswvPe4IQ99ciT3IiPkKoI7pdjOAd9JCSDu_DrlkMfUGLOaWWtf4WenpvaeeS3Sz9alvQXS_wqs2YkbU6c6IOqqUhSdwUGZPF7TzVXPQuXmqrmuaO5xmAPkHdAhKb4qALUrxV1eJKMIS4lHyBr-TralEp5UwW6WZJDyM3H2Mg6CfbpOjFbxiwY1P7FqaXtnja4r7Ph7bc9fyT-lFYL2zYl8zr0CwiZ9h8NVqx1Q&sai=AMfl-YQoySqZLqzINn9Gb5RfPk63H4X5E9A2s1Kc7gBx5sbA1IF6udQyASvoFVNL-PLi8390Hg8waF8xvZpOkQJLPX0lfDeDQQYzcfo65tHr8WYn73NjoyK7TNvFSVKEgAessH8yX9qlmR2clDtfBhNE-pi2vV9KW2Rds2HliBQOiu3892CTraDMpkzi2qu92jHc9SzdNVgx9HAwS83puk6HjAzBlOKlR0mVn7Tnjx1h3i01ji_5IhjJOPStWw7AjneRUxPb&sig=Cg0ArKJSzFcyqhSW-___EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1235&cbvp=1&cstd=1231&cisv=r20230725.91354&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 27 Jul 2023 12:37:57 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 27 Jul 2023 12:37:57 GMT

GET
H2 200 ca
choices.truste.com/ Frame 4269 27 KB
27 KB 50ms
0ms Image
text/javascript 108.138.106.40
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=1&c=digitas01cont1&w=160&h=600

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.106.40 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-205-121-138.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 13:14:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 8c17de0f985b9ec9dbef8f79e2137106.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: JFK50-P3
cross-origin-embedder-policy: unsafe-none
age: 84206
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: 75I4gS-6p7P_6o4VJ_xD5u4KRnXpflr0AGsqvjhrjcZJzUeYMobAAQ==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

firstevent
hpe.demdex.net/ Frame 4269
Redirect Chain

https://hpe.demdex.net/event?d_event=imp&d_src=615807&d_creative=182974254&d_placement=353148678&d_campaign=28995437
https://hpe.demdex.net/firstevent?d_event=imp&d_src=615807&d_creative=182974254&d_placement=353148678&d_campaign=28995437

42 B
940 B

20ms
14ms

Image
image/gif

54.205.121.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hpe.demdex.net/firstevent?d_event=imp&d_src=615807&d_creative=182974254&d_placement=353148678&d_campaign=28995437

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Server

54.205.121.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v049-03a19aa8e.edge-va6.demdex.com 3 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 6ZMut4d4TRQ=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-va6-2-v049-069e90abf.edge-va6.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: ob6GAg4bSG4=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://hpe.demdex.net/firstevent?d_event=imp&d_src=615807&d_creative=182974254&d_placement=353148678&d_campaign=28995437
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 9504
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1&google_push=AaAOQGFTst7HPe2oxb1CWpO_sSoLSUZqKHuEnQsjnU_roNFWmbhPEPn5eakQhN5jd3d_1TjPpCw_JlYde4PO1DJMzFDyMyddZ6O5
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NDA5MzMzNDg1NjI1MDcwMTMzMQ==&gdpr=0&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1

43 B
398 B

34ms
34ms

Image
image/gif

2620:112:f002:bbbb::21
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1
Requested by: Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2620:112:f002:bbbb::21 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9504
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEDXXZ9o2cGYteqPrFbtbIJs&google_cver=1&google_push=AaAOQGFGN3M_jwOrOXJcY_lg6Rnpk6_IcFUKxyzpDUMu7nOBSehIzI-euK...
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AaAOQGFGN3M_jwOrOXJcY_lg6Rnpk6_IcFUKxyzpDUMu7nOBSehIzI-euKjp_UKTmi6csHZ8coBAi-0NpvOM0-JxYHYLF8_3DR82&google_hm=uerpIM...

170 B
188 B

43ms
37ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AaAOQGFGN3M_jwOrOXJcY_lg6Rnpk6_IcFUKxyzpDUMu7nOBSehIzI-euKjp_UKTmi6csHZ8coBAi-0NpvOM0-JxYHYLF8_3DR82&google_hm=uerpIMzcwoGQ8qhzKPiaKA

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AaAOQGFGN3M_jwOrOXJcY_lg6Rnpk6_IcFUKxyzpDUMu7nOBSehIzI-euKjp_UKTmi6csHZ8coBAi-0NpvOM0-JxYHYLF8_3DR82&google_hm=uerpIMzcwoGQ8qhzKPiaKA
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9504
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGGSzaDT0TO8sArt3TYD348i5_3V1EEpXHsXQkrJ5JK...

170 B
188 B

40ms
39ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGGSzaDT0TO8sArt3TYD348i5_3V1EEpXHsXQkrJ5JKp9kVJtth7aWg4wMzRXTiWsEz1tc0xDvcGwotIIYty2wqglBO-QQ8A

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:56 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-784-g0c0b2cf#rel-ec2-master i-0bcf48f5eb6bc72ae@us-east-1e@dxedge-app-us-east-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGGSzaDT0TO8sArt3TYD348i5_3V1EEpXHsXQkrJ5JKp9kVJtth7aWg4wMzRXTiWsEz1tc0xDvcGwotIIYty2wqglBO-QQ8A
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9504
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESEGxvXSF98Q3DnE9CWVBjHFc&google_cver=1&google_push=AaAOQGEp4xdQvS5a8msoUJTJg5136ImtsGr-pAtr5cA3SqP3qz8gHIjbdeCFws2P_UFbjJOR_9FlvnM3f_rt--zkjuwUdU2HWt-8
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==

170 B
188 B

43ms
37ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==
date: Thu, 27 Jul 2023 12:37:57 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9504
Redirect Chain

https://rtb.adentifi.com/CookieSyncAdX?google_gid=CAESEGwWO3TrA9Jw_LxqPq5aUJA&google_cver=1&google_push=AaAOQGEjbeVQjVBh1z7UPJ9hTvDUq3M8MNo17qjZVA-0N_U07XM5da8rDt_HLFfBYDLX3i5CZHiqS2d2NplR71mtT1E84...
https://cm.g.doubleclick.net/pixel?google_nid=adtheorent&google_hm=Zp9EECx6Ee6T2xKnrfzb6w&google_push=AaAOQGEjbeVQjVBh1z7UPJ9hTvDUq3M8MNo17qjZVA-0N_U07XM5da8rDt_HLFfBYDLX3i5CZHiqS2d2NplR71mtT1E84vt...

170 B
188 B

51ms
44ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adtheorent&google_hm=Zp9EECx6Ee6T2xKnrfzb6w&google_push=AaAOQGEjbeVQjVBh1z7UPJ9hTvDUq3M8MNo17qjZVA-0N_U07XM5da8rDt_HLFfBYDLX3i5CZHiqS2d2NplR71mtT1E84vtC87M&google_redir=https%3A%2F%2Frtb.adentifi.com%2FCookieSyncAdXCheck&google_ula=6802874232

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=adtheorent&google_hm=Zp9EECx6Ee6T2xKnrfzb6w&google_push=AaAOQGEjbeVQjVBh1z7UPJ9hTvDUq3M8MNo17qjZVA-0N_U07XM5da8rDt_HLFfBYDLX3i5CZHiqS2d2NplR71mtT1E84vtC87M&google_redir=https%3A%2F%2Frtb.adentifi.com%2FCookieSyncAdXCheck&google_ula=6802874232
date: Thu, 27 Jul 2023 12:37:57 GMT
content-type: text/plain

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9504
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEPX02IOAklvX6AwbwUgrtoU&google_cver=1&google_push=AaAOQGFTg0YxdOcrMHZSqELm6tljdaz0vmGY0RjGpS6jylJ3cdEViCFXrVhv6g1q9k1Il7ER1ye8uByus-HxjvCYweY3...
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=fa600ba6-dc58-41e7-a41a-832e682c030f&ssp=google&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=419&user_id=10593732968356378916&ssp=google&gdpr=&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGHLIyGiQy_qGPxnZdGu72Pbl9hP8To4ZYNsQxHRyp3b2ZzRLvUOX6B-U1ctNIGJcQe2dlHDuwXu57tM3cbZb7dGvQd5BvVF&google_hm=-mALptxYQeekGoMuaCwDDw==

170 B
188 B

40ms
39ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGHLIyGiQy_qGPxnZdGu72Pbl9hP8To4ZYNsQxHRyp3b2ZzRLvUOX6B-U1ctNIGJcQe2dlHDuwXu57tM3cbZb7dGvQd5BvVF&google_hm=-mALptxYQeekGoMuaCwDDw==

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGHLIyGiQy_qGPxnZdGu72Pbl9hP8To4ZYNsQxHRyp3b2ZzRLvUOX6B-U1ctNIGJcQe2dlHDuwXu57tM3cbZb7dGvQd5BvVF&google_hm=-mALptxYQeekGoMuaCwDDw==
Date: Thu, 27 Jul 2023 12:37:58 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9504
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEJYsuHs6s1O74JLGHus4zP8&google_cver=1&google_push=AaAOQGEGMc5z1dwnDUQKaJXVaHqcUA_E4g29ibLL4g2uyrWfMM3o1ZnHjlDaTD4aZS5uTpqySmS-0Rsg0nqq03-...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGEGMc5z1dwnDUQKaJXVaHqcUA_E4g29ibLL4g2uyrWfMM3o1ZnHjlDaTD4aZS5uTpqySmS-0Rsg0nqq03...

170 B
188 B

40ms
38ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGEGMc5z1dwnDUQKaJXVaHqcUA_E4g29ibLL4g2uyrWfMM3o1ZnHjlDaTD4aZS5uTpqySmS-0Rsg0nqq03-YUbIZh5XffcE

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGEGMc5z1dwnDUQKaJXVaHqcUA_E4g29ibLL4g2uyrWfMM3o1ZnHjlDaTD4aZS5uTpqySmS-0Rsg0nqq03-YUbIZh5XffcE
Date: Thu, 27 Jul 2023 12:37:57 GMT
Connection: keep-alive
Content-Length: 241
Content-Type: text/html; charset=utf-8

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 9504 0
12 B 84ms
41ms Image
text/html 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KPL1Hxx2EFqZx-MGYQyFF5OSPV-GdO-BzX5mpqyEtTRjMe7gELpngt7-h1rzciH8Z6LbvB

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame A637 22 KB
8 KB 64ms
15ms Document
text/html 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 56323
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:59:14 GMT
expires: Thu, 25 Jul 2024 20:59:14 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

/ Show response
hde.tynt.com/deb/ Frame 7289
Redirect Chain

https://de.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV
https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

1 KB
2 KB

323ms
23ms

Document
text/html

67.202.105.34
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.34 Palos Park, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip34.67-202-105.static.steadfastdns.net
Software: /
Resource Hash: 0a40b1db72be202ad81e80d78469803e4cca637e3ba15991be3e253d3742539d

Request headers

Referer: https://router.infolinks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA, Sec-CH-UA-Mobile
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length: 1403
content-type: text/html
date: Thu, 27 Jul 2023 12:37:57 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url

Redirect headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA, Sec-CH-UA-Mobile
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length: 0
date: Thu, 27 Jul 2023 12:37:57 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
location: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url

GET
H/1.1 200
OK usermatch Show response
ssum-sec.casalemedia.com/ Frame A274 2 KB
2 KB 37ms
8ms Document
text/html 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: 7cac65549a5b1925dc4c43328f16b9e31c0c0d7a863e96a775421ab0452b2bcd

Request headers

Referer: https://router.infolinks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 1551
Content-Type: text/html
Date: Thu, 27 Jul 2023 12:37:57 GMT
Expires: 0
Keep-Alive: timeout=1, max=500
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 16B6 2 KB
814 B 33ms
8ms Document
text/html 51.222.239.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Requested by

Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.239.230 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ip230.ip-51-222-239.net

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://router.infolinks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 748E
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infoli...
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=80101931-A35F-4E27-9F09-B0912A7ADA85&gdpr=-1&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=7d4ef700331604d3&is_secure=true&networkId=17100&version=1&nuid=80101931-A35F-4E27-9F09-B0912A7ADA85&gdpr=-1&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAJSMp1ZUDmDgMNFJEQAAAAAAA&expiration=1690547878&nuid=80101931-A35F-4E27-9F09-B0912A7ADA85&...

42 B
365 B

13ms
11ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAJSMp1ZUDmDgMNFJEQAAAAAAA&expiration=1690547878&nuid=80101931-A35F-4E27-9F09-B0912A7ADA85&is_secure=true&gdpr_consent=&gdpr=-1
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 12:37:58 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAJSMp1ZUDmDgMNFJEQAAAAAAA&expiration=1690547878&nuid=80101931-A35F-4E27-9F09-B0912A7ADA85&is_secure=true&gdpr_consent=&gdpr=-1
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

apn-usync
router.infolinks.com/dyn/ Frame 748E
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fapn-usync%3Fuser_id%3D%24UID
https://router.infolinks.com/dyn/apn-usync?user_id=7437480408642019502

35 B
186 B

35ms
34ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/apn-usync?user_id=7437480408642019502
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7ed4efce3ad64388-EWR
content-length: 35
expires: Wed, 27 Jul 2022 12:37:58 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
an-x-request-uuid: 7697d8a6-816b-48d1-9ead-e139b28a9b37
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://router.infolinks.com/dyn/apn-usync?user_id=7437480408642019502
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

ox-usync
router.infolinks.com/dyn/ Frame 748E
Redirect Chain

https://u.openx.net/w/1.0/cm?id=9b5994f2-035d-46de-8c12-bc0e9a4e66c2&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fox-usync%3Fuid%3D
https://router.infolinks.com/dyn/ox-usync?uid=d7d9ffaf-bf6d-4a83-988c-9d575e003fb2

35 B
199 B

37ms
37ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ox-usync?uid=d7d9ffaf-bf6d-4a83-988c-9d575e003fb2
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7ed4efce2ace4388-EWR
content-length: 35
expires: Wed, 27 Jul 2022 12:37:58 GMT

Redirect headers

date: Thu, 27 Jul 2023 12:37:57 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://router.infolinks.com/dyn/ox-usync?uid=d7d9ffaf-bf6d-4a83-988c-9d575e003fb2
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 748E
Redirect Chain

https://ups.analytics.yahoo.com/ups/58786/sync?redir=true
https://router.infolinks.com/dyn/VR-usync?uid=y-k0R9VlhE2uImtN4VBoihLHDkDc3l32NS~A
https://pixel.tapad.com/idsync/ex/receive?partner_id=3399&partner_device_id=y-k0R9VlhE2uImtN4VBoihLHDkDc3l32NS~A
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D7f4728db-c546-4885-91eb-59bdc0ffdd33%252C%252C
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=7437480408642019502&pt=7f4728db-c546-4885-91eb-59bdc0ffdd33%2C%2C

95 B
123 B

30ms
26ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=7437480408642019502&pt=7f4728db-c546-4885-91eb-59bdc0ffdd33%2C%2C

Requested by

Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:58 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
an-x-request-uuid: d838ae90-0ae8-4fe0-a095-9ac8195f2d5f
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=7437480408642019502&pt=7f4728db-c546-4885-91eb-59bdc0ffdd33%2C%2C
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

ur-usync
router.infolinks.com/dyn/ Frame 748E
Redirect Chain

https://sync.1rx.io/usersync2/infolinks
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3182322932
https://sync.1rx.io/usersync/tradedesk/a7485659-1d87-4413-a256-0b6bba4fa732
https://sync.targeting.unrulymedia.com/csync/RX-14723f11-90d9-492f-9cc4-e7bb3476cf9c-005?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fur-usync%3Fuid%3DRX-14723f11-90d9-492f-9cc4-e7bb3476cf9c-005
https://router.infolinks.com/dyn/ur-usync?uid=RX-14723f11-90d9-492f-9cc4-e7bb3476cf9c-005

35 B
212 B

40ms
33ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ur-usync?uid=RX-14723f11-90d9-492f-9cc4-e7bb3476cf9c-005
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7ed4efd1defa4388-EWR
content-length: 35
expires: Wed, 27 Jul 2022 12:37:58 GMT

Redirect headers

Date: Thu, 27 Jul 2023 12:37:58 GMT
Server: Tengine
ETag: RX14723f1190d9492f9cc4e7bb3476cf9c005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://router.infolinks.com/dyn/ur-usync?uid=RX-14723f11-90d9-492f-9cc4-e7bb3476cf9c-005
Content-Type: text/html
Connection: keep-alive

GET
H2

200

zmn-usync
router.infolinks.com/dyn/ Frame 748E
Redirect Chain

https://b1sync.zemanta.com/usersync/infolinks/?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fzmn-usync%3Fuid%3D__ZUID__
https://stags.bluekai.com/site/23178?id=SHqIxsER5zzdNQS3bQL1&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TPOV2GK4RONFXGM33MNFXGW4ZOMNXW2L3EPFXC66TN...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TPOV2GK4RONFXGM33MNFXGW4ZOMNXW2L3EPFXC66TNNYWXK43ZNZRT6ZLYMNUGC3THMU6WS3TGN5WGS3TLOMTHK2LEHVJUQ4KJPBZUKURVPJ5GITSRKMZWEUKMGE
https://router.infolinks.com/dyn/zmn-usync?uid=SHqIxsER5zzdNQS3bQL1

35 B
214 B

39ms
36ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/zmn-usync?uid=SHqIxsER5zzdNQS3bQL1
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7ed4efd13e7b4388-EWR
content-length: 35
expires: Wed, 27 Jul 2022 12:37:58 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:58 GMT
Content-Type: text/html; charset=utf-8
Location: https://router.infolinks.com/dyn/zmn-usync?uid=SHqIxsER5zzdNQS3bQL1
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 90
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

tplift
router.infolinks.com/dyn/ Frame 748E
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Ftplift%3Fuid%3D%24UID
https://router.infolinks.com/dyn/tplift?uid=1562212822517953672969

35 B
211 B

32ms
32ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/tplift?uid=1562212822517953672969
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7ed4efce2ac84388-EWR
content-length: 35
expires: Wed, 27 Jul 2022 12:37:58 GMT

Redirect headers

location: https://router.infolinks.com/dyn/tplift?uid=1562212822517953672969
date: Thu, 27 Jul 2023 12:37:57 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

sonobi-usync
router.infolinks.com/dyn/ Frame 748E
Redirect Chain

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsonobi-usync%3Fuid%3D%5BUID%5D
https://router.infolinks.com/dyn/sonobi-usync?uid=0879b8ef-eed0-499d-b782-d1c89f5648b0

35 B
247 B

36ms
36ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/sonobi-usync?uid=0879b8ef-eed0-499d-b782-d1c89f5648b0
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7ed4efce3ad44388-EWR
content-length: 35
expires: Wed, 27 Jul 2022 12:37:58 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:57 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-98
Content-Type: text/plain; charset=utf8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://router.infolinks.com/dyn/sonobi-usync?uid=0879b8ef-eed0-499d-b782-d1c89f5648b0
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

imd-usync
router.infolinks.com/dyn/ Frame 748E
Redirect Chain

https://ad.360yield.com/server_match?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fimd-usync%3Fuser_id%3D%7BPUB_USER_ID%7D%26partner_id%3D1531
https://router.infolinks.com/dyn/imd-usync?user_id=d8894ba5-35bd-4833-8e9c-b10a6d4f19ce&partner_id=1531

35 B
208 B

34ms
33ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/imd-usync?user_id=d8894ba5-35bd-4833-8e9c-b10a6d4f19ce&partner_id=1531
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7ed4efce2ac64388-EWR
content-length: 35
expires: Wed, 27 Jul 2022 12:37:58 GMT

Redirect headers

location: https://router.infolinks.com/dyn/imd-usync?user_id=d8894ba5-35bd-4833-8e9c-b10a6d4f19ce&partner_id=1531
access-control-allow-origin: *
date: Thu, 27 Jul 2023 12:37:57 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

outh-usync
router.infolinks.com/dyn/ Frame 748E
Redirect Chain

https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true
https://ups.analytics.yahoo.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true
https://router.infolinks.com/dyn/outh-usync?uid=y-lv9Jj4dE2uFufMjJ1PDh0NXUXkeStzk7~A

35 B
229 B

37ms
35ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/outh-usync?uid=y-lv9Jj4dE2uFufMjJ1PDh0NXUXkeStzk7~A
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7ed4efcfecc84388-EWR
content-length: 35
expires: Wed, 27 Jul 2022 12:37:58 GMT

Redirect headers

location: https://router.infolinks.com/dyn/outh-usync?uid=y-lv9Jj4dE2uFufMjJ1PDh0NXUXkeStzk7~A
date: Thu, 27 Jul 2023 12:37:58 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.64
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

sovrn-usync
router.infolinks.com/dyn/ Frame 748E
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID
https://router.infolinks.com/dyn/sovrn-usync?uid=HDPVfRZHq_uSkr3DQI69IfXJ

35 B
251 B

32ms
32ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/sovrn-usync?uid=HDPVfRZHq_uSkr3DQI69IfXJ
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7ed4efccc95b4388-EWR
content-length: 35
expires: Wed, 27 Jul 2022 12:37:57 GMT

Redirect headers

Date: Thu, 27 Jul 2023 12:37:57 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://router.infolinks.com/dyn/sovrn-usync?uid=HDPVfRZHq_uSkr3DQI69IfXJ
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap4ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 748E
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=60809&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D60809%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolink...
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=80101931-A35F-4E27-9F09-B0912A7ADA85&gdpr=-1&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=6c78d80f99df1a22&is_secure=true&networkId=17100&version=1&nuid=80101931-A35F-4E27-9F09-B0912A7ADA85&gdpr=-1&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAABq8WqSrkNYwNom5DVAAAAAAA&expiration=1690547878&nuid=80101931-A35F-4E27-9F09-B0912A7ADA85&...

42 B
346 B

19ms
19ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAABq8WqSrkNYwNom5DVAAAAAAA&expiration=1690547878&nuid=80101931-A35F-4E27-9F09-B0912A7ADA85&is_secure=true&gdpr_consent=&gdpr=-1
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 12:37:57 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAABq8WqSrkNYwNom5DVAAAAAAA&expiration=1690547878&nuid=80101931-A35F-4E27-9F09-B0912A7ADA85&is_secure=true&gdpr_consent=&gdpr=-1
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

mnet-usync
router.infolinks.com/dyn/ Frame 748E
Redirect Chain

https://cs.media.net/cksync?cs=41&ovsid=setstatuscode&type=inf&redirect=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fmnet-usync%3Fuid%3D%3Cvsid%3E
https://router.infolinks.com/dyn/mnet-usync?uid=3334630720813421000V10

35 B
203 B

66ms
65ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/mnet-usync?uid=3334630720813421000V10
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7ed4efce3ad84388-EWR
content-length: 35
expires: Wed, 27 Jul 2022 12:37:58 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:57 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://router.infolinks.com/dyn/mnet-usync?uid=3334630720813421000V10
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Thu, 27 Jul 2023 12:37:57 GMT

GET
H2

200

mgid-us
router.infolinks.com/dyn/ Frame 748E
Redirect Chain

https://cm-x.mgid.com/5abf3d2eff2f70c0a0669cd9f0f84ba0.gif?puid=[UID]&redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fmgid-us%3Fuser_id%3D%5BUID%5D
https://router.infolinks.com/dyn/mgid-us?user_id=95d519f3-32d9-4a57-b8d2-30654c090096

35 B
233 B

74ms
37ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/mgid-us?user_id=95d519f3-32d9-4a57-b8d2-30654c090096
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7ed4efcfbc904388-EWR
content-length: 35
expires: Wed, 27 Jul 2022 12:37:58 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:57 GMT
Transfer-Encoding: chunked
Location: https://router.infolinks.com/dyn/mgid-us?user_id=95d519f3-32d9-4a57-b8d2-30654c090096
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Keep-Alive: timeout=5
Expires: 0

GET
H/1.1

200
OK

RX-14723f11-90d9-492f-9cc4-e7bb3476cf9c-005
sync.targeting.unrulymedia.com/csync/ Frame 748E
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=infolinks
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=1016912063
https://sync.1rx.io/usersync/tradedesk/a7485659-1d87-4413-a256-0b6bba4fa732
https://sync.targeting.unrulymedia.com/csync/RX-14723f11-90d9-492f-9cc4-e7bb3476cf9c-005

43 B
452 B

16ms
14ms

Image
image/gif

199.127.204.171
RHYTHMONE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-14723f11-90d9-492f-9cc4-e7bb3476cf9c-005
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: HTTP/1.1
Server: 199.127.204.171 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Thu, 27 Jul 2023 12:37:58 GMT
Server: Tengine
Connection: keep-alive
Content-Length: 43
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:58 GMT
Server: Tengine
Transfer-Encoding: chunked
Content-Type: text/html
Location: https://sync.targeting.unrulymedia.com/csync/RX-14723f11-90d9-492f-9cc4-e7bb3476cf9c-005
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Expires: 0

GET
H2

200

qc-usync
router.infolinks.com/dyn/ Frame 748E
Redirect Chain

https://cms.quantserve.com/pixel/p-u1vdacBMXAcfT.gif?idmatch=0
https://router.infolinks.com/dyn/qc-usync?gdpr=0&uid=HcTt0R3FvNAGw7mCG5SjhRjG6NYGxLjUG8E-w83d

35 B
206 B

37ms
37ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/qc-usync?gdpr=0&uid=HcTt0R3FvNAGw7mCG5SjhRjG6NYGxLjUG8E-w83d
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7ed4efce2acd4388-EWR
content-length: 35
expires: Wed, 27 Jul 2022 12:37:58 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://router.infolinks.com/dyn/qc-usync?gdpr=0&uid=HcTt0R3FvNAGw7mCG5SjhRjG6NYGxLjUG8E-w83d
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

zeta-usync
router.infolinks.com/dyn/ Frame 748E
Redirect Chain

https://p.rfihub.com/cm?pub=43153&in=1
https://router.infolinks.com/dyn/zeta-usync?uid=970314641601922599

35 B
186 B

33ms
33ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/zeta-usync?uid=970314641601922599
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7ed4efccc95d4388-EWR
content-length: 35
expires: Wed, 27 Jul 2022 12:37:57 GMT

Redirect headers

Location: https://router.infolinks.com/dyn/zeta-usync?uid=970314641601922599
Date: Thu, 27 Jul 2023 12:37:57 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

45f6616f8301569fb3628edffa5edae8.gif
cs.admanmedia.com/ Frame 748E
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fdisus%3Fuid%3D%24UID&partner=infolinks
https://cs.admanmedia.com/45f6616f8301569fb3628edffa5edae8.gif?puid=ua-6865df45-cc3a-346a-a8d8-1884ce9ef314&redir=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D24%26buyeruid%3D%5BUID%5D%26r%3DCid...

0
176 B

19ms
9ms

Image
text/plain

80.77.87.166
NATCOWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cs.admanmedia.com/45f6616f8301569fb3628edffa5edae8.gif?puid=ua-6865df45-cc3a-346a-a8d8-1884ce9ef314&redir=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D24%26buyeruid%3D%5BUID%5D%26r%3DCid1YS02ODY1ZGY0NS1jYzNhLTM0NmEtYThkOC0xODg0Y2U5ZWYzMTQQ____________ASpSaHR0cHM6Ly9yb3V0ZXIuaW5mb2xpbmtzLmNvbS9keW4vZGlzdXM_dWlkPXVhLTY4NjVkZjQ1LWNjM2EtMzQ2YS1hOGQ4LTE4ODRjZTllZjMxNDICGA44AQ==&gdpr=&gdpr_consent=

Requested by

Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F

Protocol

HTTP/1.1

Server

80.77.87.166 Clifton, United States, ASN46636 (NATCOWEB, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Thu, 27 Jul 2023 12:37:58 GMT
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Server: nginx
Connection: keep-alive

Redirect headers

location: https://cs.admanmedia.com/45f6616f8301569fb3628edffa5edae8.gif?puid=ua-6865df45-cc3a-346a-a8d8-1884ce9ef314&redir=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D24%26buyeruid%3D%5BUID%5D%26r%3DCid1YS02ODY1ZGY0NS1jYzNhLTM0NmEtYThkOC0xODg0Y2U5ZWYzMTQQ____________ASpSaHR0cHM6Ly9yb3V0ZXIuaW5mb2xpbmtzLmNvbS9keW4vZGlzdXM_dWlkPXVhLTY4NjVkZjQ1LWNjM2EtMzQ2YS1hOGQ4LTE4ODRjZTllZjMxNDICGA44AQ==&gdpr=&gdpr_consent=
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
cache-control: no-store
content-length: 0
expires: 0

GET
H2

200

33a-usync
router.infolinks.com/dyn/ Frame 748E
Redirect Chain

https://ssc-cms.33across.com/ps/?ri=0010b00002CpYhEAAV&ru=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2F33a-usync%3Fuid%3D33XUSERID33X
https://router.infolinks.com/dyn/33a-usync?uid=212218736360043

35 B
184 B

44ms
34ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/33a-usync?uid=212218736360043
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7ed4efcfbc934388-EWR
content-length: 35
expires: Wed, 27 Jul 2022 12:37:58 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
referrer-policy: unsafe-url
server: 33XP005
x-33x-status: 100000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://router.infolinks.com/dyn/33a-usync?uid=212218736360043
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

ProfilesEngineServlet
sync1.intentiq.com/profiles_engine/ Frame 748E
Redirect Chain

https://router.infolinks.com/dyn/iq-usync
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=4472bf44-7dce-43d7-b3d2-92c989ceb0d9&3rddpi=1177082855&3rdpcid=970314641601922599&3rddpi=1213503647&3...
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=4472bf44-7dce-43d7-b3d2-92c989ceb0d9&3rddpi=1177082855&3rdpcid=970314641601922599&3rddpi=1213503647&...

43 B
960 B

55ms
22ms

Image
image/gif

18.173.219.5

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=4472bf44-7dce-43d7-b3d2-92c989ceb0d9&3rddpi=1177082855&3rdpcid=970314641601922599&3rddpi=1213503647&3rdpcid=y-k0R9VlhE2uImtN4VBoihLHDkDc3l32NS%7EA&3rddpi=1239766150&3rdpcid=d7d9ffaf-bf6d-4a83-988c-9d575e003fb2&3rddpi=443164713&3rdpcid=HcTt0R3FvNAGw7mCG5SjhRjG6NYGxLjUG8E-w83d&ckls=true&ci=mViFwChyGS&nc=false&trid=-631258666
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: H2
Server: 18.173.219.5 , United States, ASN (),
Reverse DNS: server-18-173-219-5.jfk52.r.cloudfront.net
Software: Apache-Coyote/1.1 /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 619f2eec0ea05d2ce0279df117eb9a0c.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: JFK52-P1
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: VirzXAyrpczNOvyKToP_3dpG8BmbfGhiaQbIPRXAmQ474mzSnmVuZg==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 a41c564554b07cc8611f5945b432513a.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: JFK52-P1
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
location: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=4472bf44-7dce-43d7-b3d2-92c989ceb0d9&3rddpi=1177082855&3rdpcid=970314641601922599&3rddpi=1213503647&3rdpcid=y-k0R9VlhE2uImtN4VBoihLHDkDc3l32NS%7EA&3rddpi=1239766150&3rdpcid=d7d9ffaf-bf6d-4a83-988c-9d575e003fb2&3rddpi=443164713&3rdpcid=HcTt0R3FvNAGw7mCG5SjhRjG6NYGxLjUG8E-w83d&ckls=true&ci=mViFwChyGS&nc=false&trid=-631258666
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
patent: https://www.almondnet.com/ip
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: _MYxkpnTneuBG3qLMDZRBzJfDf7ZaEfQcLyC3XiXVgu2f2mQYvYd0w==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8E21 22 KB
8 KB 48ms
28ms Document
text/html 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 56323
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:59:14 GMT
expires: Thu, 25 Jul 2024 20:59:14 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 56D6 22 KB
8 KB 45ms
29ms Document
text/html 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 56323
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:59:14 GMT
expires: Thu, 25 Jul 2024 20:59:14 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame FA50 22 KB
8 KB 34ms
29ms Document
text/html 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 56323
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:59:14 GMT
expires: Thu, 25 Jul 2024 20:59:14 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2E8C 42 B
64 B 75ms
55ms Fetch
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstVctc0Wzo_7jMd5EeqUoDZLOzNZ6KlS_RhPzQLAgPYQnCGpsOW-o3WUbA9xZC2aYuOhKgDzn_R2W4EvUHg5NbHUn39DECIf2WjTCzAM5_M-zQBdB5-1NenhgW6AE_j2UroGTV9_ExA1g&sai=AMfl-YTL2dRaB4YSLpvu7ATYOxF952rXsgZSrCMfsl6muyS0UapF6n2WwdrgLOSW6Pte6PFIQ2FgLgPdTCv9kRM8InH5JcpFdyM6AoV27AH7EBQmHDvNAoYu5_EDT6E&sig=Cg0ArKJSzCkgZ5eyWSmJEAE&cid=CAQSOwBpAlJWJPkiFoHhPQB-lD2qRACMgIk7I8htIY3BN9RPIkNrZckk7W7PQrwD1B6n9t0eXVymSp2OXIlBGAE&id=lidar2&mcvt=1245&p=1144,222,1234,950&mtos=0,0,1245,1245,1245&tos=0,0,1245,0,0&v=20230724&bin=7&avms=nio&bs=0,0&mc=0.62&if=1&vu=1&app=0&itpl=20&adk=891648550&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1690461472383&rpt=3991&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js Show response
s0.2mdn.net/sadbundle/15571588451724435493/ Frame 03E9 90 KB
26 KB 15ms
7ms Script
application/x-javascript 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ecd496ef92b3ff404c6040f0149d5712e19055e365fd63e8d336fc74e299a93d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 11:52:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 521156
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26262
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 20 Jul 2024 11:52:01 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 9948 0
0 45ms
40ms Image
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CXwnBIWXCZJ-gAsjG_gTYg6LQAt2XtNJw8L2ag6QRx7Xpi90CEAEg2NXYK2DJxqmLwKTYD6AByKrF1gPIAQngAgCoAwHIA8sEqgSSAk_Q-Lxi8lfRUvbO1h9SFnad1_F5rm-z1rRfrTmPMrGPeHEEK7a34glMSYWP0URPyOXQ7-Vzw3pnuKcnDrs2oqAs_S-xHH2zPneqHpknEkOAZE03DtoLulCZOIBa2xozN3esg-6aBSsj96ubFAxCIHhENkcVvoMFgLbIHkaoZemiqHI3vJCRCQSs5GsbpFNXhMbaIfGkcDsgQXAfBHWWsbehEOHIXwOXuRrKiF5MtGrC3PLenXmCnodLFHULD4i5qNoEJyEU8jsIX_N7da3m2NG2gbNL4_UExn-4Ysz4NxLLg_OvebgfHvMKjewRieg9t0nMM0uBM5UGuml-iTxZK7EvD9kkTAD1fAOPwgd0kb5CX1_ABL-c_pr5A-AEAZIFBAgEGAGSBQQIBRgEoAYugAfWj_CLAagH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEEJPyLdIIFAiAYRABGB0yAooCOgKAQEi9_cE6gAoDyAsBmAzSsaCN7AO4E6EE2BMO0BUBgBcBshceChwIABIUcHViLTk1MTcxODUxMDYyODM2ODIYmNsQ&sigh=QtREBCXmSBE&uach_m=[UACH]&cid=CAQSOwBpAlJWy4xZ3ZbI6trqOuXa1MUZGsctIRThkqQ09lbkyD4DfSQeavOlKvZFO-bY_fRwTUR43BQ-DtxYGAE&template_id=545&cbvp=2&vis=1
Requested by: Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

POST
H3 204 AGSKWxXPvVBITFiWmvTp1eJ5ySWvkr9Hftlz7gEmLP4E6mbflN-OBCZN_yNe7M86d7vHU7pyU1LN9RgtMKjWC0ZlFnY= Show response
fundingchoicesmessages.google.com/el/ 0
28 B 54ms
48ms XHR
text/html 2607:f8b0:4020:804::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXPvVBITFiWmvTp1eJ5ySWvkr9Hftlz7gEmLP4E6mbflN-OBCZN_yNe7M86d7vHU7pyU1LN9RgtMKjWC0ZlFnY=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-1ERfBMuUJXhJYOoWiaFQuw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:57 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-1ERfBMuUJXhJYOoWiaFQuw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxUvbuoGJsQge0HuWDTm_Snhymrtp8n1VZrc2VmH6RJEhIvheTmSPX3cmrtAZghosmz3IQyBbFSzws_2zL1ed3gL7OoKDU-pU9gFQNO1uxydFPiUAA0Yn0V32rV3fC8t1_-Sz-Qh7g== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 65ms
63ms Script
application/javascript 2607:f8b0:4020:804::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUvbuoGJsQge0HuWDTm_Snhymrtp8n1VZrc2VmH6RJEhIvheTmSPX3cmrtAZghosmz3IQyBbFSzws_2zL1ed3gL7OoKDU-pU9gFQNO1uxydFPiUAA0Yn0V32rV3fC8t1_-Sz-Qh7g==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjkwNDYxNDc3LDcyODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vZWhmbWMtY29tLm5nb250aW5oMjQuY29tLyIsbnVsbCxbWzgsIjRVYmtnOWIyTGE4Il0sWzksImVuLVVTIl0sWzE5LCIyIl0sWzE4LCJbW1swXV1dIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

272cfca7be2cc8a17917ed3bf3142308b92ac3113eddb6b692bc52b96461ac59

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-HHSOwLu5QJIRnHe4rDsocg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:57 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-HHSOwLu5QJIRnHe4rDsocg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 9948 33 KB
33 KB 9ms
7ms Font
font/woff2 2607:f8b0:4006:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2003 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 04:45:59 GMT
x-content-type-options: nosniff
age: 546718
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 20 Jul 2024 04:45:59 GMT

GET
H3 200 d5172966dc6f96ad0462b6e137d21b0e.js Show response
s0.2mdn.net/sadbundle/5357816647124024566/ Frame 2069 98 KB
28 KB 6ms
5ms Script
application/x-javascript 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/d5172966dc6f96ad0462b6e137d21b0e.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

781808bc8edd6a369bdc077fb4b8d701ed00b31f6458142a2137af774ac6f78c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 04:01:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30979
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28704
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jul 2024 04:01:38 GMT

GET
H2 200 iqusync-1.25.min.js Show response
resources.infolinks.com/static/usync/ 2 KB
1 KB 18ms
14ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/usync/iqusync-1.25.min.js
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/lcmanage?pid=3245929&wsid=0&pdom=ehfmc-com.ngontinh24.com&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e035885f253b73836d41088415cc8c467e43385ca3452b111431e6ab76f990b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:57 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 22 May 2023 09:55:02 GMT
server: cloudflare
age: 8049
etag: W/"8e7-5fc4543bc811d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 7ed4efcc08b74388-EWR
expires: Sat, 26 Aug 2023 10:23:48 GMT

GET
H3 200 b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js Show response
s0.2mdn.net/sadbundle/15571588451724435493/ Frame 71B3 90 KB
26 KB 5ms
5ms Script
application/x-javascript 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ecd496ef92b3ff404c6040f0149d5712e19055e365fd63e8d336fc74e299a93d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 11:52:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 521156
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26262
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 20 Jul 2024 11:52:01 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8B1F
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEDXXZ9o2cGYteqPrFbtbIJs&google_cver=1&google_push=AaAOQGFr33ieMzXQjFGMkA-BTDRC6M0hYxQd2gwaQStv2HlEKJQFrIObqr...
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AaAOQGFr33ieMzXQjFGMkA-BTDRC6M0hYxQd2gwaQStv2HlEKJQFrIObqrSvfcYLXo3sPGNrgH2-QkiKwagRQmus_jNBftNGVNW6&google_hm=uerpIM...

170 B
188 B

58ms
53ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AaAOQGFr33ieMzXQjFGMkA-BTDRC6M0hYxQd2gwaQStv2HlEKJQFrIObqrSvfcYLXo3sPGNrgH2-QkiKwagRQmus_jNBftNGVNW6&google_hm=uerpIMzcwoGQ8qhzKPiaKA

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AaAOQGFr33ieMzXQjFGMkA-BTDRC6M0hYxQd2gwaQStv2HlEKJQFrIObqrSvfcYLXo3sPGNrgH2-QkiKwagRQmus_jNBftNGVNW6&google_hm=uerpIMzcwoGQ8qhzKPiaKA
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8B1F
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGFi-hRbM8MuEP94p8mryrQ6jxjbS0d3-Vw-I_pbOXG...

170 B
188 B

38ms
37ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGFi-hRbM8MuEP94p8mryrQ6jxjbS0d3-Vw-I_pbOXGK8i93YjUAktBI9wuCRSf8yOXxCRarYReTAVJc9I3m8IBv2DjJw9kb

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:57 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-784-g0c0b2cf#rel-ec2-master i-0bcf48f5eb6bc72ae@us-east-1e@dxedge-app-us-east-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGFi-hRbM8MuEP94p8mryrQ6jxjbS0d3-Vw-I_pbOXGK8i93YjUAktBI9wuCRSf8yOXxCRarYReTAVJc9I3m8IBv2DjJw9kb
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8B1F
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEHOhJH0HgTsAsDdQcUg_RNw&google_cver=1&google_push=AaAOQGF30PEBj9q7pG6a2CXNWgfgrdkIryyubsScArwvMaWS1mGVbVkXJyC6rGJ1jk7RNIx2JzANQKO_HFOw7R-fJF...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=YTc0ODU2NTktMWQ4Ny00NDEzLWEyNTYtMGI2YmJhNGZhNzMy&google_push&gdpr=0&gdpr_consent=&ttd_tdid=a7485659-1d87-4413-a256-0b6bba4fa732

170 B
188 B

61ms
55ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=YTc0ODU2NTktMWQ4Ny00NDEzLWEyNTYtMGI2YmJhNGZhNzMy&google_push&gdpr=0&gdpr_consent=&ttd_tdid=a7485659-1d87-4413-a256-0b6bba4fa732

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:57 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=YTc0ODU2NTktMWQ4Ny00NDEzLWEyNTYtMGI2YmJhNGZhNzMy&google_push&gdpr=0&gdpr_consent=&ttd_tdid=a7485659-1d87-4413-a256-0b6bba4fa732
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 423

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8B1F
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESEGxvXSF98Q3DnE9CWVBjHFc&google_cver=1&google_push=AaAOQGHbFiNHwXVLaZZF4QTylEoY5g8lYlfD6YP5cxOUBgkuTSHPgLuJzCRDdWtBYIVkq9l1aQ3e03MJooGArAXXIBfl5zTgiu9M
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==

170 B
188 B

62ms
54ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==
date: Thu, 27 Jul 2023 12:37:57 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8B1F
Redirect Chain

https://rtb.adentifi.com/CookieSyncAdX?google_gid=CAESEGwWO3TrA9Jw_LxqPq5aUJA&google_cver=1&google_push=AaAOQGHyW145ofRnEfcIKB472HYuWXm5B0qSlOiQpi2lFSGjRRRa3uBSOEgUWM3bVPergUg3jD4S242QKQsVvxSfGLIFE...
https://cm.g.doubleclick.net/pixel?google_nid=adtheorent&google_hm=Zp9EECx6Ee6T2xKnrfzb6w&google_push=AaAOQGHyW145ofRnEfcIKB472HYuWXm5B0qSlOiQpi2lFSGjRRRa3uBSOEgUWM3bVPergUg3jD4S242QKQsVvxSfGLIFE-A...

170 B
188 B

101ms
94ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adtheorent&google_hm=Zp9EECx6Ee6T2xKnrfzb6w&google_push=AaAOQGHyW145ofRnEfcIKB472HYuWXm5B0qSlOiQpi2lFSGjRRRa3uBSOEgUWM3bVPergUg3jD4S242QKQsVvxSfGLIFE-A0QoJ_&google_redir=https%3A%2F%2Frtb.adentifi.com%2FCookieSyncAdXCheck&google_ula=6802874232

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=adtheorent&google_hm=Zp9EECx6Ee6T2xKnrfzb6w&google_push=AaAOQGHyW145ofRnEfcIKB472HYuWXm5B0qSlOiQpi2lFSGjRRRa3uBSOEgUWM3bVPergUg3jD4S242QKQsVvxSfGLIFE-A0QoJ_&google_redir=https%3A%2F%2Frtb.adentifi.com%2FCookieSyncAdXCheck&google_ula=6802874232
date: Thu, 27 Jul 2023 12:37:57 GMT
content-type: text/plain

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8B1F
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEPX02IOAklvX6AwbwUgrtoU&google_cver=1&google_push=AaAOQGHLIyGiQy_qGPxnZdGu72Pbl9hP8To4ZYNsQxHRyp3b2ZzRLvUOX6B-U1ctNIGJcQe2dlHDuwXu57tM3cbZb7dG...
https://r.bidswitch.net/sync?bidswitch_ssp_id=google&bsw_custom_parameter=fa600ba6-dc58-41e7-a41a-832e682c030f
https://pixel.tapad.com/idsync/ex/receive?partner_id=3205&partner_device_id=fa600ba6-dc58-41e7-a41a-832e682c030f&partner_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D393%26user_id%3D0%26ssp%...
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D7f4728db-c546-4885-91eb-59bdc0ffdd33%252Chttps%2525...
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=7437480408642019502&pt=7f4728db-c546-4885-91eb-59bdc0ffdd33%2Chttps%253A%252F%252Fx.bidswitch.net%252Fsync%253Fdsp_id...
https://x.bidswitch.net/sync?dsp_id=393&user_id=0&ssp=google&bsw_param=fa600ba6-dc58-41e7-a41a-832e682c030f
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGFlpBWhbpmKOVZFKt1ZDnf5HBBRiZx14S3lPtwSSOMwmUkLr76YtAoC7o2eWxUa6Yj7TADCLP9cei-y0UPoLPGBROJj_Tw&google_hm=-mALptxYQeekGoMuaCwDDw==

170 B
188 B

45ms
44ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGFlpBWhbpmKOVZFKt1ZDnf5HBBRiZx14S3lPtwSSOMwmUkLr76YtAoC7o2eWxUa6Yj7TADCLP9cei-y0UPoLPGBROJj_Tw&google_hm=-mALptxYQeekGoMuaCwDDw==

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGFlpBWhbpmKOVZFKt1ZDnf5HBBRiZx14S3lPtwSSOMwmUkLr76YtAoC7o2eWxUa6Yj7TADCLP9cei-y0UPoLPGBROJj_Tw&google_hm=-mALptxYQeekGoMuaCwDDw==
Date: Thu, 27 Jul 2023 12:37:59 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8B1F
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEJYsuHs6s1O74JLGHus4zP8&google_cver=1&google_push=AaAOQGHr3Q2ks0AbyG2WWxA1Mper13qPkvWX-aVAJR0vDsXZRFN_3gJysMLE3lNWzuKxeYjG8AiwH7XQWO4n8HJ...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGHr3Q2ks0AbyG2WWxA1Mper13qPkvWX-aVAJR0vDsXZRFN_3gJysMLE3lNWzuKxeYjG8AiwH7XQWO4n8H...

170 B
188 B

42ms
37ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGHr3Q2ks0AbyG2WWxA1Mper13qPkvWX-aVAJR0vDsXZRFN_3gJysMLE3lNWzuKxeYjG8AiwH7XQWO4n8HJ5yV9EWCo8v2WI

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=TsQVy5XhU41iMArRnN9PSgW16oY&google_push=AaAOQGHr3Q2ks0AbyG2WWxA1Mper13qPkvWX-aVAJR0vDsXZRFN_3gJysMLE3lNWzuKxeYjG8AiwH7XQWO4n8HJ5yV9EWCo8v2WI
Date: Thu, 27 Jul 2023 12:37:57 GMT
Connection: keep-alive
Content-Length: 242
Content-Type: text/html; charset=utf-8

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 8B1F 0
12 B 44ms
35ms Image
text/html 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I3vYz0LPkkiXO3C8zdzDyMQieVN4vvR8QIhdaCjFR62yTGdSYdq7xvhvjkaBkeOLcuLt5h

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:57 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame A274 43 B
855 B 16ms
15ms Image
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZMJlHrxKtywSipqqcGg9AQAABT8AAAIB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:58 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: PX92MVYVB09ZR8YQAF9C
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame A274
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZMJlHrxKtywSipqqcGg9AQAABT8AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEMD5_JMyCLjJQlA1roR4Lgg&google_cver=1

43 B
632 B

9ms
5ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEMD5_JMyCLjJQlA1roR4Lgg&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:58 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEMD5_JMyCLjJQlA1roR4Lgg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A274
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=a7485659-1d87-4413-a256-0b6bba4fa732&expiration=1693053478&gdpr=0&gdpr_consent=

43 B
632 B

15ms
5ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=a7485659-1d87-4413-a256-0b6bba4fa732&expiration=1693053478&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:58 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=a7485659-1d87-4413-a256-0b6bba4fa732&expiration=1693053478&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame A274
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=7437480408642019502

43 B
632 B

16ms
5ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=7437480408642019502
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:58 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
an-x-request-uuid: fe8cdf17-f7fb-42b7-ba28-52b1717a3a9d
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=7437480408642019502
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

crum
dsum.casalemedia.com/ Frame A274
Redirect Chain

https://bttrack.com/pixel/cookiesync?source=67e94f23-25d6-4008-8236-375d1743c2e0&secure=1
https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=4e1ffa94-5bed-467e-b2df-23bf9de8b444

43 B
632 B

29ms
7ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=4e1ffa94-5bed-467e-b2df-23bf9de8b444
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:58 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

x-servername: Track003-iad
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:54 GMT
strict-transport-security: max-age=31536000;
content-type: text/html; charset=utf-8
location: https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=4e1ffa94-5bed-467e-b2df-23bf9de8b444
cache-control: private,no-cache
content-length: 222
expires: -1

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame A274
Redirect Chain

https://trace.mediago.io/ju/cs/indexexchange
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=215&external_user_id=70669cc9b639c7f4172d478b3307d7e3

43 B
632 B

14ms
6ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=215&external_user_id=70669cc9b639c7f4172d478b3307d7e3
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:58 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=215&external_user_id=70669cc9b639c7f4172d478b3307d7e3
date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8
content-type: text/plain; charset=utf-8

GET
H/1.1

200
OK

rum
dsum.casalemedia.com/ Frame A274
Redirect Chain

https://x.bidswitch.net/sync?ssp=index
https://r.bidswitch.net/sync?bidswitch_ssp_id=index&bsw_custom_parameter=fa600ba6-dc58-41e7-a41a-832e682c030f
https://pixel.tapad.com/idsync/ex/receive?partner_id=3205&partner_device_id=fa600ba6-dc58-41e7-a41a-832e682c030f&partner_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D393%26user_id%3D0%26ssp%...
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D7f4728db-c546-4885-91eb-59bdc0ffdd33%252Chttps%2525...
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=7437480408642019502&pt=7f4728db-c546-4885-91eb-59bdc0ffdd33%2Chttps%253A%252F%252Fx.bidswitch.net%252Fsync%253Fdsp_id...
https://x.bidswitch.net/sync?dsp_id=393&user_id=0&ssp=index&bsw_param=fa600ba6-dc58-41e7-a41a-832e682c030f
https://dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=&gdpr_consent=&us_privacy=

43 B
632 B

6ms
5ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:59 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Location: //dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=fa600ba6-dc58-41e7-a41a-832e682c030f&gdpr=&gdpr_consent=&us_privacy=
Date: Thu, 27 Jul 2023 12:37:59 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2 200 tp_out
d.adroll.com/cm/index/ Frame A274 42 B
182 B 273ms
9ms Image
image/gif 2600:1f18:61c0:2206:3a89:67bd:12fc:5feb
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/index/tp_out?advertisable=3GMDZMBFQREVBC75SYYKWH
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:61c0:2206:3a89:67bd:12fc:5feb Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx/1.22.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:58 GMT
cache-control: no-transform,public,max-age=300,s-maxage=900
server: nginx/1.22.1
content-length: 42
vary: Cookie
content-type: image/gif

GET
H2 200 ix-usync
router.infolinks.com/dyn/ Frame A274 35 B
196 B 40ms
37ms Image
image/gif 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ix-usync?uid=ZMJlHrxKtywSipqqcGg9AQAA%261343
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7ed4efcfdcab4388-EWR
content-length: 35
expires: Wed, 27 Jul 2022 12:37:58 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E968 42 B
64 B 46ms
46ms Fetch
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuQ97bxc4KJOKk8qoBWwtRjJofnL1l2Me8OKTG6yPWUrrmuTin906fy9zXDo8Eh0EYtcfuRcgiSTSqh034CyyN9a7siUIoYV2vFbeRRERYpjpaH2x7zjsLBS7ci3LJnw_xyFff-ql4BB4cduMJxbiw-O8aYjgEtnk7EJd7AN6Eyy0UzjKjohutpezS5_I7Kgg6UlhzxNIu7-hm2AtT1jxgwpajJN7DHuRS96g2PTCLz84b3qJt5ZLN9RZXTaXGpYkbyr6lwLhT7FtLIm9QpoSqX7wamVnVbj1rnadFX_aQ4AZh2WHqbrsUlQ1Jo_xWz9Z2ABCr7f3GHHqNNY3sCVA2REOOAk3X_2BOr87IHd8Xi5ojVdyeSfGwhql6TslKziKNea9hVPBmqA_W3m2BPAC0RggkkSQ5FvsaWOAFAelyU-i-NojvBTREvg7x1kWcPhENqnWyHMiShA4B6_5v8Fe1WBMuq5YsNfRse0b6Zpf_f3drdvzVB34pBXBeTvWEpQHIST_UXrAZTeWNgNKfQxJzynlhEDLz2GMwTEdAsCqM6gLcSDqCKsDCVBfm6bLF2NzpWRPeA5i0BlTdu2j5kJAe6DCdWV72HBhSDIIzR8ebfNKSDawUUOctfJVWpQ2UG7Fy7w-0KX5KCq3ng5X6jw8GJp2bUyxAw-41DKzIN-ulKatGAeyuxEyN1LeGNl0DVsMoUHTXidrg8o467GOxoY3DpVs0QDlphRLdm3EkTcMPSn329F_JcFwNngINE4E6-8WGfhwGe0MtuUrEv36O3N6OSAlU0B5vrxiA5wCTlHrNdPukNGTm21Tl-tzAI3E-GenqVDF7B-w21akFEknBvXxIlTNMAjwZyzsiYA_nnexCDzi-WlXQrlxhMXJBMaaq_fWvG0oWrEE6uHSxWvhwz6l3EcBm15Di4RgdczVsh-jW_wNz9TbkkF42gsj05G3wZKmncrHi9HFym79Y8KI5p5LiBiAIR72097Bc2ehHquEptEzl6OuetSCb5cIy5eoQtOyoVrR3IVB69duVJkKyjrSN0M1kAYo3mYXJ_U5ux_aFtaMDtv-0pSw&sai=AMfl-YSI_L0XNnqvQbk78hYRhQdKvRr5DhjWO4wIMfdtbqAC3JSan2IVzqpkCUsD1hxoEsTg2ywWRhG6zDQmf2qr_QT4eKWaJ7ZLvQ&sig=Cg0ArKJSzDOJFeIoxjzKEAE&cid=CAQSGwBpAlJWuhmwbHp-DJLm-VMt4vdgXNpG7AsjeRgB&id=lidar2&mcvt=1508&p=0,0,124,1005&mtos=1508,1508,1508,1508,1508&tos=1508,0,0,0,0&v=20230724&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1690461470690&rpt=5983&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame BB0F 22 KB
8 KB 24ms
20ms Document
text/html 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 56324
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:59:14 GMT
expires: Thu, 25 Jul 2024 20:59:14 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 694A 42 B
64 B 72ms
68ms Fetch
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstfDWH7wZAxoFSgkB6YMsLPmASUMbO2hIRli17jtesiGeu79LZVjeWq0NdW0seZkBYesZDkjh0cuNMVEWPGpEO5TJXo0UCq5hqQDKW-Xs-nmc1VmL7QvNPLOk79RrovghYFPoTAqBsewda4uYe7D71qz5Q60C3_I50vHvu3m94B4TLDArK1nxJAE7GxTWtEx5flKt0KSWtw_JJe1i0Re1XgMc3RxoD-XLe6AEPkHOiL1Grs2o4vG97fSEfpQfZqNVe-oDvfOsZfyoOyzg0B0Jf7aQnTANBTia3qQxF3emPul5V7WV-nuyvnQ4TdXLWmha3jCTA-tZrwrKXKX0BlDA0queClRbhNrOrdqphRt6nFkZ931Rjkv6T-ChoHaUYIjQA63Tri2jjfgI-LNbQQ8yhY8mq3cFbe31yZ54FEO6OgM66N3ypTJ1__sY6SionfMYxyefMCmmr_Ib4UIbDsUZwVDPLJd8T24Vkcfe1hG3hPayzFyaKKRa_rL0w7Mn6CQrDf-46KYm-6gPyVtdAUsTlt6-n8T0kzkACHdJ8JoICDWWLk3pfFDqVrUROMxk6KwEdPvMRe0sIIYkU6C9z2v7ztqnw_prDz5DJuhBPl5z_CiYiBIZ7F3vUnSTDH4_OciFt_m37fo0FuK7YhB_IXrTNO10hDS295MrMk8-zzq-ZZRjjG6wLMwxkMUVmpdMqnPFtC16hZOfDVboA9eqoO4V2bLUUmrJMW9qG2gXWekRR2TrlQhB1Si0nTQ51znw6XzsojDix56-hwdMGH8pPN4mXr6LpZsN10w526elimGHA5o_fLRZzSRdrdwevCCZVaJfEabl1HcPbhQjS2kFPTaoAdm4O0maof6L8AgNf5cC6zariWA_b1hU75RauEW9waMmBXKjum5WLFDalH52eA30pdzFXoQ6GSW3QnTKmorVNqAZ8kdRsQO8kXjWWVh-CJsWIR0OgSAr_RT0HIAE6YaL9XoNC1uvrSjgbFhvC9m7DjRIMfV-i85yF54sFSaY8dyWq5OmMmgPP74hHtbNpULPuCkLsdsK_CEKQmtUWxq-q4jo7eOSDDNTVvQDeLv-4Sm2VyTpFoVXxhEsAXJZfoaeAP&sai=AMfl-YQJIYhNQYyqSCg3YI8okpKYy3BBQHoG3aiVRbZpxtuisGKwtfPFm7vWjxlEC74z4kn_gGYVYxlzuY-rrj33aZwoYHZlXnFS4xU_WZdhpXha_DKfzVJ8gtHGrM_obMlOaHxqQCnMvh0l&sig=Cg0ArKJSzOgEBh8jG9hXEAE&cid=CAQSOwBpAlJWg0FEZZTQ3MagvyLwX1u0NWW7xvyTFRUqkxqRl4M0ZxD80f0rpQJWfNm1sz21mjgt_C8yEP2NGAE&id=lidar2&mcvt=1459&p=0,0,280,409&mtos=0,0,1459,1459,1459&tos=0,0,1459,0,0&v=20230724&bin=7&avms=nio&bs=0,0&mc=0.61&if=1&vu=1&app=0&itpl=22&adk=3855717033&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1690461468662&rpt=8039&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 694A 0
17 B 381ms
381ms Ping
image/gif 2404:6800:4009:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=6~lkl545wk&c=7568049181108&slotId=3784024590554&qqid=CLyL5NrzroADFU44wQodFtwIqw&dm=64181&event_name=first_play&asset_bytes=139298&video_bytes=0&cached_data_bytes=0&js_cached=false&css_cached=false&num_assets=12&num_assets_cached=0&num_assets_cache_validated=0&num_assets_unmeasurable=4&video_played_seconds=0.00&video_muted=true&video_seconds_loaded=0.00&met.4=vil.lkl546ic~ff.lkl546u4
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/5529604523bf1021996c9e114ecf8778.js?tag=video_location/web_och
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4009:800::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js Show response
pagead2.googlesyndication.com/bg/ Frame E57A 37 KB
14 KB 23ms
22ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230725/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4f9e4b1838819f2fdbc6eea07e712886701f71a49ff22a445a9be3d5c7d806

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:38:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57580
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14628
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jul 2024 20:38:18 GMT

GET
H2 200 ctrack
track1.avplayer.com/ 0
98 B 43ms
2ms Image
text/plain 35.169.83.220
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.avplayer.com/ctrack?pt=2&d66=8.2.12&stagid=&stplid=&pid=632d59d7b9689f25ad20b012&cid=633172fb22e9a25a4645a127&r=ehfmc-com.ngontinh24.com&sn=&cd1=&cd2=&cd3=&app=&test=&cb=1690461478311&e=AVC_M1&cvid=&cpid=&str=autostart&vi=100&wi=300&he=250&sspt=10.412
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.83.220 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-83-220.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:58 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D8C1 42 B
64 B 81ms
52ms Fetch
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsswCFz28ZMgcH5xoUN3JKyuVzZOrREPhlAKvJhSz7FlHMsJ_JNcIBiHRVKoBui1CWJl2-m5TQV2XdFm8b2y7Oyg8-gR63PpW4stWzU1HBbl4GzUvBI6fn3nu4XGvNyuh-SM0cTP2FSKpA&sai=AMfl-YSlPcrlrx1v9apaC1S6ltwmaeKHixBT_ZoV1-OW4kJAAi3BWITFODCe-RMUS7ckUimIoJk3idBJu2hBJRKeGdEQjN6s_3lpguvt_i6JKs4we-8OpvfyOyGe5TQ&sig=Cg0ArKJSzI2C4ITYo43dEAE&cid=CAQSOwBpAlJWZKLHhTXzmfrVyXvl_Qw8rMKJIv9XM5VgYw-W3qfpaPtUZpGqdmzhxmXDLIPTrgOYpJj3MukjGAE&id=lidar2&mcvt=1382&p=600,259,640,300&mtos=1382,1382,1382,1382,1382&tos=1382,0,0,0,0&v=20230726&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3809490118&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1690461472471&rpt=4067&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 44B4 42 B
64 B 58ms
47ms Fetch
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstBKlboaLjk3x3HvYEMftWh1MrjYJnMw4BrpfMHFe004e7FUpHzoNDS3auPYQrgfznIu3FSlqYGp8JDGLL1X3VKYuKujRuDnuv-BxPZ0I7R3EfUkeqA&sig=Cg0ArKJSzBBmh3RoBIfSEAE&id=lidar2&mcvt=1290&p=1110,436,1200,1164&mtos=1290,1290,1290,1290,1290&tos=1290,0,0,0,0&v=20230724&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=3242601509&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1690461472308&rpt=4680&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 271F
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1&google_push=AaAOQGHdAajrMmebWwpas4mo4EOvpziZ3BosrWtgSEk62p6a4vp1Q2IWtVDnnXxS2RapUFp3CnVgHrurC46dL9uDVJm7ogLKnSM
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NDA5MzMzNDg1NjI1MDcwMTMzMQ==&gdpr=0&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1

43 B
398 B

27ms
26ms

Image
image/gif

2620:112:f002:bbbb::21
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 2620:112:f002:bbbb::21 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=0&gdpr_consent=&google_gid=CAESEKis5ef2aBXZKxOB3fJ7QDY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 271F
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEDXXZ9o2cGYteqPrFbtbIJs&google_cver=1&google_push=AaAOQGHGLhvg9XaA113wUg5tgicpuzLBnUKAbSDrwpOSfOnUDftYChhqCm...
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AaAOQGHGLhvg9XaA113wUg5tgicpuzLBnUKAbSDrwpOSfOnUDftYChhqCm-ZGEyt34OgBd2BNYgV1lqulDcajNqvBOJfV3WR2QI&google_hm=uerpIMz...

170 B
188 B

42ms
40ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AaAOQGHGLhvg9XaA113wUg5tgicpuzLBnUKAbSDrwpOSfOnUDftYChhqCm-ZGEyt34OgBd2BNYgV1lqulDcajNqvBOJfV3WR2QI&google_hm=uerpIMzcwoGQ8qhzKPiaKA

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AaAOQGHGLhvg9XaA113wUg5tgicpuzLBnUKAbSDrwpOSfOnUDftYChhqCm-ZGEyt34OgBd2BNYgV1lqulDcajNqvBOJfV3WR2QI&google_hm=uerpIMzcwoGQ8qhzKPiaKA
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 271F
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGGw2IeX4s88q2JWcSC2MCLBTTI-nQx6QOx6BvlEgPA...

170 B
188 B

40ms
38ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGGw2IeX4s88q2JWcSC2MCLBTTI-nQx6QOx6BvlEgPAwak-WMgzZEUW02aEVPAbHXWP6I9p_g5mADtlZDagaLYRwWswwzE8

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:57 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-784-g0c0b2cf#rel-ec2-master i-0e392308e04f047a8@us-east-1d@dxedge-app-us-east-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ckRpWG1PUTYxUXAwZkM1&google_gid=CAESEMLkoQVF59EPvcXn2IYp3Bc&google_cver=1&google_push=AaAOQGGw2IeX4s88q2JWcSC2MCLBTTI-nQx6QOx6BvlEgPAwak-WMgzZEUW02aEVPAbHXWP6I9p_g5mADtlZDagaLYRwWswwzE8
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 271F
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wk1KbElRQURfNHFEVUFCWQ==&google_gid=CAESEBO-kX1m54gvrbUJSMImTXs&google_cver=1&google_push=AaAOQGF0zC0KJ648v1uG9XMX7DyJGxsNc4...

170 B
188 B

41ms
40ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wk1KbElRQURfNHFEVUFCWQ==&google_gid=CAESEBO-kX1m54gvrbUJSMImTXs&google_cver=1&google_push=AaAOQGF0zC0KJ648v1uG9XMX7DyJGxsNc43recM6ntKxwXGVQja8JyTRU0QLZETNW9G4DfslPXyt3YPOBkHN8dy_crsEQ9QxkiY

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-lga21963-LGA
pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1690461478.391761,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wk1KbElRQURfNHFEVUFCWQ==&google_gid=CAESEBO-kX1m54gvrbUJSMImTXs&google_cver=1&google_push=AaAOQGF0zC0KJ648v1uG9XMX7DyJGxsNc43recM6ntKxwXGVQja8JyTRU0QLZETNW9G4DfslPXyt3YPOBkHN8dy_crsEQ9QxkiY
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 271F
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESEGxvXSF98Q3DnE9CWVBjHFc&google_cver=1&google_push=AaAOQGEOgR_Hj2nwZa4TYLBQgeuYbRI8j82x6mjs-JQ_RsEc884kBs30ojueknZhvTPa6sdL2cV9tKXQ8stF-OhmXiysgHdH4w
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==

170 B
188 B

40ms
38ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=RDBGMEE0RTc0QjkzRkFBRQ==
date: Thu, 27 Jul 2023 12:37:58 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 271F
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEPX02IOAklvX6AwbwUgrtoU&google_cver=1&google_push=AaAOQGFlpBWhbpmKOVZFKt1ZDnf5HBBRiZx14S3lPtwSSOMwmUkLr76YtAoC7o2eWxUa6Yj7TADCLP9cei-y0UPoLPGB...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGFlpBWhbpmKOVZFKt1ZDnf5HBBRiZx14S3lPtwSSOMwmUkLr76YtAoC7o2eWxUa6Yj7TADCLP9cei-y0UPoLPGBROJj_Tw&google_hm=-mALptxYQeekGoMuaCwDDw==

170 B
188 B

39ms
37ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGFlpBWhbpmKOVZFKt1ZDnf5HBBRiZx14S3lPtwSSOMwmUkLr76YtAoC7o2eWxUa6Yj7TADCLP9cei-y0UPoLPGBROJj_Tw&google_hm=-mALptxYQeekGoMuaCwDDw==

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGFlpBWhbpmKOVZFKt1ZDnf5HBBRiZx14S3lPtwSSOMwmUkLr76YtAoC7o2eWxUa6Yj7TADCLP9cei-y0UPoLPGBROJj_Tw&google_hm=-mALptxYQeekGoMuaCwDDw==
Date: Thu, 27 Jul 2023 12:37:58 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 271F
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEGiXZycTwgahC91LEZIk3-Y&google_cver=1&google_push=AaAOQGFwrQslkeSwjxTvQfeC9dpFeLiVR9-hOUiWl-ud2ATien14LNZZaIsTfGVyvpkXsXdZH80qsTNi...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjYwNjMxMTM0Nzc1NTgwNTEwNA&google_push=AaAOQGFwrQslkeSwjxTvQfeC9dpFeLiVR9-hOUiWl-ud2ATien14LNZZaIsTfGVyvpkXsXdZH80qsT...

170 B
188 B

46ms
46ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjYwNjMxMTM0Nzc1NTgwNTEwNA&google_push=AaAOQGFwrQslkeSwjxTvQfeC9dpFeLiVR9-hOUiWl-ud2ATien14LNZZaIsTfGVyvpkXsXdZH80qsTNigD4RYmHHUPHTZQU3RAY

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjYwNjMxMTM0Nzc1NTgwNTEwNA&google_push=AaAOQGFwrQslkeSwjxTvQfeC9dpFeLiVR9-hOUiWl-ud2ATien14LNZZaIsTfGVyvpkXsXdZH80qsTNigD4RYmHHUPHTZQU3RAY
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 271F 0
12 B 36ms
35ms Image
text/html 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KDBAIo9-1eQB2I7Gz6v4-W1G-vifN1Gdd7l1L6Xp1RFOBgJSRoGUvo0-TMuHYTp_lf9i5X

Requested by

Host: 3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com
URL: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:58 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 0ED6 42 B
64 B 69ms
68ms Fetch
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuSEjkPpREXEl_-uWmicL30hMy6K1liKotZmgY8iJbr6JnfRn6_BYvkXZdNDHW6M21samslLq5tGlXOJgWxZ1QXFXkAlev-s0wWqC01AOAmkdY11jq7MmUCRZNfD87M7tJOE4jn7brOYA&sai=AMfl-YQ5Tcq7OagBgrdUDIeodjRm2Wp-3rqiZwGJpTwIrvfpbJtsjFioa7Z5Tv37IzevUhUv15PmDHKPojlS_WW5kv1z_lv6bU-mH2OcS835ofzrDrL1W-eB3sRjZzY&sig=Cg0ArKJSzN9XaWzHZsbkEAE&cid=CAQSOwBpAlJWP9xjzqrT4AI-PCOW-d6AivBDaQ6AQkQC4k64Y2UOL4xMteFtDjEl4LI8PqhtCwhLW6R3G8KqGAE&id=lidar2&mcvt=1238&p=430,127,470,168&mtos=1238,1238,1238,1238,1238&tos=1238,0,0,0,0&v=20230724&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=932655064&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1690461472270&rpt=4181&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 99BA
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy=
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

281 B
554 B

5ms
4ms

Document
text/html

23.52.162.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-162-21.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 27 Jul 2023 12:37:58 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 27 Jul 2023 12:37:58 GMT
location: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
server: AkamaiGHost

GET
H2

200

user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame C6C8
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1690461477980.6&ri=25&ru=https%3A%2F%2Fads.pubmatic.com%2FAdServer%2Fjs%2Fuser_sync.html%3F%26p%3D156423%26us_privacy%3D%24%7BUS_PRIVACY%7D%26predire...
https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D

15 KB
6 KB

12ms
10ms

Document
text/html

184.50.204.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.50.204.192 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-50-204-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 94061a925c5d84bf776554ac894020c407a9a4c89b979d538de3cf45591fe423

Request headers

Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=34764
content-encoding: gzip
content-length: 5606
content-type: text/html
date: Thu, 27 Jul 2023 12:37:58 GMT
expires: Thu, 27 Jul 2023 22:17:22 GMT
last-modified: Tue, 11 Jul 2023 09:39:35 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-length: 0
date: Thu, 27 Jul 2023 12:37:58 GMT
expires: Thu, 01-Jan-70 00:00:01 GMT
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
pragma: no-cache
referrer-policy: unsafe-url
server: 33XP007
x-33x-status: 40000000008200000A

GET
H3

200

match
events-ssc.33across.com/ Frame 7289
Redirect Chain

https://x.bidswitch.net/sync?ssp=the33across&us_privacy=
https://ads.betweendigital.com/match?bidder_id=43092&gdpr=&consent=&callback_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D429%26user_id%3D%24%7BUSER_ID%7D%26ssp%3Dthe33across%26expires%3D30%...
https://ads.betweendigital.com/match?bidder_id=43092&gdpr=&consent=&callback_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D429%26user_id%3D%24%7BUSER_ID%7D%26ssp%3Dthe33across%26expires%3D30%...
https://x.bidswitch.net/sync?dsp_id=429&user_id=102a807c-1e7a-53d0-8682-988ae240fdac&ssp=the33across&expires=30&user_group=1&gdpr=&gdpr_consent=
https://ssc-cms.33across.com/ps/?xi=10&us_privacy=&xu=fa600ba6-dc58-41e7-a41a-832e682c030f
https://events-ssc.33across.com/match?bidder_id=10&external_user_id=fa600ba6-dc58-41e7-a41a-832e682c030f&ts=1690461479&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
82 B

16ms
16ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=10&external_user_id=fa600ba6-dc58-41e7-a41a-832e682c030f&ts=1690461479&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H3
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-US,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:59 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
referrer-policy: unsafe-url
server: 33XP010
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=10&external_user_id=fa600ba6-dc58-41e7-a41a-832e682c030f&ts=1690461479&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame 7289
Redirect Chain

https://ups.analytics.yahoo.com/ups/58350/sync?redir=true
https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-8DF0q.VE2uGE_FvCjySeVyvNH_c7ohss~A
https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-8DF0q.VE2uGE_FvCjySeVyvNH_c7ohss%7EA&ts=1690461478&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
118 B

135ms
14ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-8DF0q.VE2uGE_FvCjySeVyvNH_c7ohss%7EA&ts=1690461478&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-US,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:59 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
referrer-policy: unsafe-url
server: 33XP019
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-8DF0q.VE2uGE_FvCjySeVyvNH_c7ohss%7EA&ts=1690461478&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame 7289
Redirect Chain

https://33across-match.dotomi.com/match/bounce/current?networkId=78390&version=1&us_privacy=
https://33across-match.dotomi.com/match/bounce/current?DotomiTest=43fbe93b6cec1a07&is_secure=true&networkId=78390&version=1&us_privacy=
https://ssc-cms.33across.com/ps?xi=64&xu=AAABtskZR808OANEk83MAAAAAAA&expiration=1690547878&is_secure=true&us_privacy=
https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAABtskZR808OANEk83MAAAAAAA&ts=1690461478&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
118 B

20ms
16ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAABtskZR808OANEk83MAAAAAAA&ts=1690461478&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-US,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:59 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
referrer-policy: unsafe-url
server: 33XP004
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAABtskZR808OANEk83MAAAAAAA&ts=1690461478&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame 7289
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fssc-cms.33across.com%2Fps%2F%3Fus_privacy%3D%26xi%3D33%26xu%3D%24UID
https://ssc-cms.33across.com/ps/?us_privacy=&xi=33&xu=1562212822517953672969
https://events-ssc.33across.com/match?bidder_id=33&external_user_id=1562212822517953672969&ts=1690461478&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
217 B

133ms
13ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=33&external_user_id=1562212822517953672969&ts=1690461478&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-US,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:59 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
referrer-policy: unsafe-url
server: 33XP018
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=33&external_user_id=1562212822517953672969&ts=1690461478&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4269 42 B
64 B 58ms
57ms Fetch
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsudVXpfH4DGUQ8fxv8X7QVBtPXx-yXYnsczqjbYjBjQSB6E50qLpU3w8XOzzHSt3sDfRhNDkOZmZWVTXjSBW4J8feKYzUytME2Te5VS-66P6CFiGw_2EiscciRmcUn1P8qhmXECjD7U0g&sai=AMfl-YRaLQXIq6nxLuu9l0md4v8TjNhrcMi1jfcNJrufBykrJvNJ_vFdA8dU-8YhpxyVoH8Cko8psXif8367bgowpAUeaTR3OkjzaEayEsk9wWe9FFN7fOyPhF9xYk0&sig=Cg0ArKJSzMMM0S3owszPEAE&cid=CAQSOwBpAlJWinGi40gHk6UwXTvZnXh8pP9D9RMD36MQ3shZoeXtaGcbMkiE1alqQZmKfgH84jjmMbC-jkLBGAE&id=lidar2&mcvt=1200&p=430,1551,470,1592&mtos=1200,1200,1200,1200,1200&tos=1200,0,0,0,0&v=20230724&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2393718110&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1690461472432&rpt=4325&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6763 42 B
64 B 49ms
48ms Fetch
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuOEMxRyYODYieLvsR_qPOLoSpJdjf97BgMuuCVRkjAICZUuVfG1wtmeIm03fWBUyGYcg9fRURLYcYcSRMOPGRwe2EczV5BZAO7V0ngByQDRDJABegAH2NUyRIZKHHVUPVOgiUI7Y7phA&sai=AMfl-YQ5EdCEY75_kPM0I0fyWTfNs5D_heRkp14iwtJBHWQDFd74PinWN55jw1sA2dNdVIhLGV9-naaFd0PX6Tzno3CPucG5nlG03yVHaxYf6JdFy1KRvusg6Z6vido&sig=Cg0ArKJSzOVMJmKv6J9ZEAE&cid=CAQSOwBpAlJW3dQ-QMz5GQqh2jjA9erD_ziRWv62M_GM0UVkWJjQaq85AphEjGrEO_OirnSv6qyeA14NZ9rBGAE&id=lidar2&mcvt=1202&p=0,436,90,1164&mtos=1202,1202,1202,1202,1202&tos=1202,0,0,0,0&v=20230724&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2678087454&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1690461472593&rpt=4702&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js Show response
pagead2.googlesyndication.com/bg/ Frame E487 37 KB
14 KB 15ms
12ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4f9e4b1838819f2fdbc6eea07e712886701f71a49ff22a445a9be3d5c7d806

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:38:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57580
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14628
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jul 2024 20:38:18 GMT

POST
H2 200 doq.htm Show response
rt3044.infolinks.com/action/ 1 KB
1 KB 204ms
163ms XHR
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3044.infolinks.com/action/doq.htm?pcode=utf-8&r=16904614784891
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1870.002-3.027.ab.1874.021-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8593f2c69601ababf5f8e5b7d38b400fabf34479a692f055a350a38549c72e9

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:58 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: text/html;charset=UTF-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
p3p: CP="NON DSP NID OUR COR"
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-language: en-US
cf-ray: 7ed4efd1bcae4237-EWR
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js Show response
pagead2.googlesyndication.com/bg/ Frame A637 37 KB
14 KB 15ms
15ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4f9e4b1838819f2fdbc6eea07e712886701f71a49ff22a445a9be3d5c7d806

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:38:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57580
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14628
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jul 2024 20:38:18 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame D8C1 0
0 45ms
43ms Fetch
image/gif 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsubISz8OPTbrHPKutHPPMpITqLQWn8ePc3dc4ma7y4M_B_0xsaDr_8krr4zkEDiBEo4f1036HVNHX_LWpcQhKO5Wfzta6Fqo0GRP1nn45AsPgaeeSYo8Itv65aunUA-NvWwirsL4GfBPG5IAdEkqJxvtuINIXrHSCwa0rkeLjkWcCNyLfKGHHu-_rvqQWmNQONtCX4yH3vlHIsEG-D0xNXCF4CzZh2O5vYaANJuBtGhhyPFRAx73SYALaXZV4QBCnEWcQbpnhqvg8-OYbqaO6DjC06ZEVmwGGHexif577TXyWxoPG83SDekgXYsVBJKnKrNMdF3cT8tJ8MTP-W9hlxyJKgmKNwx898NIde6XCuI5d3HZ88qKcMKbTzOT3cTD-v4gnpmT89uku0jD9OhX5D_k2rdKAqF2euinI3_ZLwTy6CFMCxChBhIr6kxc-2v3DOO9sfShg6X0QvMS8N3BbOg3i2xIm8aS6-t7PKSSS4WoS-a7niyr-fpuWsIibM1mN1t1TUzpEu5Gxl1wQIKRkVezUIjpCVId8qacIsG33r1W5R5qZRGEy3kOpwdmucQ4UpbolxHMDGHejKB8-0kg9EwDJ8FtDvpIsRhburJr9wziHR0P1wmSa3qXXya4ldm2XVOREF34YaPjj9xu75iHovRBzg_DcjA8ftqBzdXazxHFC_DfOFgYiZs7WDBpXRlZZDb8iR9HaqDq9jFmwfv4wZVXO9surMMf52sRGek6wrhHqEdhZ_V3tnBKPQ28XcXx920VojJ3XwFNsZAJehk6L0-Cy3dwALhRdkOyEqtm8Z9_H10_2_v_B36Dys5Bx2j_jxnuW5cWAUChh6GY6BrDeCub92D8ILqBIGb4VxyxQlSkuDYRSooAUpmPS93A4klqjPszQZguTmxbiucbkD2qQWTgUkJ0qXB6NYMoawfGGon3VH0NQvRWppRAROQ6oTUaUSwEj1KdELfkhC8UojvzVjjGL9FK6nz_qmQ5ozG8tHEu3LhuQ5uAS7vL7e7yBkiDD1WDB-Sl-6XMKfh8hqwddWno3yNvpG4IrOG71OxnhY2ObZ1GMDldebI8PluQegapY9WqZuQ5jreXBZW1tbENbIuZlpc_cMPbkj6gNZ4ycrPOs92LAA3kldMmNDf-G9w2EWSv0GpLKuVFo2JigIiRCf_tIe4dJRAEdsXwfz1xZlyaYLgwGpSswR12mO6XujJBan1m1WnlnPP8vBsSSLXHnP7JIkiyA7nmDOecJYN9yOC0Pp17GJkih-qZq5So-pEE4W_HrDzyDzktQ5JuvVDwsWxe7WHQQ&sai=AMfl-YShww8JQb1kwHDObjutDIMnZTqufu9anQ43rbVtNQkiLP0FMCfAu6WeecTcH0a14w9xyyYC-lxFPz41YGYejbRS3BAd4tYjv2CZow1Z7vpQiGEdJZtiZ6rfdS00Z87REfyeP7Zwjq0twagVO86Py5b3f1zTDHQPq6nnuhE--mLL7-prNmKrun5MBlmYEqUF31LT4jgYKs8Is0XnuzBA-HfM6X1f7E6n9rAVWbIls6_0e3sXr4kImb40A1RhpMg2eXD6&sig=Cg0ArKJSzKXX9gB0MqUfEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2736&vt=11&dtpt=1802&dett=3&cstd=925&cisv=r20230725.81447&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:58 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 27 Jul 2023 12:37:58 GMT

GET
H3 200 XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js Show response
pagead2.googlesyndication.com/bg/ Frame 8E21 37 KB
14 KB 18ms
13ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4f9e4b1838819f2fdbc6eea07e712886701f71a49ff22a445a9be3d5c7d806

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:38:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57580
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14628
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jul 2024 20:38:18 GMT

GET
H3 200 XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js Show response
pagead2.googlesyndication.com/bg/ Frame 56D6 37 KB
14 KB 18ms
14ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4f9e4b1838819f2fdbc6eea07e712886701f71a49ff22a445a9be3d5c7d806

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:38:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57580
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14628
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jul 2024 20:38:18 GMT

GET
H3 200 metrichpe_501_normal.ttf
s0.2mdn.net/sadbundle/15571588451724435493/fonts/ Frame 03E9 59 KB
24 KB 6ms
5ms Font
font/ttf 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/fonts/metrichpe_501_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3865c0dbe6b11b3a32b8c600acaeda70bae7b1f8287d566bcc0613c217907f2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 22 Jul 2023 06:46:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 453080
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24241
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Jul 2024 06:46:38 GMT

GET
H3 200 b31695c16034d998f4926d5d76e8c376.jpg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 03E9 3 KB
3 KB 7ms
6ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/b31695c16034d998f4926d5d76e8c376.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad7b8c6680d668079fa0c0ebeb069e4cd85ce516f53eee5717978dad20819228

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 04:03:22 GMT
x-content-type-options: nosniff
age: 30876
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3151
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jul 2024 04:03:22 GMT

GET
H3 200 395d370bde56edb1a7a13cb7c151fd9f.svg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 03E9 4 KB
2 KB 8ms
7ms Image
image/svg+xml 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/395d370bde56edb1a7a13cb7c151fd9f.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae9ec49acaff45c6a341e9a552d546bd6fea845331c314261be35a40c37ddc7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 24 Jul 2023 09:16:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 271270
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1630
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 23 Jul 2024 09:16:48 GMT

GET
H3 200 XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js Show response
pagead2.googlesyndication.com/bg/ Frame FA50 37 KB
14 KB 12ms
12ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4f9e4b1838819f2fdbc6eea07e712886701f71a49ff22a445a9be3d5c7d806

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:38:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57580
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14628
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jul 2024 20:38:18 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 99BA 34 KB
10 KB 5ms
5ms Script
text/html 23.52.162.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-162-21.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 5dd0435e368c584ecbb528386140f8c4231178419b214c661c6e86398041749d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Thu, 27 Jul 2023 12:37:58 GMT
Content-Encoding: gzip
Last-Modified: Thu, 27 Jul 2023 07:29:37 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=67909
Connection: keep-alive
Content-Length: 10114
Expires: Fri, 28 Jul 2023 07:29:47 GMT

GET
H3 200 XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js Show response
pagead2.googlesyndication.com/bg/ Frame BB0F 37 KB
14 KB 27ms
27ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4f9e4b1838819f2fdbc6eea07e712886701f71a49ff22a445a9be3d5c7d806

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:38:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57580
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14628
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jul 2024 20:38:18 GMT

GET
H3 200 AGSKWxXf0xo6RJOHOVpJoka871buwqwULpLzSNiKfl9AfUwI21uIt5J64TciBXnfO76CGz-WyQvIVMUCYNAvwhbKIDR9_JM9m1Pf_lJlC8aQbj8AcHkB2BJrMidz7tJClQdHku7OPBVjDg== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 71ms
67ms Script
application/javascript 2607:f8b0:4020:804::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXf0xo6RJOHOVpJoka871buwqwULpLzSNiKfl9AfUwI21uIt5J64TciBXnfO76CGz-WyQvIVMUCYNAvwhbKIDR9_JM9m1Pf_lJlC8aQbj8AcHkB2BJrMidz7tJClQdHku7OPBVjDg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjkwNDYxNDc4LDkyNDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMCw5XSxudWxsLDIsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9laGZtYy1jb20ubmdvbnRpbmgyNC5jb20vIixudWxsLFtbOCwiNFVia2c5YjJMYTgiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTgsIltbWzBdXV0iXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

65e2981023e75a864e2c38830c65f1140fdb1571dc0c264c0ddc530f22853b49

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-tSpql_10uQp4zZtpr629tg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:58 GMT
content-security-policy: script-src 'report-sample' 'nonce-tSpql_10uQp4zZtpr629tg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 iquid.js Show response
resources.infolinks.com/static/ 54 KB
13 KB 24ms
19ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/iquid.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.25.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4c35a725ae1976af59c99556ad69e993dd9cf474033a75bb9406d59819d573d4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 20 Mar 2023 11:30:07 GMT
server: cloudflare
age: 1327
etag: W/"d8c3-5f7533fc75a6e"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 7ed4efd358334388-EWR
expires: Sat, 26 Aug 2023 12:15:51 GMT

GET
H2 200 ima.js Show response
cdn-ima.33across.com/ 24 KB
8 KB 12ms
7ms Script
application/javascript 104.18.24.112
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ima.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.25.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.112 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 037ffb8136ae53ead51233fecf1325956412036eb55e73a71ddc4450f27f2547

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:58 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 20 Jul 2023 17:46:18 GMT
server: cloudflare
age: 65367
etag: W/"64b972ea-60bb"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86400
cf-ray: 7ed4efd35c3218f6-EWR
expires: Fri, 28 Jul 2023 12:37:58 GMT

GET
H2 200 id5.js Show response
resources.infolinks.com/static/ 58 KB
17 KB 25ms
21ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/id5.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.25.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05e77dab19940dd457e00282837faecc886434cc8cc5f631575a5e6c386de774

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:58 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sun, 26 Mar 2023 15:25:02 GMT
server: cloudflare
age: 13340
etag: W/"e65f-5f7cf3aed6f0f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 7ed4efd358354388-EWR
expires: Sat, 26 Aug 2023 08:55:38 GMT

GET
H2 200 container-2.0.html Show response
resources.infolinks.com/static/ Frame B15F 925 B
561 B 23ms
18ms Document
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/container-2.0.html
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1870.002-3.027.ab.1874.021-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a37336acc4462da1425a726d686a4d82b027c1d4d996bfe1776c630162ac4a71

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 3274
cache-control: max-age=2592000
cf-cache-status: HIT
cf-ray: 7ed4efd3d8b44388-EWR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 27 Jul 2023 12:37:59 GMT
expires: Sat, 26 Aug 2023 11:43:25 GMT
last-modified: Wed, 03 May 2023 17:45:02 GMT
server: cloudflare
vary: Accept-Encoding
via: 1.1 google

GET
H3 200 metrichpe_501_normal.ttf
s0.2mdn.net/sadbundle/5357816647124024566/fonts/ Frame 2069 59 KB
24 KB 5ms
4ms Font
font/ttf 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/fonts/metrichpe_501_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5357816647124024566/d5172966dc6f96ad0462b6e137d21b0e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3865c0dbe6b11b3a32b8c600acaeda70bae7b1f8287d566bcc0613c217907f2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 04:55:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 546124
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24241
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 20 Jul 2024 04:55:54 GMT

GET
H3 200 8e493e4428fc103db3191da83a8775d0.jpg
s0.2mdn.net/sadbundle/5357816647124024566/media/ Frame 2069 14 KB
14 KB 6ms
5ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/media/8e493e4428fc103db3191da83a8775d0.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

608b4742e840e98757ce147a69e9c51bce390ecb572dfb7a1ec231748e05acdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 04:29:45 GMT
x-content-type-options: nosniff
age: 115693
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14143
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Jul 2024 04:29:45 GMT

GET
H3 200 395d370bde56edb1a7a13cb7c151fd9f.svg
s0.2mdn.net/sadbundle/5357816647124024566/media/ Frame 2069 4 KB
2 KB 6ms
6ms Image
image/svg+xml 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/media/395d370bde56edb1a7a13cb7c151fd9f.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae9ec49acaff45c6a341e9a552d546bd6fea845331c314261be35a40c37ddc7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 10:15:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 94968
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1630
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Jul 2024 10:15:10 GMT

GET
H3 200 metrichpe_501_normal.ttf
s0.2mdn.net/sadbundle/15571588451724435493/fonts/ Frame 71B3 59 KB
24 KB 5ms
5ms Font
font/ttf 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/fonts/metrichpe_501_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3865c0dbe6b11b3a32b8c600acaeda70bae7b1f8287d566bcc0613c217907f2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 22 Jul 2023 06:46:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 453080
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24241
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Jul 2024 06:46:38 GMT

GET
H3 200 b31695c16034d998f4926d5d76e8c376.jpg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 71B3 3 KB
3 KB 11ms
10ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/b31695c16034d998f4926d5d76e8c376.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad7b8c6680d668079fa0c0ebeb069e4cd85ce516f53eee5717978dad20819228

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 04:03:22 GMT
x-content-type-options: nosniff
age: 30876
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3151
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jul 2024 04:03:22 GMT

GET
H3 200 395d370bde56edb1a7a13cb7c151fd9f.svg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 71B3 4 KB
2 KB 12ms
11ms Image
image/svg+xml 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/395d370bde56edb1a7a13cb7c151fd9f.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae9ec49acaff45c6a341e9a552d546bd6fea845331c314261be35a40c37ddc7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 24 Jul 2023 09:16:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 271270
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1630
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 23 Jul 2024 09:16:48 GMT

GET
H3 200 metrichpe_401_normal.ttf
s0.2mdn.net/sadbundle/15571588451724435493/fonts/ Frame 03E9 60 KB
26 KB 8ms
8ms Font
font/ttf 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/fonts/metrichpe_401_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

671fca35d060e3ce06bbe0848b80e47be23f3322befbeb57bbce5d46994c846b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 22 Jul 2023 15:20:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 422239
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26072
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Jul 2024 15:20:40 GMT

GET
H3 200 metrichpe_601_normal.ttf
s0.2mdn.net/sadbundle/15571588451724435493/fonts/ Frame 03E9 61 KB
26 KB 9ms
8ms Font
font/ttf 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/fonts/metrichpe_601_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

39c7c602e0d57a569539f7e8e0b2d75a9f5aa9bb38d59782d2011d9e35c07d77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 22 Jul 2023 15:20:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 422239
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26501
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Jul 2024 15:20:40 GMT

GET
H3 200 b31695c16034d998f4926d5d76e8c376.jpg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 03E9 3 KB
3 KB 12ms
11ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/b31695c16034d998f4926d5d76e8c376.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad7b8c6680d668079fa0c0ebeb069e4cd85ce516f53eee5717978dad20819228

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 04:03:22 GMT
x-content-type-options: nosniff
age: 30877
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3151
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jul 2024 04:03:22 GMT

GET
H3 200 0391cb9c0ee8d59aaa5843797f816a93.jpg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 03E9 17 KB
17 KB 7ms
5ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/0391cb9c0ee8d59aaa5843797f816a93.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

27c835092c21e796e6c2c6796e5ab31a00d145db2c945a0041ff64784478117e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 04:10:06 GMT
x-content-type-options: nosniff
age: 116873
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17568
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Jul 2024 04:10:06 GMT

GET
H3 200 bf92c8be83eeb2dbf186eb1436ebcb5e.svg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 03E9 4 KB
2 KB 8ms
5ms Image
image/svg+xml 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/bf92c8be83eeb2dbf186eb1436ebcb5e.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6648009549b81e81582f3fb8345dd6305ee4a232fd4eac4fd803a78cb69b0c1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 04:10:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 116873
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1630
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Jul 2024 04:10:06 GMT

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/10215220780491718443/35978-4_PG_BRD_HADA_300x600_PR_LM_4_04-2023/ Frame A82D 19 KB
19 KB 7ms
4ms Image
image/png 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10215220780491718443/35978-4_PG_BRD_HADA_300x600_PR_LM_4_04-2023/cta.png

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d664d7992a5f3a0b55bd22a74d6542719b19add68a448c6e74acd3b09d48a54c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10215220780491718443/35978-4_PG_BRD_HADA_300x600_PR_LM_4_04-2023/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:03:34 GMT
x-content-type-options: nosniff
age: 59665
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19614
x-xss-protection: 0
last-modified: Mon, 24 Apr 2023 19:14:20 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Jul 2024 20:03:34 GMT

GET
H3 200 copy1.png
s0.2mdn.net/sadbundle/10215220780491718443/35978-4_PG_BRD_HADA_300x600_PR_LM_4_04-2023/ Frame A82D 44 KB
44 KB 10ms
8ms Image
image/png 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10215220780491718443/35978-4_PG_BRD_HADA_300x600_PR_LM_4_04-2023/copy1.png

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dc241511127e6ed399159ed1cefd789f7ec983fcd16eaae2c2194fe50863d231

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10215220780491718443/35978-4_PG_BRD_HADA_300x600_PR_LM_4_04-2023/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 16:45:26 GMT
x-content-type-options: nosniff
age: 71553
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45066
x-xss-protection: 0
last-modified: Mon, 24 Apr 2023 19:14:20 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Jul 2024 16:45:26 GMT

GET
H3 200 bg1.jpg
s0.2mdn.net/sadbundle/10215220780491718443/35978-4_PG_BRD_HADA_300x600_PR_LM_4_04-2023/ Frame A82D 116 KB
116 KB 9ms
7ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10215220780491718443/35978-4_PG_BRD_HADA_300x600_PR_LM_4_04-2023/bg1.jpg

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

57a2c308d05b6b644c02f38464c8770dcbe6b880b70eb770b8ecc2c032da1f06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10215220780491718443/35978-4_PG_BRD_HADA_300x600_PR_LM_4_04-2023/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 23 Jul 2023 04:18:25 GMT
x-content-type-options: nosniff
age: 375574
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 118323
x-xss-protection: 0
last-modified: Mon, 24 Apr 2023 19:14:20 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 22 Jul 2024 04:18:25 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame EAD7 0
17 B 382ms
381ms Ping
image/gif 2404:6800:4009:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~lkl546og&c=201128486213&slotId=100564243106.5&qqid=CP7litrzroADFYUQoQodsnIFnw&umsem=0&ple=1&ape=1&met.4=vfl.lkl548lt~vil.lkl548ob
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/72f96481e1fa2f83db121c0d28854a9d.js?tag=gpa/dynamic_fig_web_banner_v2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4009:800::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:59 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ctrack
track1.avplayer.com/ 0
98 B 9ms
9ms Image
text/plain 35.169.83.220
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.avplayer.com/ctrack?pt=2&d66=8.2.12&stagid=&stplid=&pid=632d59d7b9689f25ad20b012&cid=633172fb22e9a25a4645a127&r=ehfmc-com.ngontinh24.com&sn=&cd1=&cd2=&cd3=&app=&test=&cb=1690461479218&e=ctpl&cvid=&cpid=&str=autostart&vi=100&wi=300&he=250&cppt=10.154575
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.83.220 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-83-220.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:59 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 in_place.js Show response
resources.infolinks.com/js/1870.002-3.027.ab.1874.021-3.027/ 35 KB
6 KB 30ms
29ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1870.002-3.027.ab.1874.021-3.027/in_place.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1870.002-3.027.ab.1874.021-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a4e4f0e42c90c819753b66ae2349db799f2b8b73969bf87f517812290e5c734e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:59 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 19 Jul 2023 11:07:11 GMT
server: cloudflare
age: 4170
etag: W/"8c6b-600d5088822b2"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 7ed4efd5ea784388-EWR
expires: Sat, 26 Aug 2023 11:28:29 GMT

GET
H3 200 metrichpe_401_normal.ttf
s0.2mdn.net/sadbundle/5357816647124024566/fonts/ Frame 2069 60 KB
25 KB 25ms
24ms Font
font/ttf 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/fonts/metrichpe_401_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5357816647124024566/d5172966dc6f96ad0462b6e137d21b0e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

671fca35d060e3ce06bbe0848b80e47be23f3322befbeb57bbce5d46994c846b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 10:23:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 526493
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26072
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 20 Jul 2024 10:23:06 GMT

GET
H3 200 metrichpe_601_normal.ttf
s0.2mdn.net/sadbundle/5357816647124024566/fonts/ Frame 2069 61 KB
26 KB 39ms
38ms Font
font/ttf 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/fonts/metrichpe_601_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5357816647124024566/d5172966dc6f96ad0462b6e137d21b0e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

39c7c602e0d57a569539f7e8e0b2d75a9f5aa9bb38d59782d2011d9e35c07d77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 22 Jul 2023 15:00:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 423470
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26501
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Jul 2024 15:00:09 GMT

GET
H3 200 3da15c1a1519d4142b61be4acb2551ca.jpg
s0.2mdn.net/sadbundle/5357816647124024566/media/ Frame 2069 20 KB
20 KB 39ms
6ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/media/3da15c1a1519d4142b61be4acb2551ca.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

59b122193996b704d97e25c4b10369a2c0e7c514dbef92ad01fafc8412f483dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 10:00:50 GMT
x-content-type-options: nosniff
age: 9429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20743
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jul 2024 10:00:50 GMT

GET
H3 200 bf92c8be83eeb2dbf186eb1436ebcb5e.svg
s0.2mdn.net/sadbundle/5357816647124024566/media/ Frame 2069 4 KB
2 KB 38ms
5ms Image
image/svg+xml 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/media/bf92c8be83eeb2dbf186eb1436ebcb5e.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6648009549b81e81582f3fb8345dd6305ee4a232fd4eac4fd803a78cb69b0c1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 13:33:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 169444
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1630
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 24 Jul 2024 13:33:55 GMT

GET
H3 200 0391cb9c0ee8d59aaa5843797f816a93.jpg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 71B3 17 KB
17 KB 6ms
4ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/0391cb9c0ee8d59aaa5843797f816a93.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

27c835092c21e796e6c2c6796e5ab31a00d145db2c945a0041ff64784478117e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 04:10:06 GMT
x-content-type-options: nosniff
age: 116873
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17568
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Jul 2024 04:10:06 GMT

GET
H3 200 bf92c8be83eeb2dbf186eb1436ebcb5e.svg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 71B3 4 KB
2 KB 6ms
4ms Image
image/svg+xml 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/bf92c8be83eeb2dbf186eb1436ebcb5e.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6648009549b81e81582f3fb8345dd6305ee4a232fd4eac4fd803a78cb69b0c1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 04:10:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 116873
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1630
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Jul 2024 04:10:06 GMT

GET
H3 200 metrichpe_401_normal.ttf
s0.2mdn.net/sadbundle/15571588451724435493/fonts/ Frame 71B3 60 KB
26 KB 7ms
5ms Font
font/ttf 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/fonts/metrichpe_401_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

671fca35d060e3ce06bbe0848b80e47be23f3322befbeb57bbce5d46994c846b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 22 Jul 2023 15:20:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 422239
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26072
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Jul 2024 15:20:40 GMT

GET
H3 200 metrichpe_601_normal.ttf
s0.2mdn.net/sadbundle/15571588451724435493/fonts/ Frame 71B3 61 KB
26 KB 8ms
6ms Font
font/ttf 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/fonts/metrichpe_601_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

39c7c602e0d57a569539f7e8e0b2d75a9f5aa9bb38d59782d2011d9e35c07d77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 22 Jul 2023 15:20:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 422239
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26501
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Jul 2024 15:20:40 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0ED6 0
0 45ms
44ms Fetch
image/gif 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvMTIkxnUxA8nMV69WlyQFZ9UNBymjUKkAdS5--6gTMd7C-S6pR-A7CGBl7l0WOk8_kNNGsVnwR4l1ix94NwPsTWnzCOVCdo9UZ4D5fNCZd7ttZUMSb_JHIZt0U-9otE1zUlHKgeTSatSsIsjqivBW72XEyV3krBSaltLFHKpxDpuKaxShaBPeiD_i1QVD7wQosQCBW6NDPNJ2S6HB5hdY-5Vek3GquWEN1Jm8D-ESCJd7GPzLYAzlEoEQhM9LeQ-dixfytzCKwY5gIBpayTw2fnD0yIJyaS60ybZNunkW-irUjkSlV3Kt9y9N-i9MpA-XeECsPOKGdzgMXC_EppJQnSEj0P3bjLPePLLGm08kdfCz6rWHkZaWGWG4P6xaqNWF_mlmGvx6wPpEDPEdFiy_CjTUwF4AR59edD6nTJ8xcSCnOJve2XugF8mIarmSLYkdyWjMdMCm3ATR5QpFkV0DSRDKzj_abu3PLB7SeTGUr6xgFR_hUq4LEQ2uW27bkqEh0EMC7VGTpDC2MSKw6eY3HstgCOMu43o1AqH_70K5YVWHBHBpHunOW7CqXqmnFblQTW5PubIIGvFOIz8_QTfS7MWFAc2iPoiUxfpPPtNSuQbl30mMLGhw1Ex94bJChGZ-LcuHrRMBSR44Yg7lQWUEhGD7WNYslZnr8q66gFz3WIbMN6zyeuF8gP8_PEOQghnb18Jogr43bHGDEIi_jrQ4-2vY0n5Py2hp4mJz-cRH-fVozTF32G2Bx_yltbXk1tWU5DU0OZWJEXzfHfmAsx-5VjIrMVuYPv1-myirhyDHCfPCqHq-P8FWNcSMjevj7v2WkYMFEcJlq5JLJTpC693fmBJx3U0_w4BNkCNvXSMlC0Gcw_p1yFz9bFiBAGmfa0VKmDiI8Obofo7egAZP97CLZDbtXYLsv3lAoT0smuvp6p-UUTbtj6Yvb81KsqrjPtOeeuPSMMuzZlVWS7su4TRKE50TcY2lfwpA_jHjO3oiNDHaOw845Egex7BF5DCsDXzbsgkrv5PEcbkpf4m7Ibyt92gAdvBSez751T136YnjXBPfUu5i6GVu6AiS-jRo8YzrbQ0uaIUYW11Xk20k96jOMvS-0EwAQ3JAaYlinpWX_C7yIGpjyJORupE4BUN9gLXGpuK6GP8psKmdIs6MWye0tJfhY7tMHmko6BstUhfohnWqN-F2D_-5Ca16x5xULTcUsaCpwNVnnwRxsXjhWdJojH5nRfOhq6_5PUFVRkPECwU1VshjrmcAnBgU-xyMJPCd_Se2Q0pnYI3GI8D2koSTHa8CfaQ4ZsbfPawKWpaakzQGKpnM&sai=AMfl-YRERAYDI92P-7YNnKwqewUpjjtvpQyZ5Zriy45YyFJ0AYJDIR_dJFtPAXjVPlzolddyiztmFUPix4ABSavhuTLQWSKfPc44WH7pUiKeWoAUgleLB09tlU_LLL8pZ1KmZlUE8Huty7NnDeRRPi3aSwjwUX3jHcDYfQFgYuWGEMDz3vXvCqi2-BrtK7L5kOd9QVfsGnggd5HftS86JMiuj7Y-V8CCgZ0knRCtzrAumFKPsDMJP173APJ_yiRYRzrcJA0F&sig=Cg0ArKJSzFu5YZFLNycIEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=3199&vt=11&dtpt=2365&dett=3&cstd=831&cisv=r20230725.15158&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:59 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 27 Jul 2023 12:37:59 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 1110 0
129 B 21ms
5ms Script
text/plain 162.248.18.34
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:59 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 1110 2 KB
3 KB 16ms
15ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=65699375&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: a4ea44143276844768ce8433327d7acb4af029dce335400efb2a94183b54cfea

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Thu, 27 Jul 2023 12:37:57 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2E8C 0
0 47ms
47ms Fetch
image/gif 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss8_JT9Kg2zpEkMh2hxvsuTsbaNLJ3PtEmE6R_c-B33ou_dNUzvKqmsDO6pNO2fxhIlTE-KAlJLZqdic6TfzT-GN4-_E4JD_hUfFhA6MeLRPsjIDI7vQPvNSybFmDgrgzQ-F2HbVSZWQPTYhTZlO2dClSHtgHiNdMIcu-e85ObuookNHpfLzOtj8Kaaq7E-QmDe-MxkFzkm_7uxgzmCcj4eXhHcizrduQza4bc8qJtMHxKSUKxXa7CJtu-NXSFtjw0VzPd0XB9T9B4Q5YmZv5wLBnlKP7sqljefG5zkPxyEvbUFD0XCknyqrmDq5L0Q3raPfvUOMTsGjKdE1sfpOXtkR96Cl9uFHhvG-HOZL3wv_WFKWkBM34mBEdVBtszhoriObVXfzNaQK4Ilc2LRaTl4R5asFe-PWZUtneYoAW8ZkyVWQ8DEOsnlzgt4iRya26gZCI6mOH-KAsgLWRoaillt6YftizpKlyhvCTxFCl4FVVsdN5j_MhSVyD9_NX5x_FzG-0pzZE47C3ZC1Gdwj-zXjyjrKMgM-EiFWVg9Kw1S7oqeWEK1yeUHqOrxxc5ozac6NQF6Rq3EeDMeh6DbC6yZ-hk5Q_bakWrCep-CF7jqKxT_3hf1sKlU0Jj-P2qL4ZG9q71edCnRbgKPQ_bluqfyybXVMr6tbNPB14YjGvbNXgu43nZt9Nv-D-GiTKeA8RV2aFYfxFGijawW5TVoxaXEew2Op-8KNB0UL7--r2UkfwFjHUyUjX2bGvSNeNZs815cMnB_zvdqGHYWlhqjwbr9PAPqGxqkMnh22wLM5o4QZ3Cr0Zk6h2nxX2nMUWCTc_LU4d7YIcZ5IRxkqF3nASieQMtLjT8RFfn9hoWW7idHVRvypMeq0WeET-QzxRPa_3N-tnu98z2WgcB9LCdl0URooKTVcUgy1s6onusnQQeExhrj8TKyBlwEIVCTaV7Yae7zWDS2nHpiHR-tY3JcnijSLXFDY4KFmK3WgTZTYmlvaDmUuv7NmGRfu5FcTRSrjvlNXNpHuABqzIYsxoprJJ01jJBhg38EVLfHoUW6FGW7qf7mVAXBCdPw8WukndBu7jLTLe-5rAUEh_VHFcaHfiaxtitFf-UMv_jdRs-hHvU-X7S828cVjhUXOI9q3r-YZORMSFTJ-m8xvd-s1v70RuYsQfGfmmal3hKlQGNZNeRoLv7gWMFgtEhBSjwk3yAitG1EC2TshvZraVcB66urZtJ84Lzqx_gVhznrJddl0R_i-iuqql17wotDUbpHCMuJfMCJABxLzzR2mrXJz5DwJUX_MGww7OrhTfd-HUlEDXvMW5wYFg&sai=AMfl-YQDvjL0n32pvHYhtAY_2FQ3jJwZbDoq5NHDIQ4eFWSchiduW-0VbxoJ3kZfl84KnNk0oREz7IvzgCSqdlSGPD88Hrk_0ILzHoNXqZSlC3ZWn8yjuZRtKoyWC52TboKpXxmqrGfcDi0cpXa5BzhmJB9lJ5Pe-Hhlf74G3vVdSCXO71c_LOCfJrtEVqDvI7eo1xaL6qU0MO9n6d19gIrbkXPVK3C0q_Vbg86UwIeDCgzAxzoILm5WSb-mB9t2bGknmf86&sig=Cg0ArKJSzDvN38UMRMU5EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=3640&vt=11&dtpt=2330&dett=3&cstd=1307&cisv=r20230725.38354&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:59 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 27 Jul 2023 12:37:59 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4269 0
0 46ms
46ms Fetch
image/gif 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstLZTOgKU94c_i3-2ak0XPa6eiB5jyKAP_MHziCCQg_pyE-g0x7MLSwkUq8yfhyF7ZThv3cecnOYGiRzudog_B0cprrqBjg-EAAMll0yu6LG3EOtLsv3QHqelkpEZignnpA5wJ76QOmLw4plzKk6gm2H5WKN7CKqh-gtX002oEH_2iEMkEm4gFnKiGl-2fJQavTGxujiFpSimwJdiZM3f9t-3eic2yqGJ0NciG0TkQ5JTTsm8pvMiHROceuG_1nUibFQdPH5wTAc4q1YjkQe2sQUQ_9Hv0vsOTR3mn6vqf9HlLq-WzQ2k8k4H_whv-4n_rk0885PiLIhmRoL1Nad8CI2chREXzw1dVdP4OWuPVxBjbNjpDzEkHyfXaFtztHDzIrGaFMKbBDMIyXnYbcgLOVaVhlgxzeDhgPbEDjYUXcr9oS-9eZq2pRJ5LC3wTosjuf6Owz1XkADZ2BgN5cu54ahlt95tzB55z1o29JJTuNcsOQqwiP2ftB9nYG0Gf-bjVCWJxHm7HEgXdwEtPLkGZYIs_V7BRGRLGvespNlQMyVvq7KIfXz6SRBYR0sXZeZchpxkgDDgMELb90Zq6DgvIaYKOAZXxNU2_PChg2OMMsadWNx6QGPL7zRiXC1lP_dwXoUk9c7uIcXv5FjvmC18sxxsVQcV1D5sG9d93NLaKySMxIEADSqkHTmmtUs2Kh0ulCsA9Jwx1pSCHiSe38xUvWsPeOBvka9MLMG6hphVCakQ_KDQ_FIr5PfNTWf_bL4ZN6YltpH84kIkneyg-TeKHSU5B2JIlrI7NiACHQzUbCBKD9LEgFcJEb7hEwjsyd2G37-mlt3r_ErHfOL1_mgtiq9I9YltuA-3NoTqIq-2qX8Nl0I0PJ83JzRsIf1smy2dAexQiW4YhMeAVDNZYRzHdcmyKDrOtZSZFVeWaFPFeZ2bOVL4ZA0hOnG0Do_GPx6PWHKGNCnRdZiHa6l554SrRyYJZu3ruiSnya3pb-IwgY7i1PP4MhkJ4mRwSs67TUcSiuxss2H3b9y_ICv0Tb3TKMgsMNgu0Ma8EmmIzPpnNcE6u0PZUxuxkYhu00v6o192WQo7fiIM9GYswvPe4IQ99ciT3IiPkKoI7pdjOAd9JCSDu_DrlkMfUGLOaWWtf4WenpvaeeS3Sz9alvQXS_wqs2YkbU6c6IOqqUhSdwUGZPF7TzVXPQuXmqrmuaO5xmAPkHdAhKb4qALUrxV1eJKMIS4lHyBr-TralEp5UwW6WZJDyM3H2Mg6CfbpOjFbxiwY1P7FqaXtnja4r7Ph7bc9fyT-lFYL2zYl8zr0CwiZ9h8NVqx1Q&sai=AMfl-YQoySqZLqzINn9Gb5RfPk63H4X5E9A2s1Kc7gBx5sbA1IF6udQyASvoFVNL-PLi8390Hg8waF8xvZpOkQJLPX0lfDeDQQYzcfo65tHr8WYn73NjoyK7TNvFSVKEgAessH8yX9qlmR2clDtfBhNE-pi2vV9KW2Rds2HliBQOiu3892CTraDMpkzi2qu92jHc9SzdNVgx9HAwS83puk6HjAzBlOKlR0mVn7Tnjx1h3i01ji_5IhjJOPStWw7AjneRUxPb&sig=Cg0ArKJSzFcyqhSW-___EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=3557&vt=11&dtpt=2322&dett=3&cstd=1231&cisv=r20230725.91354&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f18.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:37:59 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 27 Jul 2023 12:37:59 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 9948 0
17 B 386ms
386ms Ping
image/gif 2404:6800:4009:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~lkl547gm&c=5556173689242&slotId=2778086844621&qqid=CN-07dzzroADFUijnwod2IEIKg&umsem=0&ape=1&ple=0&met.4=vil.lkl548ue
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/5529604523bf1021996c9e114ecf8778.js?tag=video_location/web_och
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4009:800::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:59 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxWQdKkFlDOKgAHt2_P5vOuqY1biWnUwVQNomB-0033QKihQ5oiicu_pOt9pRqaw6rQEWtsg8fq3bA8-Eua9s0sB5qhtiMpEU-2htMT5q228QnY2HsedUstH6_fFeBCW7mDLBYFTjQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 48ms
47ms XHR
text/html 2607:f8b0:4020:804::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWQdKkFlDOKgAHt2_P5vOuqY1biWnUwVQNomB-0033QKihQ5oiicu_pOt9pRqaw6rQEWtsg8fq3bA8-Eua9s0sB5qhtiMpEU-2htMT5q228QnY2HsedUstH6_fFeBCW7mDLBYFTjQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-jakCAxGxsRhDJGt6YmEEiw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:59 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-jakCAxGxsRhDJGt6YmEEiw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxXPvVBITFiWmvTp1eJ5ySWvkr9Hftlz7gEmLP4E6mbflN-OBCZN_yNe7M86d7vHU7pyU1LN9RgtMKjWC0ZlFnY= Show response
fundingchoicesmessages.google.com/el/ 0
28 B 47ms
46ms XHR
text/html 2607:f8b0:4020:804::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXPvVBITFiWmvTp1eJ5ySWvkr9Hftlz7gEmLP4E6mbflN-OBCZN_yNe7M86d7vHU7pyU1LN9RgtMKjWC0ZlFnY=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-z_33MR3UL86rssiT8kM0EQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 27 Jul 2023 12:37:59 GMT
content-security-policy: script-src 'report-sample' 'nonce-z_33MR3UL86rssiT8kM0EQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

amd-us
router.infolinks.com/dyn/ Frame B15F
Redirect Chain

https://tracker.exchange.amitydigital.io/sync?id=11&uid=4472bf44-7dce-43d7-b3d2-92c989ceb0d9
https://router.infolinks.com/dyn/amd-us?user_id=45c354a8-083b-6556-772e-945e6349b61f

35 B
294 B

40ms
39ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/amd-us?user_id=45c354a8-083b-6556-772e-945e6349b61f
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://resources.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:00 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7ed4efdadde54388-EWR
content-length: 35
expires: Wed, 27 Jul 2022 12:38:00 GMT

Redirect headers

date: Thu, 27 Jul 2023 12:37:59 GMT
server: nginx/1.20.1
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: text/plain; charset=utf-8
location: https://router.infolinks.com/dyn/amd-us?user_id=45c354a8-083b-6556-772e-945e6349b61f
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
content-length: 100

GET
H2

200

ta-usync
router.infolinks.com/dyn/ Frame B15F
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_device_id=4472bf44-7dce-43d7-b3d2-92c989ceb0d9=&partner_id=3337&partner_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fta-usync%3Fuid%3D%24%7BTA_DE...
https://dpm.demdex.net/ibs:dpid=540&dpuuid=7f4728db-c546-4885-91eb-59bdc0ffdd33&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DADB%26partner_device_id%3D%24%7BDD_UUID%7D...
https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=48289118704695552241148134663272448035&pt=7f4728db-c546-4885-91eb-59bdc0ffdd33%2Chttps%253A%252F%252Frouter.infolinks.com%...
https://router.infolinks.com/dyn/ta-usync?uid=7f4728db-c546-4885-91eb-59bdc0ffdd33

35 B
199 B

43ms
34ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ta-usync?uid=7f4728db-c546-4885-91eb-59bdc0ffdd33
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://resources.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:00 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7ed4efdcdf964388-EWR
content-length: 35
expires: Wed, 27 Jul 2022 12:38:00 GMT

Redirect headers

date: Thu, 27 Jul 2023 12:38:00 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://router.infolinks.com/dyn/ta-usync?uid=7f4728db-c546-4885-91eb-59bdc0ffdd33
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D8C1 0
25 B 42ms
40ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=8828823692926&version=m202307240101&ct=76&x=1&cor=4446582534515229000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:59 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

match
events-ssc.33across.com/ Frame 99BA
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy=&khaos=LKL540WK-1B-DXU8
https://ssc-cms.33across.com/ps/?xi=1&xu=LKL540WK-1B-DXU8
https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LKL540WK-1B-DXU8&ts=1690461480&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
82 B

13ms
13ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LKL540WK-1B-DXU8&ts=1690461480&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:00 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:59 GMT
referrer-policy: unsafe-url
server: 33XP003
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LKL540WK-1B-DXU8&ts=1690461480&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6763 0
25 B 51ms
44ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=9086132100662&version=m202306200101&ct=76&x=1&cor=332138546669845250

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:37:59 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ProfilesEngineServlet Show response
api.intentiq.com/profiles_engine/ 79 B
820 B 26ms
24ms XHR
text/html 13.226.34.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=328512134&pt=17&dpn=1&jsver=5.36&iiqidtype=2&iiqpcid=9f1ce227-7a36-486b-a00e-09d1a9788223&iiqpciddate=1690461468187&iiqcallcount=0&iiqfailcount=0&iiqnodata=false&iiqlocalstorageenabled=true&tsrnd=92_1690461479995&fbp=95808134&cttl=43200000&rrtt=0&dud=0&abtg=A&iiqppcc=0
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/iquid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.34.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-34-62.ewr53.r.cloudfront.net
Software: Apache-Coyote/1.1 /
Resource Hash: 868b056e9eadc9038651fd701b9620bace688c42061fa03b63effe5d68cadcad

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:00 GMT
via: 1.1 2ef71b29bcfbfc8755cad5f92a3c329a.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C2
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
patent: https://www.almondnet.com/ip
alt-svc: h3=":443"; ma=86400
pragma: no-cache
server: Apache-Coyote/1.1
vary: Origin
access-control-allow-methods: POST, GET
content-type: text/html
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
access-control-max-age: 3600
access-control-allow-credentials: true
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Accept, X-Requested-With, remember-me
x-amz-cf-id: 417EzamFXIdX8Jb2vFSD1Dp9g3u-hG54KIEJn5I_FQyi3IRaiMOxXg==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 ProfilesEngineServlet
sync.intentiq.com/profiles_engine/ 43 B
975 B 23ms
21ms Image
image/gif 2600:9000:26fa:4800:1b:6b7d:2300:93a1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=548266&iiqidtype=2&iiqpcid=9f1ce227-7a36-486b-a00e-09d1a9788223&iiqpciddate=1690461468187&tsrnd=14_1690461479997&fbp=95808134&jsver=5.36&abtp=100&abtg=A
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26fa:4800:1b:6b7d:2300:93a1 , United States, ASN (),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:00 GMT
via: 1.1 a41c564554b07cc8611f5945b432513a.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: JFK52-P1
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: dToKt95uWZuQdXOG-FncBHVL4R9wl4UKD16xx7HpR-qEOg-kMKbnyA==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 42 B
249 B 235ms
39ms XHR
application/json 2600:1901:0:8344::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0015a0000344WLkAAM&src=ima&ver=1.0.0&us_privacy=1---
Requested by: Host: cdn-ima.33across.com
URL: https://cdn-ima.33across.com/ima.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:8344:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: 435b1ece4a55f4f8d06866b32c1aee3cc4661eb905265894795f15a57bf1b33d

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Thu, 27 Jul 2023 12:38:00 GMT
via: 1.1 google
vary: origin
content-type: application/json
access-control-allow-origin: https://ehfmc-com.ngontinh24.com
cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2 200 getads.htm Show response
rt3044.infolinks.com/action/ 3 KB
2 KB 1142ms
1141ms Script
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3044.infolinks.com/action/getads.htm?hks=%5B%7B%22lid%22%3A%22u_IL_INPLACE_mmt-4258afea-960f-419a-9cd3-d9b394374220_1_1_ad_728x90%22%2C%22bdc%22%3A1%2C%22prod_t%22%3A%22u%22%2C%22garc%22%3A0%2C%22as%22%3A%22728*90%22%2C%22sdata%22%3A%22logo%22%2C%22scs%22%3A%22cXIy0tnxyg%22%7D%5D&rid=cece8cb3-4b63-4322-819e-e0595816a52f&jsv=1870.002-3.027.ab.1874.021-3.027&sr=1600X1200&rts=1690461480156&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=115.0.5790.110&dv=p&ce=t&purl=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&tzo=-0000&c=c&strg=true&pitc=19~0s79zxbNO0H0swki_uOxdafKD28VqrTk&sua=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%7D&rsd=VulGt4aPTSytPXT6bfIP_Pxw-_GJznigFpj0uvo2SotyJalMVbLbtGWHvQ3FAnMk2jm5JFQeTcYsu4GlUxaFaFloWI3mXEdKId_Xl_TQmZmN37MNRq4-5lw7pJ-gvjT7rLJwImBenActF9DQr-XsQWKE7hchI5qLC4Qp9BpqGJw&rsk=44&rcs=2kZyEovFADmogrB1cMb1kQ&cuid=4472bf44-7dce-43d7-b3d2-92c989ceb0d9&_pubcid=8217a596-e105-4814-9f40-7d0549462d31&hbnr=false
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1870.002-3.027.ab.1874.021-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c43d35e1988c6b1c9b51172ae7c786d7bc591edd27d30b6d01f076bc4e60a2c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-language: en-US
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 7ed4efdb0e144388-EWR
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6F11 0
26 B 49ms
48ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B9pTNHWXCZM3rOfuooPwPzI6UwAgAAAAAOAHgBAI&bg=!eXqlei7NAAZGOVy5Zjk7ADkAdvg8WlOkZeRr4f-yA8eRamWppHYEztMPhR5Z0mFbZgmitIQ3yfPGeop2IGOrrKYf3nammVMeg6ACAAALdlIAAAALaAEHmQMDpklR9xybJYy4mJXqBOQzwrXQ3aLOu5XKqhu6QnXzaQ0stGLkSBqL_ygxs79PBW8lxJkWgOzhh-hauGh7LA-OFG2DQ7ZgfiFUrB3cRznNwnDWmS5-G7tGjApMRtWxwb3fI_85-SY81KqahPK45YOeW-7JS_alC62SUZf5Me8_AVQ-CNgzYA3DuzXQfbXZsohYd-PwVBsJAhfvxe6NNQHAx3MWRxnmN8-OV21PxyQ7n2lsC0in9xYbU054hQxF5-E8WzHAf8izcRIo93309b3kKqC_Hojo0D2yLNBdrR5vta3xDd5-tobAstuiNiHi1tVQVyXy2EgDu94-tIja9gWyMmKJ0ABuSLRSX7_Y43BTrq2t7SXibz70HH2rKZ_XwzXd09CTuq_aA4MKX-UG3gZTyNJeLLWII2AGGG4Fxr1TVZUZ4V_2quzui42rSujCyp45OdPjTedgDKR4oNDq4Xu5vG44iNwh_pM-mJ66Kp4GXBDW_37L4NyYFQ-1nMRsJmg0FYve92FEQkvl7rYR3V6uvRXNpCdffZFSRzLYx0Czck3wj7UCu__sRLLmKP0g1i9PO9lSVoMBTM7TNLw1kcTt_t3Kqzyhd0-ec-emDnvsMK2P2EY9uqscvTwNk-9mgyFeciqAsLcBavkuMMGFuCxXOfmxT-Ic_lQsC-D59iPwQI4_oPh2mvnfE6FxrWqquuNtmeSDhpK-y4S8JM26UVGj3SEIiyQXlC3XUR58A15A8Zc5ZjSGJ4xb5DvOvnRimftUi3txWOo6b4gQ3rN1eIsi3QGLf2vXKfGKNi3ZaYqXgffrrxABCl3MfNA3Vb_9U-UjUVk42O-wPbr1CBnFq5ovAEQxC7g8PLQXWPCwBognXcyU4IPd1V_B3n8Hu6m9Rw5vEDU0XMEpPLuxByvVmK1RwLkZa22vvqShE-CMkxRN37l62siBab0HS2x9SKFwK0don7_6cUj6FZlzrOV4nDcXddA4p5XzYvP5IgtHadu7uWbAhe2Oqkn6ELmmILBI0eOFjtjL

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 1EC2
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7437480408642019502&gdpr=0&gdpr_consent=

42 B
298 B

10ms
9ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7437480408642019502&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 12:37:59 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: d8506830-e655-4ce0-bdb4-af43f503fdd2
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 27 Jul 2023 12:38:00 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7437480408642019502&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.21.3
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
x-xss-protection: 0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 8A08
Redirect Chain

https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_85715b548d114da8bc4b5

42 B
280 B

5ms
4ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_85715b548d114da8bc4b5
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 12:37:59 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
content-type: image/gif
date: Thu, 27 Jul 2023 12:38:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_85715b548d114da8bc4b5
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: b

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 4C79
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=pVsbfKVaSn2-XE8vowtVKKBZHnu-W055o161mDLV

42 B
338 B

14ms
11ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=pVsbfKVaSn2-XE8vowtVKKBZHnu-W055o161mDLV
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 12:37:59 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
date: Thu, 27 Jul 2023 12:38:00 GMT
expires: Fri, 04 Aug 1978 12:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=pVsbfKVaSn2-XE8vowtVKKBZHnu-W055o161mDLV
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
pragma: no-cache
strict-transport-security: max-age=86400

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame F472
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=

42 B
95 B

16ms
15ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 09:11:04 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-cache
content-length: 0
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:37:59 GMT
expires: Thu, 27 Jul 2023 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 859491
strict-transport-security: max-age=31536000; preload;
x-errorlevel: 0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 43EC
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=6abd5532-2c7a-11ee-9042-8203411c076b

42 B
321 B

22ms
20ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=6abd5532-2c7a-11ee-9042-8203411c076b
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 09:10:51 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, proxy-revalidate
content-length: 0
content-type: image/gif
date: Thu, 27 Jul 2023 12:38:00 GMT
expires: Thu, 23 Sep 2004 17:42:04 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=6abd5532-2c7a-11ee-9042-8203411c076b
p3p: CP="NOI OTC OTP OUR NOR"
pragma: no-cache
server: Cowboy
x-realserver-nx: lga-delivery-3

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame B1DA
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=TsQVy5XhU41iMArRnN9PSgW16oY&gdpr=0&gdpr_consent=

42 B
299 B

32ms
9ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=TsQVy5XhU41iMArRnN9PSgW16oY&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 12:37:58 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 188
Content-Type: text/html; charset=utf-8
Date: Thu, 27 Jul 2023 12:38:00 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=TsQVy5XhU41iMArRnN9PSgW16oY&gdpr=0&gdpr_consent=

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 41D2
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:rDiXmOQ61Qp0fC5&gdpr=0&gdpr_consent=

42 B
221 B

18ms
16ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:rDiXmOQ61Qp0fC5&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 12:37:59 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Date: Thu, 27 Jul 2023 12:38:00 GMT
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:rDiXmOQ61Qp0fC5&gdpr=0&gdpr_consent=
Pragma: no-cache
Server: PingMatch/v2.0.30-784-g0c0b2cf#rel-ec2-master i-0378fef7ed0d1fc56@us-east-1d@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security: max-age=2592000; includeSubDomains

GET
H/1.1 200 usersync Show response
usersync.gumgum.com/ Frame 9270 35 B
250 B 20ms
17ms Document
image/gif 35.172.99.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=pbm&i=80101931-A35F-4E27-9F09-B0912A7ADA85
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.172.99.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-99-217.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 27 Jul 2023 12:38:00 GMT
Expires: 0
Pragma: no-cache

GET
H3 200 sd
us-u.openx.net/w/1.0/ Frame 1110 43 B
61 B 32ms
29ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=540245193&val=80101931-A35F-4E27-9F09-B0912A7ADA85&gdpr=0&gdpr_consent=
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:00 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK Martin
crb.kargo.com/api/v1/dsync/ Frame 1110 43 B
504 B 82ms
10ms Image
image/gif 34.233.62.209
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://crb.kargo.com/api/v1/dsync/Martin?exid=80101931-A35F-4E27-9F09-B0912A7ADA85&gdpr=0&gdpr_consent=
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.233.62.209 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-233-62-209.compute-1.amazonaws.com
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:38:00 GMT
X-Accel-Expires: 0
Vary: Origin
Content-Type: image/gif
Cache-Control: no-cache, no-store, must-revalidate, private, max-age=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 204 sync
sync.bfmio.com/ Frame 1110 0
425 B 65ms
9ms Image
text/plain 52.6.44.210
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=187&uid=80101931-A35F-4E27-9F09-B0912A7ADA85&gdpr=0&gdpr_consent=
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.6.44.210 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-6-44-210.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Connection: keep-alive
Date: Thu, 27 Jul 2023 12:38:00 GMT

GET
H/1.1 200 syncMe
synchroscript.deliveryengine.adswizz.com/ Frame 1110 0
397 B 398ms
89ms Image
text/plain 34.247.137.136
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=mrtnsvr.com&idType=cookie&partnerUserId=80101931-A35F-4E27-9F09-B0912A7ADA85&gdpr=0&gdpr_consent=
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.247.137.136 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-137-136.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Thu, 27 Jul 2023 12:38:00 GMT
X-Clacks-Overhead: GNU Terry Pratchett
X-Adswizz-request-id: 6c2f1040-2c7a-11ee-9430-020829da0811
Connection: keep-alive
Content-Length: 0
X-Application-Context: application:production
Instance-id: i-0239651de9a20f9e1

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 1110
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=2158e5d2-ac31-454d-af6e-d48bb416c5f4-64c26527-5553&gdpr=0&gdpr_consent=

42 B
342 B

6ms
5ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=2158e5d2-ac31-454d-af6e-d48bb416c5f4-64c26527-5553&gdpr=0&gdpr_consent=
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 12:38:00 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:00 GMT
server: A
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=2158e5d2-ac31-454d-af6e-d48bb416c5f4-64c26527-5553&gdpr=0&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame 1110
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33647_1067838A4_34878840&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
266 B

8ms
5ms

Image
image/gif

38.98.69.175
COGENT-174

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

HTTP/1.1

Server

38.98.69.175 New York, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-373466260; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Expires: -1
Pragma: no-cache
Date: Thu, 27 Jul 2023 12:37:59 GMT
Cache-Control: no-cache
Strict-Transport-Security: max-age=-373466260; includeSubDomains
Content-Length: 43
Content-Type: image/gif

Redirect headers

location: https://pmp.mxptint.net/sn.ashx?ak=1
date: Thu, 27 Jul 2023 12:37:59 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 1110
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=6606311347755805104

42 B
250 B

10ms
9ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=6606311347755805104
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 12:37:59 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=6606311347755805104
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 32B8 0
26 B 60ms
45ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BJATmHmXCZI_rIYqLNbDev9gNAAAAADgB4AQC&bg=!n5ylnMjNAAZGOVy5Zjk7ADkAdvg8WvnvVmfyFoGoSztyL7fB9dwzvB58Tdut0ti7BcD8f49fmzGEryvFSj-ioxkFOhF5yIYH75ECAAAK-FIAAABZaAEHmQL_N8W7aNtP0hSzWkZfBjs6Wuyj8u-otnAovUGrWfMZL6svaCL_4tSFly4S2VqBZYAq98gVoftPX-5YWixyuuS1kJ4KKdcQRSzulD5WYMTQQBG9W6YokPPG0RyzABUq5xsBx4JfAs0_XAJ2_qL7xiXoKGPV69ibmY7_iw6SvCobtXp3O-yLjjkMteHXx0GxGomnPhhXc0VVZAiAz3ug2SZLimXWfWjAo4WaD-_rbsvYHu1DGqUR--Gm0hzn5d8bUCsL6xiZC3EVlIbn6KGYKUk_DmZZlrtHq7EGo6kZWt8khSZYRdcwnekIgCD1jsNXpwtleEkOgz5-X1mvqCOmulOYv9aeQakNPrkn2vZIoUoBhIg0wrZn97VZQo4dQaqABYZ_mDGOnoSt3DIkjyPi0kW7LN7rOPk79Q7WyTE4zpro7N027E1447yxQeDDMStqkzIFxA4iusWBYaV2A-RK3Go2SaxsicpcumesxLFO7uH64bgjm5WIRlGOJ40cocmlfdH6FU2BaGyOo7ThgNn6bfRRCmb8yKXl8Q179wloVDXoFRhQgEORZUazT_AvHsAkT73b38J8ie_VpJFcn8vZ3kcKhegQqXBB7Ip0JWSriGpzFxndZrgxr55rW1DV_k2mN9d5BWiy8DY9psq3xoKmZkkBAtAVcB3HI4qiQ3NytwzINdRklIdixZsxejG_yhN364hy0Wq7ISxda6s-BKVw-PWRugerng52bFoSVQ2Qe97FplAIVsq6NMXJCKMvd3mNlGTMJZORcM2z9dPW9lSwtv9NaW-PfwpOI1DIsoF3mNDIvPcUh4NZ4-G5LORlaEyAmIm-opx97bmDQjtnfqU0L0r59HJYxZkMwuAVfx55HPw1xTULObNijjgtt3fLp_UBnZTblSB1cYRGVPiZb72jecarAQQ_GBJN-YXBAM-_947PafWMghOaYt_LaPwvYzl4_5x3uC96bg1ervwhze4IJyRpS33e5iPkmZiZckoJvi_K20hCTQTTO7KzA3TXYeskLXs

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0ED6 0
26 B 41ms
40ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=7704471699950&version=m202306200101&ct=76&x=1&cor=17570431935271586000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4269 0
26 B 42ms
42ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6705814035621&version=m202306200101&ct=76&x=1&cor=18089128470098514000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 6.gif
p4-gwyhc22pboc7c-4erul7yjt2qr7imo-634121-i1-v6exp3.v4.metric.gstatic.com/v6exp3/ Frame 7E0A 35 B
490 B 116ms
34ms Image
image/gif 172.217.13.210
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p4-gwyhc22pboc7c-4erul7yjt2qr7imo-634121-i1-v6exp3.v4.metric.gstatic.com/v6exp3/6.gif

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.210 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://p4-gwyhc22pboc7c-4erul7yjt2qr7imo-if-v6exp3-v4.metric.gstatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 6.gif
p4-gwyhc22pboc7c-4erul7yjt2qr7imo-634121-i2-v6exp3.ds.metric.gstatic.com/v6exp3/ Frame 7E0A 35 B
490 B 130ms
38ms Image
image/gif 2607:f8b0:4020:804::2012
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p4-gwyhc22pboc7c-4erul7yjt2qr7imo-634121-i2-v6exp3.ds.metric.gstatic.com/v6exp3/6.gif

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2012 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://p4-gwyhc22pboc7c-4erul7yjt2qr7imo-if-v6exp3-v4.metric.gstatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FA50 0
27 B 44ms
43ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B3oU7ImXCZN3-JIWUoPwPtbqnuAgAAAAAOAHgBAI&bg=!0tGl0YXNAAZGOVy5Zjk7ADkAdvg8WuAZbsj8mAol3DKBgoULGnEc_b03mo_7OG7TTERpvkLLYZB9zqxqoh-2wKcc1FjDu3PBtB0CAAAGLlIAAAALaAEHmQL3c3z1T1eKiTb16-12Ahd7qBmzgn8JICi4ifYD67l-AzcvKGHv0eZoC_iezbCruvbPwDBaA2moYVa7T3xxPNfb-EJdrXVcagRmm7g4hRqI47FKWr1Z0hmCUaqf6YFl9SHUZb9WVmlqi-1Y8DoKci8w6T9XghftuWj2bwSdLO6pIHtFY9ylH9y53k1J4GveqCdOpv-MuJatqbyCZNKPP2vvKPMmxesbXACtL6Fan0-gDtAyLu-93rXcvkxxmjaoa_u4YD8WZzm5PPEUWTlEJovlxylQ1O62InQf3f8HjuOOq_hZnxAi1IXoKKtakbSKWQ0U9fWmS6kyGPxwVgTsPA61GM0b7cO5ft2AuU5Hb7bylw83JSrt4C7dorrV2lQjRT9zj9LpuZnQtLOwNY9yHnmlqqW3tEOcf9Lguw3h9QXPy04S4XM3RRx72Tc5Md21VfvhoYqtPFqTjkozPXhhzbc4wAcy2bwKHfWwVKqSAKZQU6hGWw9Cjn5LCN6XKLEUxn8H0AFvD2e2zD9oEJCTsF47-MYO14kM0gaq2rKJZiVe0M2BPcwIwMOc67GF6wYXi63mUlnfzVoRGwG8wzilcVNku_RX7PE1YR5fIVFXUsXUShglvdcRV5AI0K1a6NG0J5lrosPp4I7nf8ZwkMF2ha7hyJAqIQAXzEYAftIiVGK__Wp0Iq06k6vT9lY2oFCz2w4s9WG1zt4m7eQiGX0ShY5Z-pQOGTWIvnEXN0zEkGUUMiqwlzgEAVekzuB7_5Ef9IG4nTdqILcZu-zPIQGsPjEoiZpPg65OTwZeWNdE8vI4obURVCegxOO3F1PBaekGoTecqJwQSM-EUZH9vKs2vgzeO2-DDQ8IE-WJ3-4aS8rXDNsrezODcQA9diyVRhqO9DbUtQAjO2o7NMIRLuPEfsCddEfgQwgTxPkwdmYTq6DqKxNvpSB_iLE0fCUNlNdpvNBGF4F1q9TG6W9HkqVaa-CWCL7FeOkjrvvQoZH_pKAjEuMNEy0bkn67

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8E21 0
27 B 45ms
44ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BNZ0oI2XCZKSsCcWyowasv5yABQAAAAA4AeAEAg&bg=!5uWl5bHNAAZGOVy5Zjk7ADkAdvg8WtHljpRo0P8cfJP9EtY1OAEkBNQoeQM_YuVAC53u4Qn2j1gaP2rzqtXQ5fgns3-Hx_5X7S4CAAAGklIAAAANaAEHmQME-0SMerwLFB0AyfcIJKsBf474Tp3Ib5v4JAOkpH2Uuk0Tw33FSLlLQmT7XCMIdGfRbgcx5qYQWvCEJab1CiZapjT6HCkT04sPhLLfhywZW60vDPRCesYpUxaV-aJ44kbCT2RrMKNkfZCLoLhNQpgGpPWm8AVyOH2HeVxUsTnhu7r3pQEj4uxG8qXre3zNRYMuuwQb5EqTbXXHmIK60MesvsO4tUgyPh0XDfiCVSexh3uvYJKfnVUwaA5ogLqvCuyWqd42E_7eHdlUfoPj7-amOCduL2g_wFQIbqQe13LOPXKfZTbZJO_S73d3-HvCHd7oKpY-sDhqvCEYP7PtUpUbG_7FFQ_V2IMG2caehSBNLqZ8xHLGCFzhYGGHro99ckVGlGRDCKQebbOV0MLAth7a0gha_wz0JNtp2-4vDAh_UgmRdswL80n7unpVUeeAg44sW_dgra6GHLoiiDFz6bVkfRA-4EJV7JBM_BhnU42d4JJqUfi3tb2wv1jRVOupSz5QtIkRF1njBUWSRWBUl8G8Qlz1YQwcpY2_bhwBMkRWBlmPanHwMP37zQdyHic96PY-u8QXuGre4N6CDui6YtmEln68zZYctka_dRT823oUN8yMIUByj2x-c_fiF8jE8QOQXwr5dVmS2rE3v3L18n89d494djxYsbj0Xb3DQmc_lerbiHl4ToP0jw5Eq035Vz45i08YhZT5vrEcpJwyJnKVgM1J_iwA0ki4jt0kXX9D2UCkRv-rz-h62huHFgMBnnp6Z2j392qXd-97G8l2vCOktnjiLrzz66UFutLMrkYMj6c6qnhnTN59gCEqaJSnnmel0-Rv2JKzykJdDJGOd_E6vt4xtFCElEQ620pBEsgT3tyL5YtWYqZTqoys1Sa19uJUJ_Tj502_vJBmwLSSDpy-CNrS7eJe0-wuBDpkr1DQuHOLOWlGDeJSzUODffQAUyLNhXG9VuJCGAVO2AUKo2noO0v5u1KozMZ_Ji-BBtkEnwR0gFkKMUE4VOwk-8Jx48CgNgHpSw

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 56D6 0
27 B 44ms
44ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BYlcEI2XCZOnXCtHa_gTSt63gAwAAAAA4AeAEAg&bg=!Tk2lTRnNAAZGOVy5Zjk7ADkAdvg8Wih6U5iVlzN5JArPnyP_s3ihSDR5ChetSNjhvOMWxSN9OftScp3Qn83Z10WEspKoOQTDYAwCAAAGf1IAAAALaAEHmQMMZD8OXmhWswBnlhMwnm1YuwKqTsMnqUWJEpjhAZhEaCYa1EnFjhztStDpTQ5Vbr2kXRbKIUG3JysTCKiruuJkivnng9e_WWxnDPG1Ks3n9ilaKzSyzf7VfMFBhm6i01Z4GKGhw8uTGyBll-GV59wBfSCHNCEwWj1k7WezCX-7Iq4vksJsyPsdZhcinSyDmFY49w8M4WjGgmJ1KCooOk3QjNW9BLS3OCPaldVTYLYDOCAupWGxBJTwhQWMjbH7bh3AQRD0infaESnn1qRcH0QcrkSU7cdP7AT_9Dwe4iFI3QwnT6ZBrG7DNDxcvwzk5yT-FCRoCGfC1uFuHT6duN-RjXDzrc9eS_Qq-IbSVn2qeAUIUCrmYfebFZcA6uvMaxRR7jrr_ngULyjUlR16PdsMpVEAO55M9qpykzP8P-R6pUpi03NnlvuFyjiBKrYi-4tIxxF5qlDGah7fG46xT4E7xpS-o30jlylr7L1NKCORHAYEW1jycknUTBNzsBD38NcPbvPss0FrlPbqTcRtaL3O0aA3z47rvQ8qXTil-XmeVRv2G1TRHCgyAz3CB3CBIhcIHV2D5NuW7HV8ShwrtacIC9jwG0n1en4Zt2DbNFMU2-sJosETx2MRAF1BeueHFVbruq_MfTpkKpvGo-2qsp2G5iEhQanGdpDajrr16S6m54Sf6_AKRqzXTfV3NERkrD1CoZJ-_8BEYgVJDXad-7Gr-0MZY1_CtiyrKhKwPgt6hzWTQD98Wy1gktM6hCpcsJAiBQW9iQ5N3-ikACh_c9sYXjehJ-VzL0lrI2X-XF4qEwGe7WjzITYf0RENX0sbx_-yODcGKzNKW6V-7vdC6yrUP6WJk_TRlemUcVVsu9R2pFdyGv7bo4cPai0Xl-PjZPUJj84ejD-_JNbBD1yo98KYtwNy-wIEi2MoyAKfQA6G5PTuPTiG3mRP7iN5p4QNQwSX6QCKDBRVJ24i4VR4YIBEsf5-vvfVZBp4IAZ7QwE8gDbq5uDH_V4rQzDfmsXvrXAUXMUEpP47-LsyD0Lk

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A637 0
27 B 52ms
51ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bw0aEImXCZI73L4CpoPMP87GjsA8AAAAAOAHgBAI&bg=!paalpvLNAAZGOVy5Zjk7ADkAdvg8WpRCUqbTdHQZN_M-9L4yrGZRJ3uSzTo-_EpggZvBTsxuYLrFUntGygR7sqSRVC2NEyoJNYUCAAAHDFIAAAALaAEHCgAt_plPhL4DA-ktIZlVxIyZcrDGJWtfMfGQczVQk9Ob-ZCqFhmfLQpTk-DCJ1LgmQL7N7gGJPRfUeFooiF3qmXnDM1nEu4M-GJac65AkWma-UYbIycrpA01DOt8bKOGvDw3hsvAl5gTcJPQIpl5EpwF61VKmcDCD4vyIULDSdgPM4EXDd-EnqpG_PJGa223pdgq8ueNFQPrrEBYX-ng1-TcrllrCdi5IDrikRJqFiUfu3lqydWEBVj9FO1jTePscpdfm7QBxeNv4ObCey98GEuc8yGGFCSvELQXmu5RM3aMMMPfiZcD8WmEkaPgJNl9jxagTGAfRO4Q4ORjR32oY-93LBb56EFbDlaNvzkFnyzzt1k7hOJFhqSZTOodsLlVjGG5lSj-r_V5kG4hL-p-qUFyShPGfxJ9awqSQMTBv6j7ZVhfMoTz2WaetYSrqjUHIznGzulZpjGCQ4Ym_pYJC1c54254oFE85ZZUtHTojcS_7aYOCRko_3CwYiWKp6yL0f7LxjZ28zRSzGMSbcjoOG3DCeQODIAzt9LbGZA52c-3hNu4G7tP3ZO1v4mz9zXVBVqJh6TZDAcgf-_Evv7_4hLKJFAms_qv_v0UFz_tQImH86lNx8Yl53QiHwyJRgS_gy0Xo4VxLEpPnRFlHM5S7VK0901rtaMMjVbk6daw1SGd2Ry9BgJQxemtmemKJhSuj_r2olZTRy0QmNo7JLhqpeugU0SxNlL0zL0PNZbY8VETvzkgofPmg7L681977LS4Wr7WNMkr2oBjAStNV5kYHDlQsB4Bk1NTy86HZZMwPhwuPy5-7JpL-mrgR8OrdojcJG-k2mIQrEATqnKlMiaOQGuUUetgeWmY6MkbfuMk7frAetuyuawSkhSjaQ8_AyQs6sImdqTUiKKlf53-XzJdpdpFCCuWU9xUl3N5BE7FcTvdPJyVeL_Y1jnr0iI1oymOTaMEntlI1Ln-GVPWHJL59hi71H9CrF0Qyz7qzgzxr-zipf2LAfiqeDRLPgRUlXib4K1MvpPY7gqNzpUwJyD4rTHC5eh2OSQJIRQbodCQp_3G1xC8BsN9Opccj3kwgg

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BB0F 0
27 B 47ms
47ms Image
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BaoGTI2XCZLHEJpT8owbZx7vABwAAAAA4AeAEAg&bg=!Tk2lTRnNAAZGOVy5Zjk7ADkAdvg8WoMjSzsdJ8WUs9X5PfXUN3xDG2822-BtgTpwiCbljTGqEqCI7EqFkB3ZIbN2O-nmZBhmHQsCAAAFXFIAAAAKaAEHmQL8ExcJAOJB9pV0tzClcFOcz1sLhQdKndmEgCSWM3DjkH5f46EUevX68mMbmuT7WYw2BCYrwjVw-ovEJtw80Is42kGNBnDWqOhBDpUxPfy6sM8IwuZeH-Yq8dpzqUNis2VCWsHru1D7IwGewMRlPLzSgLANglWqzYb96A6Az4Rn4Z8zLGMvQlp_ImFfeaoKZHmngU1lutLjoI3th4TWC_1Gp0PVhTX2j1CyPBzX74zAzV1dUzFp3xIdkimkGkxcEohdseWLubiJzqH8rHdQnXiZMzmsKGFo0DoGrePEQv_dXhe0WYzfUFsPwyY8WNjHa2F91vC7g9F1z2I03dx5T8X9_b78mgIz3RRTOcy78wtGTQYF3y6Dbj_OeFGzvpEAiEadD5hihw7FAGHuqqjpdzdffzZR6b4QTgNJ_0lOtqZ1-havMXCYofk62qXYlxHfJE0vJghy2QYwpU9-WBXdVKBNnmZWOVGoA6ayc3e4133_tVVFDpv9EukTCzI07Bax_TJb-mkjhIN1T13JwUpjRcH8oTlbza_febePvOYqa0U9TljKKqr7sO78Cdsy8JzxD5aD9ZEj_r_uNEdyOOQZ64jea78-ONpWXxn_pslWWSBpdh_bEkJT-rRVp3AEE43b5HnmcZJom-fIbc0qCuDJaZlm3TpsQjLUpgpyXnzqXzEwWqPPs32bvSW2qvgvL6f7bI3gHPIkD8iGtg7vb0gGJH9doUfGuHs2h5eYiVCYX0rScxiO2ZGz00zxf4Ahn29toHiarUgytIlm6r7V62vuk-Q6GgWvCQ7V1u-m5Vdl7gdNd8gIBzxZHvOIaiVNtwHKAdogM2hMOgtlqI9H5a0OUIFWdlbBiEHCUtW92Cdlg_DhTXfgbUc23wrzK8O6xTpgJVk7WEPb5C6xRlu-DPupmvIUaUaVs1VeK8OIgZwGr779cnuPcetSl0eSS4oW6cGN8-2rNYRxKz0T64R5lLY0_L1f4OMw0DgQ0oVA37-HqWzrQ0_7jsa1IYgG9yJX2eU

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dcl.htm Show response
rt3044.infolinks.com/action/ 0
39 B 89ms
89ms Script
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3044.infolinks.com/action/dcl.htm?rid=cece8cb3-4b63-4322-819e-e0595816a52f&jsv=1870.002-3.027.ab.1874.021-3.027&capara=%7B%22error%22%3A%22ICE_HB%20was%20not%20found%20on%20window%20-%20init%20not%20fired.%22%7D
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1870.002-3.027.ab.1874.021-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 7ed4efe22c844388-EWR
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 ad.html Show response
westads.simpli.fi/ads/3592432/32612348/ Frame 9A88 3 KB
2 KB 222ms
65ms Document
text/html 34.168.195.104
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://westads.simpli.fi/ads/3592432/32612348/ad.html?sifi=8608,3592432,32612348,105306032504518,2,0,0,0,0,265,1,v,17.29000,1.330000,0,0,1,7,4D94309430964F1EAB559A6C8B7C142E,0,0,0,1210,400,1,0,0,604,0,701,bidder-base-prd-us-west1-b-931cfe3b:9011-1690461480256-548580438,1,2,395291,2,0,29,12,06479,0,0.00,0,0,95808134,0,0,0,1,-4,0,98,,0,337460,0,0,3,-1,156872,-1,-1,4840792&sifi_exchange_uid=380BD354-7A30-4632-8168-9BF044560A9A&request_id=30D83054-42A6-4F67-B3A2-87F6E3E62738

Requested by

Host: blank
URL: about:blank

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.168.195.104 The Dalles, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

104.195.168.34.bc.googleusercontent.com

Software

Resource Hash

231cb4c16ad6e0857c2be18d880b8463a70c2659f6b3ac8815ca3295be501dd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
x-request-id: F3W5wtGNM1IRizc1g20C

GET
H2 200 showad.js Show response
ads.pubmatic.com/AdServer/js/ Frame CB66 39 KB
14 KB 11ms
10ms Document
text/html 184.50.204.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: blank
URL: about:blank
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.50.204.192 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-50-204-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 5cd425896ccfd119ee720821af6a832189231c40d52ae8cad03480886967b984

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=154675
content-encoding: gzip
content-length: 14445
content-type: text/html
date: Thu, 27 Jul 2023 12:38:01 GMT
expires: Sat, 29 Jul 2023 07:35:56 GMT
last-modified: Tue, 21 Mar 2023 06:09:28 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 AdDisplayTrackerServlet Show response
st.pubmatic.com/AdServer/ Frame 7AD8 0
91 B 72ms
15ms Document
text/plain 8.28.7.95
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://st.pubmatic.com/AdServer/AdDisplayTrackerServlet?operId=1&pubId=156872&siteId=284982&adId=1373833&imprId=3A294F73-A100-47E6-A642-FB91FB597C38&cksum=D94E49BAA3BF909D&adType=10&adServerId=243&kefact=1.228571&kaxefact=1.228571&kadNetFrequecy=0&kadwidth=728&kadheight=90&kadsizeid=7&kltstamp=1690461480&indirectAdId=0&adServerOptimizerId=2&ranreq=0.1&kpbmtpfact=1.330000&dcId=1&tldId=0&passback=0&svr=BIDSV30200&adsver=_1408952789&adsabzcid=0&cls=BID&i0=0x2100000000000000&c0=0x1&ekefact=KGXCZOKHBgAPIm5CVN6J8psS7kz8HfGf_1pGbe9_AWtiVzVh&ekaxefact=KGXCZPCHBgCzIlWwq9J6zdZIKQ7LFKMQDIEowC1CU12SKPUV&ekpbmtpfact=KGXCZPyHBgBiRv5tIPgmZSAIGOF9ZAKimePP-bM8p5QeK4yw&enpp=KGXCZAiIBgDjigUiSmBNsW4m1MjIQ9W6OWZlLcXNDekBvjI4&pfi=1&domId=16694358824775985714&dc=SFO2&pubBuyId=6469&crID=32612348&lpu=ct.gov&ucrid=7017103702741991340&campaignId=19421&creativeId=0&pctr=0.000000&wDSPByrId=1&wDspId=148&wbId=15&wrId=0&wAdvID=309481&wDspCampId=3592432&isRTB=1&rtbId=30D83054-42A6-4F67-B3A2-87F6E3E62738&ver=14&dateHr=2023072712&oid=3A294F73-A100-47E6-A642-FB91FB597C38&cntryId=232&domain=ehfmc-com.ngontinh24.com&sec=1&pAuSt=2&wops=0&sURL=ehfmc-com.ngontinh24.com&BrID=5&oiabdvt=2
Requested by: Host: blank
URL: about:blank
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.95 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Thu, 27 Jul 2023 12:38:01 GMT
expires: 0
pragma: no-cache

GET
H2 200 adview.htm
rt3044.infolinks.com/action/ 0
135 B 94ms
93ms Image
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rt3044.infolinks.com/action/adview.htm?rid=cece8cb3-4b63-4322-819e-e0595816a52f&bdc=1&midx=0&emd=MzgzfjE5NDIxX251bGx-MzI2MTIzNDg&rts=1690461481357&prod_t=u&jsv=1870.002-3.027.ab.1874.021-3.027&sdata=logo&scs=cXIy0tnxyg&rsd=VulGt4aPTSytPXT6bfIP_Pxw-_GJznigFpj0uvo2SotyJalMVbLbtGWHvQ3FAnMk2jm5JFQeTcYsu4GlUxaFaFloWI3mXEdKId_Xl_TQmZmN37MNRq4-5lw7pJ-gvjT7rLJwImBenActF9DQr-XsQWKE7hchI5qLC4Qp9BpqGJw&rsk=44&rcs=2kZyEovFADmogrB1cMb1kQ
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 7ed4efe28ce74388-EWR
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2E8C 0
27 B 42ms
42ms Ping
image/gif 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=7721995629649&version=m202306200101&ct=76&x=1&cor=6505049772523424000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cba77.jpg
media.simpli.fi/ads/display/eb/32612348/c52c0d3ac579cf8b0f408165d91f342b/ Frame 9A88 54 KB
54 KB 50ms
5ms Image
image/jpeg 34.160.5.2
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.simpli.fi/ads/display/eb/32612348/c52c0d3ac579cf8b0f408165d91f342b/cba77.jpg?sifi_date=8608
Requested by: Host: westads.simpli.fi
URL: https://westads.simpli.fi/ads/3592432/32612348/ad.html?sifi=8608,3592432,32612348,105306032504518,2,0,0,0,0,265,1,v,17.29000,1.330000,0,0,1,7,4D94309430964F1EAB559A6C8B7C142E,0,0,0,1210,400,1,0,0,604,0,701,bidder-base-prd-us-west1-b-931cfe3b:9011-1690461480256-548580438,1,2,395291,2,0,29,12,06479,0,0.00,0,0,95808134,0,0,0,1,-4,0,98,,0,337460,0,0,3,-1,156872,-1,-1,4840792&sifi_exchange_uid=380BD354-7A30-4632-8168-9BF044560A9A&request_id=30D83054-42A6-4F67-B3A2-87F6E3E62738
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.160.5.2 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 2.5.160.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: fe0f906bf527b9e9066e1be7c54bfcbf622ab63f33c266c6d272cf53155ecc15

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 11:51:51 GMT
age: 89170
x-guploader-uploadid: ADPycdvWdzAXznF4hQa3rE1LUvfrIsEXH7-wHjIRtt4PyHaLE-Ezb4tEXQUurQWv4ZG3csAi8PrIHL-VMC-fps66gLrW14taEr4o
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-meta-copied_from: sifi-cdn-ads-live-prd-us-east4-1bf72d84/eb/32612156/c52c0d3ac579cf8b0f408165d91f342b/cba77.jpg
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54957
last-modified: Wed, 26 Jul 2023 03:03:41 GMT
server: UploadServer
etag: "c52c0d3ac579cf8b0f408165d91f342b"
vary: Origin
x-goog-generation: 1690340621375586
x-goog-hash: crc32c=tVQqOQ==, md5=xSwNOsV5z4sPQIFl2R80Kw==
content-type: image/jpeg
cache-control: public,max-age=3600
x-goog-stored-content-length: 54957
accept-ranges: bytes

GET
H2 200 ca Show response
choices.truste.com/ Frame 9A88 27 KB
10 KB 15ms
14ms Script
text/javascript 108.138.106.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.truste.com/ca?pid=simplifi01&aid=simplifi01&cid=0611sf728x90&c=cont1&w=728&h=90&js=pmw0&plc=tr&sid=7BFq-tseoZb_N8y1CeH8CJ6lD4BRzEOb5nYWHrpoKi0ghJk1yGLRXc7uF8yXWhKlDqO6rAE6GjYVAhgl24X3hgE4lzetM9YxYgkOcPK4QVpuAJnMHpF4ZZtbNNG0CXIbUbeLJL079RL7NmLvK6WI9A8XoY5YQvLPfB0XBkBUYwE

Requested by

Host: westads.simpli.fi
URL: https://westads.simpli.fi/ads/3592432/32612348/ad.html?sifi=8608,3592432,32612348,105306032504518,2,0,0,0,0,265,1,v,17.29000,1.330000,0,0,1,7,4D94309430964F1EAB559A6C8B7C142E,0,0,0,1210,400,1,0,0,604,0,701,bidder-base-prd-us-west1-b-931cfe3b:9011-1690461480256-548580438,1,2,395291,2,0,29,12,06479,0,0.00,0,0,95808134,0,0,0,1,-4,0,98,,0,337460,0,0,3,-1,156872,-1,-1,4840792&sifi_exchange_uid=380BD354-7A30-4632-8168-9BF044560A9A&request_id=30D83054-42A6-4F67-B3A2-87F6E3E62738

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.106.40 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

117.242.85.34.bc.googleusercontent.com

Software

nginx /

Resource Hash

3699b11bd84f6bbfe3ecb5d863e93999dbe74b6ff1cfd63618d990780ac414b0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 8c17de0f985b9ec9dbef8f79e2137106.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: JFK50-P3
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: A8633vlp47fjOsXCDVZRuHs7cpuYJ12kfQZlv6EJz7QmVVop5DbYDw==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 SifiLib-1.1.12.min.js Show response
cdn.simpli.fi/lib/ Frame 9A88 1 KB
2 KB 61ms
4ms Script
application/ecmascript 108.139.29.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.simpli.fi/lib/SifiLib-1.1.12.min.js
Requested by: Host: westads.simpli.fi
URL: https://westads.simpli.fi/ads/3592432/32612348/ad.html?sifi=8608,3592432,32612348,105306032504518,2,0,0,0,0,265,1,v,17.29000,1.330000,0,0,1,7,4D94309430964F1EAB559A6C8B7C142E,0,0,0,1210,400,1,0,0,604,0,701,bidder-base-prd-us-west1-b-931cfe3b:9011-1690461480256-548580438,1,2,395291,2,0,29,12,06479,0,0.00,0,0,95808134,0,0,0,1,-4,0,98,,0,337460,0,0,3,-1,156872,-1,-1,4840792&sifi_exchange_uid=380BD354-7A30-4632-8168-9BF044560A9A&request_id=30D83054-42A6-4F67-B3A2-87F6E3E62738
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.29.40 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-29-40.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2c67404c1eab4fd9ccbfff1e25eb2c676fbda189004a54ff050f51326080ecaf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:34:02 GMT
via: 1.1 c1685d59e35fdb859ab8a1f97feb5652.cloudfront.net (CloudFront)
last-modified: Thu, 03 Nov 2022 18:38:48 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P2
age: 240
etag: "b45652bcc83850c179affce5e3df2e7f"
x-cache: Hit from cloudfront
content-type: application/ecmascript
accept-ranges: bytes
content-length: 1263
x-amz-cf-id: VQj5cwa_Vp7z4X5r5HyLSyZfrb1cShWyCHp-nbKzEHD0r79_cvvJnA==

GET
H2 200 p Show response
i.simpli.fi/ Frame 9A88 775 B
1 KB 66ms
14ms Script
application/javascript 34.85.242.117
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://i.simpli.fi/p?cid=337460&cb=ads_70551956944._hp

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.85.242.117 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

76858feb842ccf5e28302d9db5fe0d658ae8df56007e0dec0684773c8bc50b8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache, no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0, max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Thu, 01 Jan 1970 00:00:00 GMT, Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

204
No Content

89A587D6428942BFB7DBA431CAFC20D7
sync.1rx.io/usersync/simplifi/ Frame 9A88
Redirect Chain

https://um.simpli.fi/nexxen
https://sync.1rx.io/usersync/simplifi/89A587D6428942BFB7DBA431CAFC20D7

0
187 B

26ms
22ms

Image
text/plain

199.127.204.171
RHYTHMONE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.1rx.io/usersync/simplifi/89A587D6428942BFB7DBA431CAFC20D7
Requested by: Host: westads.simpli.fi
URL: https://westads.simpli.fi/ads/3592432/32612348/ad.html?sifi=8608,3592432,32612348,105306032504518,2,0,0,0,0,265,1,v,17.29000,1.330000,0,0,1,7,4D94309430964F1EAB559A6C8B7C142E,0,0,0,1210,400,1,0,0,604,0,701,bidder-base-prd-us-west1-b-931cfe3b:9011-1690461480256-548580438,1,2,395291,2,0,29,12,06479,0,0.00,0,0,95808134,0,0,0,1,-4,0,98,,0,337460,0,0,3,-1,156872,-1,-1,4840792&sifi_exchange_uid=380BD354-7A30-4632-8168-9BF044560A9A&request_id=30D83054-42A6-4F67-B3A2-87F6E3E62738
Protocol: HTTP/1.1
Server: 199.127.204.171 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:38:01 GMT
Cache-Control: no-store, no-cache, must-revalidate
Server: Tengine
Connection: keep-alive
Expires: 0

Redirect headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://sync.1rx.io/usersync/simplifi/89A587D6428942BFB7DBA431CAFC20D7
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 26 Jul 2023 12:38:01 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 9A88
Redirect Chain

https://um.simpli.fi/triplelift
https://eb2.3lift.com/xuid?mid=7969&xuid=89A587D6428942BFB7DBA431CAFC20D7&dongle=yf3

37 B
354 B

27ms
16ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7969&xuid=89A587D6428942BFB7DBA431CAFC20D7&dongle=yf3
Requested by: Host: westads.simpli.fi
URL: https://westads.simpli.fi/ads/3592432/32612348/ad.html?sifi=8608,3592432,32612348,105306032504518,2,0,0,0,0,265,1,v,17.29000,1.330000,0,0,1,7,4D94309430964F1EAB559A6C8B7C142E,0,0,0,1210,400,1,0,0,604,0,701,bidder-base-prd-us-west1-b-931cfe3b:9011-1690461480256-548580438,1,2,395291,2,0,29,12,06479,0,0.00,0,0,95808134,0,0,0,1,-4,0,98,,0,337460,0,0,3,-1,156872,-1,-1,4840792&sifi_exchange_uid=380BD354-7A30-4632-8168-9BF044560A9A&request_id=30D83054-42A6-4F67-B3A2-87F6E3E62738
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif
date: Thu, 27 Jul 2023 12:38:01 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://eb2.3lift.com/xuid?mid=7969&xuid=89A587D6428942BFB7DBA431CAFC20D7&dongle=yf3
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 26 Jul 2023 12:38:01 GMT

GET
H2

200

sync
simplifi.partners.tremorhub.com/ Frame 9A88
Redirect Chain

https://um.simpli.fi/telaria_p
https://simplifi.partners.tremorhub.com/sync?UISF=89A587D6428942BFB7DBA431CAFC20D7

43 B
174 B

28ms
13ms

Image
image/gif

2600:1f18:612b:4216:545b:f017:f638:2c9a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simplifi.partners.tremorhub.com/sync?UISF=89A587D6428942BFB7DBA431CAFC20D7
Requested by: Host: westads.simpli.fi
URL: https://westads.simpli.fi/ads/3592432/32612348/ad.html?sifi=8608,3592432,32612348,105306032504518,2,0,0,0,0,265,1,v,17.29000,1.330000,0,0,1,7,4D94309430964F1EAB559A6C8B7C142E,0,0,0,1210,400,1,0,0,604,0,701,bidder-base-prd-us-west1-b-931cfe3b:9011-1690461480256-548580438,1,2,395291,2,0,29,12,06479,0,0.00,0,0,95808134,0,0,0,1,-4,0,98,,0,337460,0,0,3,-1,156872,-1,-1,4840792&sifi_exchange_uid=380BD354-7A30-4632-8168-9BF044560A9A&request_id=30D83054-42A6-4F67-B3A2-87F6E3E62738
Protocol: H2
Server: 2600:1f18:612b:4216:545b:f017:f638:2c9a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Thu, 27 Jul 2023 12:38:01 GMT
server: nginx
content-type: image/gif

Redirect headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://simplifi.partners.tremorhub.com/sync?UISF=89A587D6428942BFB7DBA431CAFC20D7
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 26 Jul 2023 12:38:01 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 9A88
Redirect Chain

https://um.simpli.fi/tapad
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=89A587D6428942BFB7DBA431CAFC20D7

95 B
123 B

59ms
54ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=89A587D6428942BFB7DBA431CAFC20D7

Requested by

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

96.170.150.34.bc.googleusercontent.com

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=89A587D6428942BFB7DBA431CAFC20D7
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 26 Jul 2023 12:38:01 GMT

GET
H2

200

empty.gif
um.simpli.fi/ Frame 9A88
Redirect Chain

https://um.simpli.fi/ad_advisor
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=89A587D6428942BFB7DBA431CAFC20D7
https://d.agkn.com/pixel/10751/?che=1690461481809&ip=5.181.234.134&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D214640604590006890816
https://um.simpli.fi/aa_px?sk=214640604590006890816
https://um.simpli.fi/empty.gif

43 B
361 B

14ms
13ms

Image
image/gif

34.150.170.96
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/empty.gif

Requested by

Protocol

Server

34.150.170.96 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43

Redirect headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: /empty.gif
access-control-allow-origin: *
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142

GET
H3

200

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/ Frame 9A88
Redirect Chain

https://um.simpli.fi/intentiq
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=89A587D6428942BFB7DBA431CAFC20D7

43 B
897 B

80ms
74ms

Image
image/gif

2600:9000:26fa:4800:1b:6b7d:2300:93a1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=89A587D6428942BFB7DBA431CAFC20D7
Requested by: Host: westads.simpli.fi
URL: https://westads.simpli.fi/ads/3592432/32612348/ad.html?sifi=8608,3592432,32612348,105306032504518,2,0,0,0,0,265,1,v,17.29000,1.330000,0,0,1,7,4D94309430964F1EAB559A6C8B7C142E,0,0,0,1210,400,1,0,0,604,0,701,bidder-base-prd-us-west1-b-931cfe3b:9011-1690461480256-548580438,1,2,395291,2,0,29,12,06479,0,0.00,0,0,95808134,0,0,0,1,-4,0,98,,0,337460,0,0,3,-1,156872,-1,-1,4840792&sifi_exchange_uid=380BD354-7A30-4632-8168-9BF044560A9A&request_id=30D83054-42A6-4F67-B3A2-87F6E3E62738
Protocol: H3
Server: 2600:9000:26fa:4800:1b:6b7d:2300:93a1 , United States, ASN (),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
via: 1.1 f5b6caeff9422ffe5c739ff6cf167922.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: JFK52-P1
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: F6Y9NKFY_vQyoxz_mhSBVuKoe14ojVA9deYlaKhMiEAEZwQuv3M_yQ==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=89A587D6428942BFB7DBA431CAFC20D7
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 26 Jul 2023 12:38:01 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 9A88
Redirect Chain

https://um.simpli.fi/pubmatic
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:89A587D6428942BFB7DBA431CAFC20D7

42 B
248 B

18ms
9ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:89A587D6428942BFB7DBA431CAFC20D7
Requested by: Host: westads.simpli.fi
URL: https://westads.simpli.fi/ads/3592432/32612348/ad.html?sifi=8608,3592432,32612348,105306032504518,2,0,0,0,0,265,1,v,17.29000,1.330000,0,0,1,7,4D94309430964F1EAB559A6C8B7C142E,0,0,0,1210,400,1,0,0,604,0,701,bidder-base-prd-us-west1-b-931cfe3b:9011-1690461480256-548580438,1,2,395291,2,0,29,12,06479,0,0.00,0,0,95808134,0,0,0,1,-4,0,98,,0,337460,0,0,3,-1,156872,-1,-1,4840792&sifi_exchange_uid=380BD354-7A30-4632-8168-9BF044560A9A&request_id=30D83054-42A6-4F67-B3A2-87F6E3E62738
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 12:38:00 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:89A587D6428942BFB7DBA431CAFC20D7
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 26 Jul 2023 12:38:01 GMT

GET

dmp
vop.sundaysky.com/sync/ Frame 9A88
Redirect Chain

https://um.simpli.fi/freewheel
https://ads.stickyadstv.com/user-registering?dataProviderId=753&userId=89A587D6428942BFB7DBA431CAFC20D7
https://sync-tm.everesttech.net/upi/pid/wGbQAlJJ?gdpr=0&gdpr_consent=&redir=https://ads.stickyadstv.com/user-registering?dataProviderId=187&userId=${TM_USER_ID}&gdpr=0&gdpr_consent=
https://ads.stickyadstv.com/user-registering?dataProviderId=187&userId=ZMJlIQAD_4qDUABY&gdpr=0&gdpr_consent=
https://jelly.mdhv.io/v4/pixie?gdpr=0&gdpr_consent=
https://ads.stickyadstv.com/user-registering?dataProviderId=513&userId=fa112ec8-3486-4acc-9691-b850b830d62d
https://sync.extend.tv/freewheel?
https://ads.stickyadstv.com/user-registering?dataProviderId=737&userId=2274dfd6-a2df-4282-ae17-707c371c8df4
https://a.tribalfusion.com/i.match?p=b25&u=6b8bcc71db428e0a12d1a2a376a5e79&gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D977%26userId%3D%24TF...
https://s.tribalfusion.com/z/i.match?p=b25&u=6b8bcc71db428e0a12d1a2a376a5e79&gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D977%26userId%3D%24...
https://ads.stickyadstv.com/user-registering?dataProviderId=977&userId=18072662109834025425
https://freewheel-match.dotomi.com/match/bounce/current?networkId=41963&version=1
https://freewheel-match.dotomi.com/match/bounce/current?DotomiTest=3fd4910eb3321a22&is_secure=true&networkId=41963&version=1
https://ads.stickyadstv.com/user-registering?dataProviderId=1249&userId=AAAJPzLSpSUWLAME_9xIAAAAAAA&expiration=1690547882&is_secure=true
https://ad.turn.com/r/cs?pid=34&gdpr=0&gdpr_consent=
https://ads.stickyadstv.com/user-registering?dataProviderId=147&userId=4093334856250701331&redirectID=0&gdpr=0&gdpr_consent=
https://freewheel.adhaven.com/bid-engine/cs/b714c175b3fe12d9388dfc1431d76197/v1?rd=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D1217%26userId%3D%24UID&gdpr=0&gdpr_consent=
https://ads.stickyadstv.com/user-registering?dataProviderId=1217&userId=4c_d27ca90a-a138-4689-8353-1ac099efdbdd
https://sync.srv.stackadapt.com/sync?nid=169&gdpr=0&gdpr_consent=
https://ads.stickyadstv.com/user-registering?dataProviderId=1362&userId=TsQVy5XhU41iMArRnN9PSgW16oY
https://vop.sundaysky.com/sync/dmp?redirect=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D609%26userId%3D%24%7Bssky_uuid%7D

0
0

GET
H3

200

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/ Frame 9A88
Redirect Chain

https://um.simpli.fi/dtnx
https://fei.pro-market.net/engine?du=24;csync=89A587D6428942BFB7DBA431CAFC20D7;mimetype=img;
https://fei.pro-market.net/engine?du=24;csync=89A587D6428942BFB7DBA431CAFC20D7;mimetype=img;sr
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=3&pcid=2145200668710947294

43 B
992 B

16ms
15ms

Image
image/gif

2600:9000:26fa:4800:1b:6b7d:2300:93a1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=3&pcid=2145200668710947294
Requested by: Host: westads.simpli.fi
URL: https://westads.simpli.fi/ads/3592432/32612348/ad.html?sifi=8608,3592432,32612348,105306032504518,2,0,0,0,0,265,1,v,17.29000,1.330000,0,0,1,7,4D94309430964F1EAB559A6C8B7C142E,0,0,0,1210,400,1,0,0,604,0,701,bidder-base-prd-us-west1-b-931cfe3b:9011-1690461480256-548580438,1,2,395291,2,0,29,12,06479,0,0.00,0,0,95808134,0,0,0,1,-4,0,98,,0,337460,0,0,3,-1,156872,-1,-1,4840792&sifi_exchange_uid=380BD354-7A30-4632-8168-9BF044560A9A&request_id=30D83054-42A6-4F67-B3A2-87F6E3E62738
Protocol: H3
Server: 2600:9000:26fa:4800:1b:6b7d:2300:93a1 , United States, ASN (),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
via: 1.1 f5b6caeff9422ffe5c739ff6cf167922.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: JFK52-P1
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: dy898iaTP693Vgqj5nCphSls8TtNMIGkr1RFqLjb4bhO7N_RaTSSog==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:00 GMT
via: 1.1 google
server: Apache-Coyote/1.1
anserver: gapp9.us1
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
access-control-allow-origin: *
location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=3&pcid=2145200668710947294
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: clear
content-length: 0
expires: Mon, 1 Jan 1990 0:0:0 GMT

GET
H2

204

/
loadm.exelator.com/load/ Frame 9A88
Redirect Chain

https://um.simpli.fi/exelatem
https://loadm.exelator.com/load/?p=204&g=2191&simid=89A587D6428942BFB7DBA431CAFC20D7&j=0

0
1 KB

25ms
0ms

Image
text/plain

50.16.197.56
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadm.exelator.com/load/?p=204&g=2191&simid=89A587D6428942BFB7DBA431CAFC20D7&j=0
Requested by: Host: westads.simpli.fi
URL: https://westads.simpli.fi/ads/3592432/32612348/ad.html?sifi=8608,3592432,32612348,105306032504518,2,0,0,0,0,265,1,v,17.29000,1.330000,0,0,1,7,4D94309430964F1EAB559A6C8B7C142E,0,0,0,1210,400,1,0,0,604,0,701,bidder-base-prd-us-west1-b-931cfe3b:9011-1690461480256-548580438,1,2,395291,2,0,29,12,06479,0,0.00,0,0,95808134,0,0,0,1,-4,0,98,,0,337460,0,0,3,-1,156872,-1,-1,4840792&sifi_exchange_uid=380BD354-7A30-4632-8168-9BF044560A9A&request_id=30D83054-42A6-4F67-B3A2-87F6E3E62738
Protocol: H2
Server: 50.16.197.56 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-197-56.compute-1.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:01 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA

Redirect headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://loadm.exelator.com/load/?p=204&g=2191&simid=89A587D6428942BFB7DBA431CAFC20D7&j=0
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 26 Jul 2023 12:38:01 GMT

GET
H2

204

sync
ups.analytics.yahoo.com/ups/55964/ Frame 9A88
Redirect Chain

https://um.simpli.fi/yahoo
https://ups.analytics.yahoo.com/ups/55964/sync?uid=89A587D6428942BFB7DBA431CAFC20D7

0
381 B

62ms
39ms

Image
text/plain

3.225.218.10
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55964/sync?uid=89A587D6428942BFB7DBA431CAFC20D7

Requested by

Protocol

Server

3.225.218.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-225-218-10.compute-1.amazonaws.com

Software

ATS/9.1.10.64 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.64
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://ups.analytics.yahoo.com/ups/55964/sync?uid=89A587D6428942BFB7DBA431CAFC20D7
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 26 Jul 2023 12:38:01 GMT

GET
H/1.1

204

sync
sync.bfmio.com/ Frame 9A88
Redirect Chain

https://um.simpli.fi/beachfront
https://sync.bfmio.com/sync?pid=141&uid=89A587D6428942BFB7DBA431CAFC20D7

0
421 B

17ms
14ms

Image
text/plain

52.6.44.210
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=141&uid=89A587D6428942BFB7DBA431CAFC20D7
Requested by: Host: westads.simpli.fi
URL: https://westads.simpli.fi/ads/3592432/32612348/ad.html?sifi=8608,3592432,32612348,105306032504518,2,0,0,0,0,265,1,v,17.29000,1.330000,0,0,1,7,4D94309430964F1EAB559A6C8B7C142E,0,0,0,1210,400,1,0,0,604,0,701,bidder-base-prd-us-west1-b-931cfe3b:9011-1690461480256-548580438,1,2,395291,2,0,29,12,06479,0,0.00,0,0,95808134,0,0,0,1,-4,0,98,,0,337460,0,0,3,-1,156872,-1,-1,4840792&sifi_exchange_uid=380BD354-7A30-4632-8168-9BF044560A9A&request_id=30D83054-42A6-4F67-B3A2-87F6E3E62738
Protocol: HTTP/1.1
Server: 52.6.44.210 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-6-44-210.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Connection: keep-alive
Date: Thu, 27 Jul 2023 12:38:01 GMT

Redirect headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://sync.bfmio.com/sync?pid=141&uid=89A587D6428942BFB7DBA431CAFC20D7
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 26 Jul 2023 12:38:01 GMT

GET
H2

200

29931
stags.bluekai.com/site/ Frame 9A88
Redirect Chain

https://um.simpli.fi/bluekai
https://stags.bluekai.com/site/29931?id=89A587D6428942BFB7DBA431CAFC20D7

62 B
306 B

201ms
178ms

Image
image/gif

23.52.164.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stags.bluekai.com/site/29931?id=89A587D6428942BFB7DBA431CAFC20D7
Requested by: Host: westads.simpli.fi
URL: https://westads.simpli.fi/ads/3592432/32612348/ad.html?sifi=8608,3592432,32612348,105306032504518,2,0,0,0,0,265,1,v,17.29000,1.330000,0,0,1,7,4D94309430964F1EAB559A6C8B7C142E,0,0,0,1210,400,1,0,0,604,0,701,bidder-base-prd-us-west1-b-931cfe3b:9011-1690461480256-548580438,1,2,395291,2,0,29,12,06479,0,0.00,0,0,95808134,0,0,0,1,-4,0,98,,0,337460,0,0,3,-1,156872,-1,-1,4840792&sifi_exchange_uid=380BD354-7A30-4632-8168-9BF044560A9A&request_id=30D83054-42A6-4F67-B3A2-87F6E3E62738
Protocol: H2
Server: 23.52.164.232 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-164-232.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Thu, 27 Jul 2023 12:38:01 GMT
content-length: 62
content-type: image/gif

Redirect headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://stags.bluekai.com/site/29931?id=89A587D6428942BFB7DBA431CAFC20D7
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 26 Jul 2023 12:38:01 GMT

GET
H2

200

tpid=89A587D6428942BFB7DBA431CAFC20D7
bcp.crwdcntrl.net/map/c=7625/tp=SIMP/ Frame 9A88
Redirect Chain

https://um.simpli.fi/crwdcntrl
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=89A587D6428942BFB7DBA431CAFC20D7

49 B
265 B

67ms
44ms

Image
image/gif

54.160.214.90
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=89A587D6428942BFB7DBA431CAFC20D7
Requested by: Host: westads.simpli.fi
URL: https://westads.simpli.fi/ads/3592432/32612348/ad.html?sifi=8608,3592432,32612348,105306032504518,2,0,0,0,0,265,1,v,17.29000,1.330000,0,0,1,7,4D94309430964F1EAB559A6C8B7C142E,0,0,0,1210,400,1,0,0,604,0,701,bidder-base-prd-us-west1-b-931cfe3b:9011-1690461480256-548580438,1,2,395291,2,0,29,12,06479,0,0.00,0,0,95808134,0,0,0,1,-4,0,98,,0,337460,0,0,3,-1,156872,-1,-1,4840792&sifi_exchange_uid=380BD354-7A30-4632-8168-9BF044560A9A&request_id=30D83054-42A6-4F67-B3A2-87F6E3E62738
Protocol: H2
Server: 54.160.214.90 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-160-214-90.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.43.123
content-length: 49
expires: 0

Redirect headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=89A587D6428942BFB7DBA431CAFC20D7
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 26 Jul 2023 12:38:01 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9A88
Redirect Chain

https://um.simpli.fi/lj_match
https://ce.lijit.com/merge?pid=2&3pid=89A587D6428942BFB7DBA431CAFC20D7

43 B
1 KB

49ms
30ms

Image
image/gif

63.251.114.182
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=89A587D6428942BFB7DBA431CAFC20D7
Requested by: Host: westads.simpli.fi
URL: https://westads.simpli.fi/ads/3592432/32612348/ad.html?sifi=8608,3592432,32612348,105306032504518,2,0,0,0,0,265,1,v,17.29000,1.330000,0,0,1,7,4D94309430964F1EAB559A6C8B7C142E,0,0,0,1210,400,1,0,0,604,0,701,bidder-base-prd-us-west1-b-931cfe3b:9011-1690461480256-548580438,1,2,395291,2,0,29,12,06479,0,0.00,0,0,95808134,0,0,0,1,-4,0,98,,0,337460,0,0,3,-1,156872,-1,-1,4840792&sifi_exchange_uid=380BD354-7A30-4632-8168-9BF044560A9A&request_id=30D83054-42A6-4F67-B3A2-87F6E3E62738
Protocol: HTTP/1.1
Server: 63.251.114.182 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 27 Jul 2023 12:38:01 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap7ewr1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://ce.lijit.com/merge?pid=2&3pid=89A587D6428942BFB7DBA431CAFC20D7
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 26 Jul 2023 12:38:01 GMT

GET
H3

200

362358.gif
idsync.rlcdn.com/ Frame 9A88
Redirect Chain

https://um.simpli.fi/liveramp_match
https://idsync.rlcdn.com/419566.gif?partner_uid=89A587D6428942BFB7DBA431CAFC20D7
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEITLaY7_KDCLVzd_62rxbj0&google_cver=1

42 B
60 B

35ms
33ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEITLaY7_KDCLVzd_62rxbj0&google_cver=1
Requested by: Host: westads.simpli.fi
URL: https://westads.simpli.fi/ads/3592432/32612348/ad.html?sifi=8608,3592432,32612348,105306032504518,2,0,0,0,0,265,1,v,17.29000,1.330000,0,0,1,7,4D94309430964F1EAB559A6C8B7C142E,0,0,0,1210,400,1,0,0,604,0,701,bidder-base-prd-us-west1-b-931cfe3b:9011-1690461480256-548580438,1,2,395291,2,0,29,12,06479,0,0.00,0,0,95808134,0,0,0,1,-4,0,98,,0,337460,0,0,3,-1,156872,-1,-1,4840792&sifi_exchange_uid=380BD354-7A30-4632-8168-9BF044560A9A&request_id=30D83054-42A6-4F67-B3A2-87F6E3E62738
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:01 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEITLaY7_KDCLVzd_62rxbj0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 289
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

/
www.google.com/pagead/1p-conversion/1026675585/ Frame 9A88
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1690461481658&cv=7&fst=1690461481658&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1217126537&cv=7&fst=1690461481658&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ctc_id=CAIVAgAAAB0CAAAA&ct_cook...
https://www.google.com/pagead/1p-conversion/1026675585/?random=1217126537&cv=7&fst=1690461481658&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ssct...

42 B
64 B

44ms
43ms

Image
image/gif

2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/1026675585/?random=1217126537&cv=7&fst=1690461481658&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMIztKF4fOugAMVUw1oCB3PggA3&is_vtc=1&ocp_id=KWXCZI6aMtOaoPMPz4WCuAM&cid=CAQSKQBpAlJWDjem9sBgQ0F6olUidpftOIAUJQRBNw6-F65TQxaZwmnnP4hV&random=1468719799

Requested by

Protocol

Server

2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://www.google.com/pagead/1p-conversion/1026675585/?random=1217126537&cv=7&fst=1690461481658&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMIztKF4fOugAMVUw1oCB3PggA3&is_vtc=1&ocp_id=KWXCZI6aMtOaoPMPz4WCuAM&cid=CAQSKQBpAlJWDjem9sBgQ0F6olUidpftOIAUJQRBNw6-F65TQxaZwmnnP4hV&random=1468719799
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

partner
sync.search.spotxchange.com/ Frame 9A88
Redirect Chain

https://um.simpli.fi/spotx_match
https://sync.search.spotxchange.com/partner?adv_id=7797&uid=89A587D6428942BFB7DBA431CAFC20D7

43 B
419 B

50ms
27ms

Image
image/gif

192.35.249.137
SPOTX-IAD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7797&uid=89A587D6428942BFB7DBA431CAFC20D7
Requested by: Host: westads.simpli.fi
URL: https://westads.simpli.fi/ads/3592432/32612348/ad.html?sifi=8608,3592432,32612348,105306032504518,2,0,0,0,0,265,1,v,17.29000,1.330000,0,0,1,7,4D94309430964F1EAB559A6C8B7C142E,0,0,0,1210,400,1,0,0,604,0,701,bidder-base-prd-us-west1-b-931cfe3b:9011-1690461480256-548580438,1,2,395291,2,0,29,12,06479,0,0.00,0,0,95808134,0,0,0,1,-4,0,98,,0,337460,0,0,3,-1,156872,-1,-1,4840792&sifi_exchange_uid=380BD354-7A30-4632-8168-9BF044560A9A&request_id=30D83054-42A6-4F67-B3A2-87F6E3E62738
Protocol: H2
Server: 192.35.249.137 Ashburn, United States, ASN11742 (SPOTX-IAD, US),
Reverse DNS
Software: /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:01 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: false
x-fe: 424
content-length: 43

Redirect headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://sync.search.spotxchange.com/partner?adv_id=7797&uid=89A587D6428942BFB7DBA431CAFC20D7
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 26 Jul 2023 12:38:01 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 9A88
Redirect Chain

https://um.simpli.fi/an
https://ib.adnxs.com/setuid?entity=66&code=89A587D6428942BFB7DBA431CAFC20D7

43 B
991 B

90ms
67ms

Image
image/gif

68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=66&code=89A587D6428942BFB7DBA431CAFC20D7

Requested by

Protocol

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

96.170.150.34.bc.googleusercontent.com

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
an-x-request-uuid: 8df971bc-b7ca-40c6-9754-2b675d000890
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://ib.adnxs.com/setuid?entity=66&code=89A587D6428942BFB7DBA431CAFC20D7
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 26 Jul 2023 12:38:01 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 9A88
Redirect Chain

https://um.simpli.fi/rb_match
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=89A587D6428942BFB7DBA431CAFC20D7&expires=365

42 B
723 B

180ms
160ms

Image
image/gif

8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=89A587D6428942BFB7DBA431CAFC20D7&expires=365
Requested by: Host: westads.simpli.fi
URL: https://westads.simpli.fi/ads/3592432/32612348/ad.html?sifi=8608,3592432,32612348,105306032504518,2,0,0,0,0,265,1,v,17.29000,1.330000,0,0,1,7,4D94309430964F1EAB559A6C8B7C142E,0,0,0,1210,400,1,0,0,604,0,701,bidder-base-prd-us-west1-b-931cfe3b:9011-1690461480256-548580438,1,2,395291,2,0,29,12,06479,0,0.00,0,0,95808134,0,0,0,1,-4,0,98,,0,337460,0,0,3,-1,156872,-1,-1,4840792&sifi_exchange_uid=380BD354-7A30-4632-8168-9BF044560A9A&request_id=30D83054-42A6-4F67-B3A2-87F6E3E62738
Protocol: HTTP/1.1
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 8f31d5fb12ac7ec11f837ad8263e0f6c
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=89A587D6428942BFB7DBA431CAFC20D7&expires=365
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 26 Jul 2023 12:38:01 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 9A88
Redirect Chain

https://um.simpli.fi/ox_match
https://us-u.openx.net/w/1.0/sd?id=537072966&val=89A587D6428942BFB7DBA431CAFC20D7

43 B
61 B

77ms
56ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072966&val=89A587D6428942BFB7DBA431CAFC20D7
Requested by: Host: westads.simpli.fi
URL: https://westads.simpli.fi/ads/3592432/32612348/ad.html?sifi=8608,3592432,32612348,105306032504518,2,0,0,0,0,265,1,v,17.29000,1.330000,0,0,1,7,4D94309430964F1EAB559A6C8B7C142E,0,0,0,1210,400,1,0,0,604,0,701,bidder-base-prd-us-west1-b-931cfe3b:9011-1690461480256-548580438,1,2,395291,2,0,29,12,06479,0,0.00,0,0,95808134,0,0,0,1,-4,0,98,,0,337460,0,0,3,-1,156872,-1,-1,4840792&sifi_exchange_uid=380BD354-7A30-4632-8168-9BF044560A9A&request_id=30D83054-42A6-4F67-B3A2-87F6E3E62738
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://us-u.openx.net/w/1.0/sd?id=537072966&val=89A587D6428942BFB7DBA431CAFC20D7
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 26 Jul 2023 12:38:01 GMT

GET
H2

204

g_match
um.simpli.fi/ Frame 9A88
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc
https://um.simpli.fi/g_match?id=&google_gid=CAESEBV50gu7I4TisD09DSaWoME&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=89A587D6428942BFB7DBA431CAFC20D7
https://um.simpli.fi/g_match?id=

0
320 B

16ms
15ms

Image
text/plain

34.150.170.96
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/g_match?id=

Requested by

Protocol

Server

34.150.170.96 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:01 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Wed, 26 Jul 2023 12:38:01 GMT

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:01 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://um.simpli.fi/g_match?id=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 229
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dcl.htm Show response
rt3044.infolinks.com/action/ 0
60 B 87ms
86ms Script
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3044.infolinks.com/action/dcl.htm?rid=cece8cb3-4b63-4322-819e-e0595816a52f&prod_t=u&sdata=logo&bdc=1&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1870.002-3.027.ab.1874.021-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:02 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 7ed4efe90aac4388-EWR
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame C6C8 3 KB
4 KB 10ms
9ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=7807758&p=156423&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 97bb686ce75d67a25b494fe6be137f924578890076a236acd0cc0fa0f52e8029

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Thu, 27 Jul 2023 12:38:02 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 1110 0
128 B 6ms
5ms Script
text/plain 162.248.18.34
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:02 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame C6C8 573 B
890 B 16ms
15ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=21352157&p=156423&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: c3bacd61f33d0c6a68bd8e183406237d93d473694cd5178c6d65775484ce4bf8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 27 Jul 2023 12:38:01 GMT
content-length: 573
content-type: text/html; charset=UTF-8

GET
H/1.1

200
OK

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame B06F
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=fae7c20a-ef77-4ef9-8ceb-dead188285af&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=80101931-A35F-4E27-9F09-B0912A7ADA85

42 B
513 B

11ms
10ms

Document
image/gif

18.214.189.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=80101931-A35F-4E27-9F09-B0912A7ADA85
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.214.189.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-189-251.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: keep-alive
Content-Length: 42
Content-Type: image/gif
Date: Thu, 27 Jul 2023 12:38:02 GMT
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 27 Jul 2023 12:38:01 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=80101931-A35F-4E27-9F09-B0912A7ADA85
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2 200 i.match Show response
a.tribalfusion.com/ Frame B900 43 B
462 B 84ms
82ms Document
image/gif 2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 7ed4efe978b94401-EWR
content-length: 43
content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 12:38:02 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 302

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 3DBF
Redirect Chain

https://ums.acuityplatform.com/tum?umid=6
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=805522953287

42 B
288 B

39ms
34ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=805522953287
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 09:06:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Content-Length: 0
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=805522953287

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 5412
Redirect Chain

https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}
https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}

0
74 B

13ms
13ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 27 Jul 2023 12:38:02 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
date: Thu, 27 Jul 2023 12:38:02 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
server: _

GET sync
t.adx.opera.com/pub/ Frame D563 0
0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame B6ED
Redirect Chain

https://ad.mrtnsvr.com/sync/pubmatic?gdpr=0&gdpr_consent=
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw%26piggybackCookie%3D%23PM_USER_ID%26gdpr...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=80101931-A35F-4E27-9F09-B0912A7ADA85&gdpr=0&gdpr_consent=

42 B
397 B

40ms
36ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=80101931-A35F-4E27-9F09-B0912A7ADA85&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 12:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 26 Jul 2023 22:15:40 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=80101931-A35F-4E27-9F09-B0912A7ADA85&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame F2BC
Redirect Chain

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F1508%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=3136719449
https://sync.1rx.io/usersync3/mediamathtest/1508/3b9a64c2-652a-4800-acf8-6f5b3d76eee9?zcc=0&sspret=1
https://sync.targeting.unrulymedia.com/csync/RX-14723f11-90d9-492f-9cc4-e7bb3476cf9c-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-14723f11-90d9-492f-9cc4-e7bb3476cf9c-005

42 B
333 B

14ms
13ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-14723f11-90d9-492f-9cc4-e7bb3476cf9c-005
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 09:06:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Type: text/html
Date: Thu, 27 Jul 2023 12:38:02 GMT
ETag: RX14723f1190d9492f9cc4e7bb3476cf9c005
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-14723f11-90d9-492f-9cc4-e7bb3476cf9c-005
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Server: Tengine
Transfer-Encoding: chunked

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame DEF1
Redirect Chain

https://gocm.c.appier.net/pubmatic
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=CcOQI33tCS-D1DG3K2XCZA

42 B
279 B

6ms
5ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=CcOQI33tCS-D1DG3K2XCZA
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 12:38:03 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
cache-control: no-store
content-length: 153
content-type: text/html; charset=utf-8
date: Thu, 27 Jul 2023 12:38:03 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=CcOQI33tCS-D1DG3K2XCZA
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: nginx

GET
H2 200 cm Show response
ipac.ctnsnet.com/int/ Frame ED84 43 B
360 B 84ms
31ms Document
image/gif 35.186.193.173
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.193.173 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 173.193.186.35.bc.googleusercontent.com
Software: Apache-Coyote/1.1 /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 43
content-type: image/gif
date: Thu, 27 Jul 2023 12:38:01 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="NOI DSP COR NID CUR OUR NOR"
pragma: no-cache
server: Apache-Coyote/1.1
via: 1.1 google

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame F59D
Redirect Chain

https://mweb.ck.inmobi.com/sync/15?redirect=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA%3D%3D%26piggybackCookie%3D%24DSP_CKID
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=27d5eac3-3ca0-462c-9328-469bd0bdd695

1 B
72 B

5ms
4ms

Document
text/html

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=27d5eac3-3ca0-462c-9328-469bd0bdd695
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Thu, 27 Jul 2023 12:38:01 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
date: Thu, 27 Jul 2023 12:38:02 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=27d5eac3-3ca0-462c-9328-469bd0bdd695
strict-transport-security: max-age=15724800; includeSubDomains

GET
H/1.1 204
No Content pub
matching.truffle.bid/sync/ Frame BE05 0
0 546ms
97ms Document
text/plain 162.55.120.196
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://matching.truffle.bid/sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

162.55.120.196 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.196.120.55.162.clients.your-server.de

Software

nginx/1.23.3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: keep-alive
Date: Thu, 27 Jul 2023 12:38:02 GMT
Server: nginx/1.23.3
Strict-Transport-Security: max-age=15768000

GET
H/1.1 200
OK cookiesync Show response
core.iprom.net/ Frame B248 43 B
281 B 674ms
116ms Document
image/gif 195.5.165.20
IPROM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.5.165.20 , Slovenia, ASN44968 (IPROM-AS, SI),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: close
Content-Length: 43
Content-Type: image/gif
Date: Thu, 27 Jul 2023 12:38:03 GMT
Vary: Accept-Encoding
X-adserver-worker: ragnarok-24d3323f77b2@version_1.564v2
X-core-time: 1ms
X-server-arch: v2

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 7ED5
Redirect Chain

https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID
https://px.owneriq.net/ecc?redir=https%3a%2f%2fsimage2.pubmatic.com%2fAdServer%2fPug%3fvcode%3dbz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw%26piggybackCookie%3dQ7437478822074539811&uid=Q743747882207453...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7437478822074539811

42 B
113 B

10ms
10ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7437478822074539811
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 09:10:46 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: max-age=32678
Connection: keep-alive
Content-Length: 154
Content-Type: text/html
Date: Thu, 27 Jul 2023 12:38:02 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7437478822074539811
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: Apache/2.4.6 (CentOS)
Vary: Accept-Encoding
X-Powered-By: PHP/7.3.33

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 9305
Redirect Chain

https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:89A587D6428942BFB7DBA431CAFC20D7&gdpr=0&gdpr_consent=

1 B
53 B

10ms
9ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:89A587D6428942BFB7DBA431CAFC20D7&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Thu, 27 Jul 2023 09:11:06 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-length: 142
content-type: text/html
date: Thu, 27 Jul 2023 12:38:02 GMT
expires: Wed, 26 Jul 2023 12:38:02 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:89A587D6428942BFB7DBA431CAFC20D7&gdpr=0&gdpr_consent=
server: openresty
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff

GET
H3 200 match Show response
events-ssc.33across.com/ Frame EFEA 68 B
82 B 20ms
15ms Document
image/png 34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=25&external_user_id=80101931-A35F-4E27-9F09-B0912A7ADA85
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png
date: Thu, 27 Jul 2023 12:38:02 GMT
via: 1.1 google

GET
H3

200

362588.gif
idsync.rlcdn.com/ Frame C6C8
Redirect Chain

https://idsync.rlcdn.com/712188.gif?partner_uid=80101931-A35F-4E27-9F09-B0912A7ADA85&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveramp&ttd_tpi=1
https://idsync.rlcdn.com/362588.gif?partner_uid=a7485659-1d87-4413-a256-0b6bba4fa732

42 B
60 B

67ms
67ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362588.gif?partner_uid=a7485659-1d87-4413-a256-0b6bba4fa732
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:02 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:02 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://idsync.rlcdn.com/362588.gif?partner_uid=a7485659-1d87-4413-a256-0b6bba4fa732
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 199

GET
H2 200 gdpr_consent=
bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=80101931-A35F-4E27-9F09-B0912A7ADA85/gdpr=0/ Frame C6C8 49 B
264 B 24ms
21ms Image
image/gif 54.160.214.90
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=80101931-A35F-4E27-9F09-B0912A7ADA85/gdpr=0/gdpr_consent=
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.160.214.90 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-160-214-90.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:02 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.6.66
content-length: 49
expires: 0

GET
H3 200 receive
pixel.tapad.com/idsync/ex/ Frame C6C8 95 B
123 B 28ms
26ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=80101931-A35F-4E27-9F09-B0912A7ADA85&gdpr=0&gdpr_consent=

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

server-108-139-47-31.jfk50.r.cloudfront.net

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:02 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

GET
H2 200 /
bpi.rtactivate.com/tag/ Frame C6C8 43 B
109 B 134ms
73ms Image
image/gif 54.147.253.182
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bpi.rtactivate.com/tag/?id=20909&user_id=80101931-A35F-4E27-9F09-B0912A7ADA85&gdpr=0&gdpr_consent=
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.147.253.182 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-147-253-182.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:02 GMT
server: awselb/2.0
content-length: 43
content-type: image/gif

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame C6C8
Redirect Chain

https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=7437480408642019502

42 B
95 B

10ms
9ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=7437480408642019502
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 12:38:01 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:02 GMT
an-x-request-uuid: 7ac8b0e2-fba6-457a-824d-33b7e07790fd
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=7437480408642019502
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame C6C8
Redirect Chain

https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:a822a560-eaec-4da1-b13a-2d20eea8cedc&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw

42 B
95 B

11ms
10ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:a822a560-eaec-4da1-b13a-2d20eea8cedc&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 27 Jul 2023 12:38:03 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:a822a560-eaec-4da1-b13a-2d20eea8cedc&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date: Thu, 27 Jul 2023 12:38:03 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=3000
Content-Length: 0
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"

GET
H3 200 match Show response
events-ssc.33across.com/ Frame 6AC2 68 B
82 B 13ms
12ms Document
image/png 34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=25&external_user_id=80101931-A35F-4E27-9F09-B0912A7ADA85
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png
date: Thu, 27 Jul 2023 12:38:02 GMT
via: 1.1 google

GET
H/1.1

200
OK

75145
i6.liadm.com/s/ Frame C6C8
Redirect Chain

https://i.liadm.com/s/75145?bidder_id=195755&bidder_uuid=80101931-A35F-4E27-9F09-B0912A7ADA85
https://i.liadm.com/s/75145?bidder_id=195755&bidder_uuid=80101931-A35F-4E27-9F09-B0912A7ADA85&_li_chk=true&previous_uuid=cb5ed20b56254178bb3592e14b33e4cf
https://i6.liadm.com/s/75145?bidder_id=195755&bidder_uuid=80101931-A35F-4E27-9F09-B0912A7ADA85

43 B
548 B

297ms
10ms

Image
image/gif

2600:1f18:ed:550e:f2f8:700c:3f9d:9b30
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i6.liadm.com/s/75145?bidder_id=195755&bidder_uuid=80101931-A35F-4E27-9F09-B0912A7ADA85

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

HTTP/1.1

Server

2600:1f18:ed:550e:f2f8:700c:3f9d:9b30 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Thu, 27 Jul 2023 12:38:02 GMT
Cache-Control: no-store
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 43
Request-Time: 1
Content-Type: image/gif

Redirect headers

Location: https://i6.liadm.com/s/75145?bidder_id=195755&bidder_uuid=80101931-A35F-4E27-9F09-B0912A7ADA85
Date: Thu, 27 Jul 2023 12:38:02 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 0
Request-Time: 2

GET
H2 200 qmap
sync.crwdcntrl.net/ Frame C6C8 49 B
264 B 51ms
49ms Image
image/gif 54.160.214.90
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=80101931-A35F-4E27-9F09-B0912A7ADA85&gdpr=0&gdpr_consent=
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.160.214.90 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-160-214-90.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:02 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.46.87
content-length: 49
expires: 0

GET
H/1.1

204
No Content

/
io.narrative.io/ Frame C6C8
Redirect Chain

https://io.narrative.io/?companyId=673&id=pubmatic_id:80101931-A35F-4E27-9F09-B0912A7ADA85
https://io.narrative.io/?io.narrative.guid.v2=6d4c1900-2c7a-11ee-a591-0a3986670f6f&companyId=673&id=pubmatic_id:80101931-A35F-4E27-9F09-B0912A7ADA85

0
247 B

12ms
10ms

Image
text/plain

52.6.135.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://io.narrative.io/?io.narrative.guid.v2=6d4c1900-2c7a-11ee-a591-0a3986670f6f&companyId=673&id=pubmatic_id:80101931-A35F-4E27-9F09-B0912A7ADA85
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: HTTP/1.1
Server: 52.6.135.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-6-135-202.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Thu, 27 Jul 2023 12:38:02 GMT
Cache-Control: no-cache
Server: nginx/1.22.1
Connection: keep-alive

Redirect headers

Location: https://io.narrative.io/?io.narrative.guid.v2=6d4c1900-2c7a-11ee-a591-0a3986670f6f&companyId=673&id=pubmatic_id:80101931-A35F-4E27-9F09-B0912A7ADA85
Date: Thu, 27 Jul 2023 12:38:02 GMT
Server: nginx/1.22.1
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200

p
a.audrte.com/ Frame C6C8
Redirect Chain

https://a.audrte.com/match?gdpr=0&gdpr_consent=&p=M1717054901&uid=80101931-A35F-4E27-9F09-B0912A7ADA85
https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=YTZjWG95RUNrb2xUWktwUnVwSXZ1WnJRdw==&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL...
https://a.audrte.com/ddp?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%3D%3D&gdpr=0&gdpr_consent=
https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent=
https://a.audrte.com/a?adform_uid=6606311347755805104&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D
https://a.audrte.com/p

68 B
424 B

11ms
10ms

Image
image/png

52.206.89.97
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.audrte.com/p
Requested by: Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/
Protocol: HTTP/1.1
Server: 52.206.89.97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-89-97.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Thu, 27 Jul 2023 12:38:02 GMT
Server: nginx/1.22.1
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 68

Redirect headers

Date: Thu, 27 Jul 2023 12:38:02 GMT
Server: nginx/1.22.1
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Allow-Origin: *
Location: https://a.audrte.com:443/p
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H3 200 metrichpe_701_normal.ttf
s0.2mdn.net/sadbundle/15571588451724435493/fonts/ Frame 03E9 60 KB
26 KB 5ms
5ms Font
font/ttf 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/fonts/metrichpe_701_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e88f4c0915dc02c509e93e39a70d9cd6ac80e9adb85fc1184f73f39d577ec533

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 11:33:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 522250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26441
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 20 Jul 2024 11:33:53 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 03E9 725 B
374 B 41ms
41ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:700

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1ef4cbeeeeb11bf689c56bf1a96f0d51bd084aee65c3c247e099b85f088aa9d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 27 Jul 2023 12:38:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 27 Jul 2023 12:37:30 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 27 Jul 2023 12:38:03 GMT

GET
H3 200 0391cb9c0ee8d59aaa5843797f816a93.jpg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 03E9 17 KB
17 KB 5ms
5ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/0391cb9c0ee8d59aaa5843797f816a93.jpg

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

27c835092c21e796e6c2c6796e5ab31a00d145db2c945a0041ff64784478117e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 04:10:06 GMT
x-content-type-options: nosniff
age: 116877
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17568
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Jul 2024 04:10:06 GMT

GET
H3 200 1d9f4002ef8e82ce3e61acbf8b35484b.jpg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 03E9 3 KB
3 KB 6ms
5ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/1d9f4002ef8e82ce3e61acbf8b35484b.jpg

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1be230e4656ba1ea5edb0a25160be1892bc99aaa6c947ae8aa1dced8d9406df0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 22 Jul 2023 15:01:12 GMT
x-content-type-options: nosniff
age: 423411
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2705
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Jul 2024 15:01:12 GMT

GET
H3 200 392a0477659a898064e1464a59d9eef7.jpg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 03E9 9 KB
9 KB 7ms
4ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/392a0477659a898064e1464a59d9eef7.jpg

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6cd0adebefba93e1bdd96840ac268fa31c646e64f1581113a75f7e9530b6c19d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 24 Jul 2023 09:16:52 GMT
x-content-type-options: nosniff
age: 271271
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9135
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 23 Jul 2024 09:16:52 GMT

GET
H3 200 409f667579a3c0ab7819a840cd41bc58.svg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 03E9 258 B
262 B 12ms
8ms Image
image/svg+xml 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/409f667579a3c0ab7819a840cd41bc58.svg

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

308e9d764fa59dc2cd4f72128c8e247cebb14c630491107f2539af6066183691

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 10:58:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 524385
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 223
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 20 Jul 2024 10:58:18 GMT

GET
H3 200 bf92c8be83eeb2dbf186eb1436ebcb5e.svg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 03E9 4 KB
2 KB 10ms
7ms Image
image/svg+xml 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/bf92c8be83eeb2dbf186eb1436ebcb5e.svg

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6648009549b81e81582f3fb8345dd6305ee4a232fd4eac4fd803a78cb69b0c1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 04:10:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 116877
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1630
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Jul 2024 04:10:06 GMT

GET
H3 200 3da15c1a1519d4142b61be4acb2551ca.jpg
s0.2mdn.net/sadbundle/5357816647124024566/media/ Frame 2069 20 KB
20 KB 6ms
4ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/media/3da15c1a1519d4142b61be4acb2551ca.jpg

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

59b122193996b704d97e25c4b10369a2c0e7c514dbef92ad01fafc8412f483dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 10:00:50 GMT
x-content-type-options: nosniff
age: 9433
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20743
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jul 2024 10:00:50 GMT

GET
H3 200 713b56ab02d7a1b47d67f0170e6ca33d.jpg
s0.2mdn.net/sadbundle/5357816647124024566/media/ Frame 2069 2 KB
2 KB 10ms
8ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/media/713b56ab02d7a1b47d67f0170e6ca33d.jpg

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9b98176cef1e3c0a7203c7dfcc22df4abec1e26a60b1f9a5cda4f225a29c2bb1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 04:01:43 GMT
x-content-type-options: nosniff
age: 30980
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2243
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jul 2024 04:01:43 GMT

GET
H3 200 bf92c8be83eeb2dbf186eb1436ebcb5e.svg
s0.2mdn.net/sadbundle/5357816647124024566/media/ Frame 2069 4 KB
2 KB 6ms
5ms Image
image/svg+xml 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/media/bf92c8be83eeb2dbf186eb1436ebcb5e.svg

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6648009549b81e81582f3fb8345dd6305ee4a232fd4eac4fd803a78cb69b0c1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 13:33:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 169448
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1630
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 24 Jul 2024 13:33:55 GMT

GET
H3 200 11057194a9bbe8826571a85e99be407f.png
s0.2mdn.net/sadbundle/5357816647124024566/media/ Frame 2069 5 KB
5 KB 10ms
9ms Image
image/png 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/media/11057194a9bbe8826571a85e99be407f.png

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c9c3aeccdcf411d0a1a0d364c6886c99e3564b7de620a918903f3a2d1e03f3f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 17:12:43 GMT
x-content-type-options: nosniff
age: 69920
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5169
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Jul 2024 17:12:43 GMT

GET
H3 200 e84a1251f37f03e41b20cdcf8eb09578.png
s0.2mdn.net/sadbundle/5357816647124024566/media/ Frame 2069 6 KB
6 KB 9ms
7ms Image
image/png 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/media/e84a1251f37f03e41b20cdcf8eb09578.png

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89ede2094377d0770d1654fe24c0f9d2a32e9b90928aad6c279cdaa8f4d0316a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 22 Jul 2023 04:45:15 GMT
x-content-type-options: nosniff
age: 460368
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5966
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Jul 2024 04:45:15 GMT

GET
H3 200 1d9f4002ef8e82ce3e61acbf8b35484b.jpg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 71B3 3 KB
3 KB 5ms
4ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/1d9f4002ef8e82ce3e61acbf8b35484b.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1be230e4656ba1ea5edb0a25160be1892bc99aaa6c947ae8aa1dced8d9406df0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 22 Jul 2023 15:01:12 GMT
x-content-type-options: nosniff
age: 423411
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2705
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Jul 2024 15:01:12 GMT

GET
H3 200 392a0477659a898064e1464a59d9eef7.jpg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 71B3 9 KB
9 KB 6ms
4ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/392a0477659a898064e1464a59d9eef7.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6cd0adebefba93e1bdd96840ac268fa31c646e64f1581113a75f7e9530b6c19d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 24 Jul 2023 09:16:52 GMT
x-content-type-options: nosniff
age: 271271
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9135
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 23 Jul 2024 09:16:52 GMT

GET
H3 200 metrichpe_701_normal.ttf
s0.2mdn.net/sadbundle/15571588451724435493/fonts/ Frame 71B3 60 KB
26 KB 6ms
5ms Font
font/ttf 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/fonts/metrichpe_701_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e88f4c0915dc02c509e93e39a70d9cd6ac80e9adb85fc1184f73f39d577ec533

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 11:33:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 522250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26441
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 20 Jul 2024 11:33:53 GMT

GET
H3 200 409f667579a3c0ab7819a840cd41bc58.svg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 71B3 258 B
262 B 8ms
6ms Image
image/svg+xml 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/409f667579a3c0ab7819a840cd41bc58.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

308e9d764fa59dc2cd4f72128c8e247cebb14c630491107f2539af6066183691

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 10:58:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 524385
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 223
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 20 Jul 2024 10:58:18 GMT

GET
H3 200 bf92c8be83eeb2dbf186eb1436ebcb5e.svg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 71B3 4 KB
2 KB 8ms
7ms Image
image/svg+xml 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/bf92c8be83eeb2dbf186eb1436ebcb5e.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6648009549b81e81582f3fb8345dd6305ee4a232fd4eac4fd803a78cb69b0c1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 04:10:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 116877
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1630
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Jul 2024 04:10:06 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 71B3 725 B
374 B 37ms
35ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:700

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15571588451724435493/b777f40a1f5bc4fa77d2fe7d2ff3bfa8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1ef4cbeeeeb11bf689c56bf1a96f0d51bd084aee65c3c247e099b85f088aa9d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 27 Jul 2023 12:38:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 27 Jul 2023 10:59:47 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 27 Jul 2023 12:38:03 GMT

GET
H3 200 0391cb9c0ee8d59aaa5843797f816a93.jpg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 71B3 17 KB
17 KB 7ms
4ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/0391cb9c0ee8d59aaa5843797f816a93.jpg

Requested by

Host: ehfmc-com.ngontinh24.com
URL: https://ehfmc-com.ngontinh24.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

27c835092c21e796e6c2c6796e5ab31a00d145db2c945a0041ff64784478117e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 04:10:06 GMT
x-content-type-options: nosniff
age: 116877
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17568
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Jul 2024 04:10:06 GMT

GET
H3 200 mmt.gif
imps.monu.delivery/ 37 B
63 B 6ms
5ms Image
image/gif 35.186.236.140
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imps.monu.delivery/mmt.gif?s=fd6252cc-2263-4692-8f56-3f75ffaf0701&a=p.l&u=fdd82422-8575-448e-84fe-fa092518ca2d
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.236.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.236.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2e4d08754839510a3d77ddf8205a515e51e4277c323932b10441196744ce757

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 02:10:33 GMT
age: 124050
x-guploader-uploadid: ADPycdtfTH7AOMIL8vASnI2SAUKO57hiMqR3KrgVyd3_EGuyzarfJLPV8txIzxbrXqaVDP4d4uU8hlF5HkVIIEB2LY4pnYBd5XPi
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
last-modified: Wed, 12 Jul 2017 09:13:19 GMT
server: UploadServer
etag: "455005e2f4b8ecc484500fab08619f70"
x-goog-generation: 1499850799559224
x-goog-hash: crc32c=1zd0wQ==, md5=RVAF4vS47MSEUA+rCGGfcA==
content-type: image/gif
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37
accept-ranges: bytes
expires: Thu, 25 Jul 2024 02:10:33 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
12 KB 53ms
53ms XHR
application/json 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230725&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202307200101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3887f227902fa4229864bae502f7487bad6f525e30dbd65b85243c37c82b7a08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:03 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11794
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 93ms
89ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202307200101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 27 Jul 2023 12:38:03 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 0C1B 13 KB
5 KB 14ms
12ms Document
text/html 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 58102
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:29:41 GMT
expires: Thu, 25 Jul 2024 20:29:41 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 3816 783 B
537 B 41ms
40ms Document
text/html 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

82a95a5aa6a11300c6f2fe00414c79ea6cf0a1cfe3543cbea8e4ef6e132cd1a1

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-41T_tF6kNPnGLBU_YAHNZQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ehfmc-com.ngontinh24.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 515
content-security-policy: script-src 'report-sample' 'nonce-41T_tF6kNPnGLBU_YAHNZQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 12:38:03 GMT
expires: Thu, 27 Jul 2023 12:38:03 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js Show response
pagead2.googlesyndication.com/bg/ Frame 0C1B 37 KB
14 KB 13ms
12ms Script
text/javascript 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XE-eSxg4gZ8v28buoH5xKIZwH3Gkn_IqRFqb49XH2AY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4f9e4b1838819f2fdbc6eea07e712886701f71a49ff22a445a9be3d5c7d806

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:38:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57585
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14628
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jul 2024 20:38:18 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 3816 0
0 44ms
41ms Image
text/html 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230725&jk=493766145868713&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 0C1B 0
12 B 12ms
11ms Image
text/plain 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?V0cbyg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:04 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 ctrack
track1.avplayer.com/ 0
97 B 12ms
12ms Image
text/plain 35.169.83.220
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.avplayer.com/ctrack?pt=2&d66=8.2.12&stagid=&stplid=&pid=632d59d7b9689f25ad20b012&cid=633172fb22e9a25a4645a127&r=ehfmc-com.ngontinh24.com&sn=&cd1=&cd2=&cd3=&app=&test=&cb=1690461484193&e=cfqt&cvid=&cpid=&str=autostart&vi=100&wi=300&he=250
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.83.220 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-83-220.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:04 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 ca Show response
choices.trustarc.com/ Frame 9A88 6 KB
3 KB 52ms
18ms Script
text/javascript 108.139.47.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.trustarc.com/ca?aid=simplifi01&pid=simplifi01&cid=0611sf728x90&w=728&h=90&c=cont1&js=pmw1&base=te-clr1-66f656cb-c57c-4603-87c1-72d493ae3387&plc=tr&sid=7BFq-tseoZb_N8y1CeH8CJ6lD4BRzEOb5nYWHrpoKi0ghJk1yGLRXc7uF8yXWhKlDqO6rAE6GjYVAhgl24X3hgE4lzetM9YxYgkOcPK4QVpuAJnMHpF4ZZtbNNG0CXIbUbeLJL079RL7NmLvK6WI9A8XoY5YQvLPfB0XBkBUYwE

Requested by

Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=simplifi01&aid=simplifi01&cid=0611sf728x90&c=cont1&w=728&h=90&js=pmw0&plc=tr&sid=7BFq-tseoZb_N8y1CeH8CJ6lD4BRzEOb5nYWHrpoKi0ghJk1yGLRXc7uF8yXWhKlDqO6rAE6GjYVAhgl24X3hgE4lzetM9YxYgkOcPK4QVpuAJnMHpF4ZZtbNNG0CXIbUbeLJL079RL7NmLvK6WI9A8XoY5YQvLPfB0XBkBUYwE

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.139.47.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

4e157c3cc4de45ccacddb6044da48372c0d926aace19604132ffc6d8530a599c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 3d84bfab616d594edc9340870455ee6a.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: JFK50-P1
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 2242
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: k7jye3Dp7cgkIYJxFRcLj3w7vjDZEx4aALln-ZA_HS6Vo5Jrtgg5Yw==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ Frame 9A88 38 KB
12 KB 39ms
5ms Script
text/javascript 108.139.47.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.trustarc.com/ca?aid=simplifi01&pid=simplifi01&cid=0611sf728x90&w=728&h=90&c=cont1&js=pmw2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.139.47.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-139-47-31.jfk50.r.cloudfront.net

Software

nginx /

Resource Hash

e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 06:24:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 3d84bfab616d594edc9340870455ee6a.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: JFK50-P1
cross-origin-embedder-policy: unsafe-none
age: 22396
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: aFTMrcDK08bdIUpyFh0vTR5yzn-h6ej-l94DaJmCDqAH3cULrncgFg==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 cap
choices.trustarc.com/ Frame 9A88 43 B
1020 B 64ms
31ms Image
image/gif 108.139.47.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://choices.trustarc.com/cap?aid=simplifi01&pid=simplifi01&cid=0611sf728x90&w=728&h=90&c=79ea

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.139.47.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-139-47-31.jfk50.r.cloudfront.net

Software

nginx /

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
via: 1.1 3d84bfab616d594edc9340870455ee6a.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P1
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Origin
content-type: image/gif
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: ylBJ_w0wPr0EIAFgGOKr0duq3eAdGLQ2VoJLbYKp3o7T74dSgzmamw==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 get
choices.trustarc.com/ Frame 9A88 457 B
799 B 4ms
4ms Image
image/png 108.139.47.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/get?name=admarkermobile-icon-tr.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.47.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-47-31.jfk50.r.cloudfront.net
Software: nginx /
Resource Hash: 896761f91fce50ed2987f615631341a0ddeddf1354292e7cb8b3649f428bc12c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://westads.simpli.fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: public
date: Mon, 17 Jul 2023 11:14:53 GMT
via: 1.1 3d84bfab616d594edc9340870455ee6a.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: JFK50-P1
age: 868991
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
content-length: 457
x-amz-cf-id: jHNjcC6bK7jwPb1_sIMdcV40r-SMP9o73vJjsYmPg8ILGOKPVZhMyQ==
expires: Wed, 16 Aug 2023 11:14:53 GMT

GET
H2 200 get
choices.trustarc.com/ Frame D8B6 457 B
797 B 5ms
4ms Image
image/png 108.139.47.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/get?name=admarkermobile-icon-tr.png
Requested by: Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?aid=simplifi01&pid=simplifi01&cid=0611sf728x90&w=728&h=90&c=cont1&js=pmw2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.47.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-47-31.jfk50.r.cloudfront.net
Software: nginx /
Resource Hash: 896761f91fce50ed2987f615631341a0ddeddf1354292e7cb8b3649f428bc12c

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: public
date: Mon, 17 Jul 2023 11:14:53 GMT
via: 1.1 3d84bfab616d594edc9340870455ee6a.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: JFK50-P1
age: 868991
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
content-length: 457
x-amz-cf-id: ri0eXthh6Hh4KtSSG-skXUbastf4neWzG7KrRTNu6HDp4swqNIym-Q==
expires: Wed, 16 Aug 2023 11:14:53 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame C6C8 0
128 B 6ms
5ms Script
text/plain 162.248.18.34
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156423&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:03 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 44ms
44ms Image
text/html 2607:f8b0:4020:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230725&jk=493766145868713&bg=!6eql6r7NAAZGOVy5Zjk7ADkAdvg8WuLSOMa_uhYsH1JWiyL5_v14FRuSMM0_TdA0fH_Y4PksAjXik6elpKgKL7gspXSrkZ2UoQ8CAAABElIAAAAsaAEHCgBL2eUkMBzQh-lZ24h_Qa2oG48g6kBtPbzuUcrtoWUHRJ0pYqbQczhQxJnjUpD8ykAVnxXchjd8S047P28Al63TUpcss3bi8rNSUerKmQKxznWlxsXgDL1gfMmUScsERAytLhDcaPWxMd15lQ5RZ9fgQvgad-3vedyIEzskJZAqbWGOJ-GwqvMiDoD4m8efvz4brKTyo619_0o-bjP0hAgv5R_4StW80T3HjX-kokYe6GGNMiQxSkn2cdyiyF4z1sYBS1Dv2NwMAzVAvHMfE416Ie7yg9SOtuu-3U8ttZ3dxEjokOeGKLJHFHRakXQ-cS23cm2IefUgbtJ_SzE-l8enKzkLOKoXBmDVXYIrCYJcU7Z2b_6UUfIBviLJp31wXNMrOXjEohgpBsvWUU0HPQQdozdUpipHPglV1UDl8BWBMQWFvz5iNBIZdKZyOlyFbgv3FAjbL_Pn0wmQeb4LUo_bLfukYZVUQBT4iwr3VFL0YHr8OGFxlpyfd3fv2guGy-FftwkeuTXDORx3Qp-fPELpYDhk1k-hpyf11-IdA_UjMxbdDZ1XP8gPKshg-cqHhrv2vMg_Cok9j4kZznRCypBquIW6hXwdcu4QORife7Lz1aJTJAgda40NbZFN8s_hD2fBrP1EoEJmffX0UeW5FwwYDhbvjWZHcW0bfhCHNmmgA5i-lq_NlUPOI8N9TV6q7Y7rtV6T93S7rUeJaHmvqUXEo29wmzCuD4g0cLoZrT4eaYxM6XWxcp3-YWRZJKoHxB46e2wLwT-5KBovdTkvrnqxynYRYy7UBZUzN4xIeAjJE8htZCUV213JTGG0ykIVs2__gf4fVyYIy26LZD2U4WkE-luXM3TMREYrlX2_-TOv3RKjs1YaVO4KY4fEhE1YfS3DyCiXGivi8mo2kTc2mUwMRwT3lerCaiuNPpGGDESdEuj6oimtnm-3gh7am-IYiR4ynU_REdI7xgNXiqRe-P0IeJjJvEe6Xqjd3cVtQt57yCskeqzM1oskJtvz9CYTeH4
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:807::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 694A 42 B
69 B 22ms
22ms Image
image/gif 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7109864259348938&output=html&h=280&slotname=3925753591&adk=3855717033&adf=218695602&pi=t.ma~as.3925753591&w=409&fwrn=4&fwrnh=100&lmt=1690029259&rafmt=1&format=409x280&url=https%3A%2F%2Fehfmc-com.ngontinh24.com%2F&adtest=off&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1690461466971&bpp=2&bdt=496&idt=1680&shv=r20230725&mjsv=m202307200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D22ffb7263d467929-223b677800e30071%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MbTVMveBTjt9SrcqaF2Ej1YYVoi4A&gpic=UID%3D00000d1fcfc84ee8%3AT%3D1690461467%3ART%3D1690461467%3AS%3DALNI_MZrDzTCEgtqRQCmPNDluDab_Ih1wQ&prev_fmts=0x0%2C1200x280%2C771x280%2C771x280%2C771x280%2C409x280%2C409x280&nras=1&correlator=894438904501&frm=20&pv=1&ga_vid=1208395644.1690461467&ga_sid=1690461467&ga_hid=1796158581&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1030&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076340%2C31076409%2C31076448%2C31076481%2C44788442%2C44798157&oid=2&pvsid=493766145868713&tmod=252754843&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=8&uci=a!8&fsb=1&xpc=K99H5wVgQx&p=https%3A//ehfmc-com.ngontinh24.com&dtd=1689
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMIje6w2_OugAMVexSICR1MBwWIEAAYACC309NcQhMI67_O2vOugAMVrVfBCh0JSAaW;met=1;&timestamp=1690461485989;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame E44D 42 B
401 B 217ms
40ms Image
image/gif 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIje6w2_OugAMVexSICR1MBwWIEAAYACC309NcQhMI67_O2vOugAMVrVfBCh0JSAaW;met=1;&timestamp=1690461485989;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 1d9f4002ef8e82ce3e61acbf8b35484b.jpg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 03E9 3 KB
3 KB 6ms
5ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/1d9f4002ef8e82ce3e61acbf8b35484b.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1be230e4656ba1ea5edb0a25160be1892bc99aaa6c947ae8aa1dced8d9406df0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 22 Jul 2023 15:01:12 GMT
x-content-type-options: nosniff
age: 423415
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2705
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Jul 2024 15:01:12 GMT

GET
H3 200 392a0477659a898064e1464a59d9eef7.jpg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 03E9 9 KB
9 KB 7ms
6ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/392a0477659a898064e1464a59d9eef7.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6cd0adebefba93e1bdd96840ac268fa31c646e64f1581113a75f7e9530b6c19d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 24 Jul 2023 09:16:52 GMT
x-content-type-options: nosniff
age: 271275
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9135
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 23 Jul 2024 09:16:52 GMT

GET
H3 200 metrichpe_701_normal.ttf
s0.2mdn.net/sadbundle/5357816647124024566/fonts/ Frame 2069 60 KB
26 KB 4ms
4ms Font
font/ttf 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/fonts/metrichpe_701_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5357816647124024566/d5172966dc6f96ad0462b6e137d21b0e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e88f4c0915dc02c509e93e39a70d9cd6ac80e9adb85fc1184f73f39d577ec533

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 22 Jul 2023 18:53:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 409486
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26441
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Jul 2024 18:53:21 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 2069 725 B
374 B 35ms
35ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:700

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5357816647124024566/d5172966dc6f96ad0462b6e137d21b0e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1ef4cbeeeeb11bf689c56bf1a96f0d51bd084aee65c3c247e099b85f088aa9d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 27 Jul 2023 12:38:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 27 Jul 2023 11:36:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 27 Jul 2023 12:38:07 GMT

GET
H3 200 713b56ab02d7a1b47d67f0170e6ca33d.jpg
s0.2mdn.net/sadbundle/5357816647124024566/media/ Frame 2069 2 KB
2 KB 5ms
4ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/media/713b56ab02d7a1b47d67f0170e6ca33d.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9b98176cef1e3c0a7203c7dfcc22df4abec1e26a60b1f9a5cda4f225a29c2bb1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 04:01:43 GMT
x-content-type-options: nosniff
age: 30984
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2243
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jul 2024 04:01:43 GMT

GET
H3 200 11057194a9bbe8826571a85e99be407f.png
s0.2mdn.net/sadbundle/5357816647124024566/media/ Frame 2069 5 KB
5 KB 5ms
4ms Image
image/png 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/media/11057194a9bbe8826571a85e99be407f.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c9c3aeccdcf411d0a1a0d364c6886c99e3564b7de620a918903f3a2d1e03f3f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 17:12:43 GMT
x-content-type-options: nosniff
age: 69924
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5169
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Jul 2024 17:12:43 GMT

GET
H3 200 e84a1251f37f03e41b20cdcf8eb09578.png
s0.2mdn.net/sadbundle/5357816647124024566/media/ Frame 2069 6 KB
6 KB 5ms
5ms Image
image/png 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/media/e84a1251f37f03e41b20cdcf8eb09578.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89ede2094377d0770d1654fe24c0f9d2a32e9b90928aad6c279cdaa8f4d0316a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 22 Jul 2023 04:45:15 GMT
x-content-type-options: nosniff
age: 460372
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5966
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Jul 2024 04:45:15 GMT

GET
H3 200 409f667579a3c0ab7819a840cd41bc58.svg
s0.2mdn.net/sadbundle/5357816647124024566/media/ Frame 2069 258 B
262 B 4ms
4ms Image
image/svg+xml 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/media/409f667579a3c0ab7819a840cd41bc58.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

308e9d764fa59dc2cd4f72128c8e247cebb14c630491107f2539af6066183691

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 22 Jul 2023 15:00:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 423469
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 223
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Jul 2024 15:00:18 GMT

GET
H3 200 bf92c8be83eeb2dbf186eb1436ebcb5e.svg
s0.2mdn.net/sadbundle/5357816647124024566/media/ Frame 2069 4 KB
2 KB 5ms
3ms Image
image/svg+xml 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5357816647124024566/media/bf92c8be83eeb2dbf186eb1436ebcb5e.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6648009549b81e81582f3fb8345dd6305ee4a232fd4eac4fd803a78cb69b0c1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5357816647124024566/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 13:33:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 169452
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1630
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 22:19:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 24 Jul 2024 13:33:55 GMT

GET
H3 200 1d9f4002ef8e82ce3e61acbf8b35484b.jpg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 71B3 3 KB
3 KB 5ms
4ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/1d9f4002ef8e82ce3e61acbf8b35484b.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1be230e4656ba1ea5edb0a25160be1892bc99aaa6c947ae8aa1dced8d9406df0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 22 Jul 2023 15:01:12 GMT
x-content-type-options: nosniff
age: 423415
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2705
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Jul 2024 15:01:12 GMT

GET
H3 200 392a0477659a898064e1464a59d9eef7.jpg
s0.2mdn.net/sadbundle/15571588451724435493/media/ Frame 71B3 9 KB
9 KB 6ms
5ms Image
image/jpeg 2607:f8b0:4006:821::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15571588451724435493/media/392a0477659a898064e1464a59d9eef7.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2006 Stony Point, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6cd0adebefba93e1bdd96840ac268fa31c646e64f1581113a75f7e9530b6c19d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15571588451724435493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 24 Jul 2023 09:16:52 GMT
x-content-type-options: nosniff
age: 271275
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9135
x-xss-protection: 0
last-modified: Wed, 23 Nov 2022 15:55:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 23 Jul 2024 09:16:52 GMT

GET
H2 200 ctrack
track1.avplayer.com/ 0
97 B 10ms
10ms Image
text/plain 35.169.83.220
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.avplayer.com/ctrack?pt=2&d66=8.2.12&stagid=&stplid=&pid=632d59d7b9689f25ad20b012&cid=633172fb22e9a25a4645a127&r=ehfmc-com.ngontinh24.com&sn=&cd1=&cd2=&cd3=&app=&test=&cb=1690461487899&e=AVC_M1&cvid=&cpid=&str=autostart&vi=100&wi=300&he=250&sspt=9.588
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.83.220 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-83-220.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:07 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 dc_oe=ChMIjpDY3fOugAMVgBRoCB3z2Aj2EAAYACCHkf5aQhMIp6f-2_OugAMVEgNoCB0ccg-q;met=1;&timestamp=1690461488651;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame D8C1 42 B
107 B 45ms
44ms Image
image/gif 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIjpDY3fOugAMVgBRoCB3z2Aj2EAAYACCHkf5aQhMIp6f-2_OugAMVEgNoCB0ccg-q;met=1;&timestamp=1690461488651;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMI3ZfN3fOugAMVBQqICR013QmHEAAYACCu7p9XQhMIjoH_2_OugAMV6g9xCh3HCwEi;met=1;&timestamp=1690461489447;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame 0ED6 42 B
63 B 44ms
43ms Image
image/gif 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI3ZfN3fOugAMVBQqICR013QmHEAAYACCu7p9XQhMIjoH_2_OugAMV6g9xCh3HCwEi;met=1;&timestamp=1690461489447;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ctrack
track1.avplayer.com/ 0
97 B 17ms
17ms Image
text/plain 35.169.83.220
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.avplayer.com/ctrack?pt=2&d66=8.2.12&stagid=&stplid=&pid=632d59d7b9689f25ad20b012&cid=633172fb22e9a25a4645a127&r=ehfmc-com.ngontinh24.com&sn=&cd1=&cd2=&cd3=&app=&test=&cb=1690461489481&e=ctpl&cvid=&cpid=&str=autostart&vi=100&wi=300&he=250&cppt=10.242879
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.83.220 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-83-220.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ehfmc-com.ngontinh24.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 12:38:09 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H3 200 dc_oe=ChMIqfXv3fOugAMVUa2fCh3SWws8EAAYACCu7p9XQhMI3bX-2_OugAMVR6OfCh1LKwf1;met=1;&timestamp=1690461489718;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame 4269 42 B
63 B 43ms
42ms Image
image/gif 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIqfXv3fOugAMVUa2fCh3SWws8EAAYACCu7p9XQhMI3bX-2_OugAMVR6OfCh1LKwf1;met=1;&timestamp=1690461489718;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3902ecd1a19f8ae7731575707556af50.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 27 Jul 2023 12:38:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMI5Mnu3fOugAMVRdnICh2sHwdQEAAYACD8idJYQhMIuLb-2_OugAMVyaOfCh1l0wi6;met=1;&timestamp=1690461490514;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame 2E8C 42 B
63 B 44ms
44ms Image
image/gif 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI5Mnu3fOugAMVRdnICh2sHwdQEAAYACD8idJYQhMIuLb-2_OugAMVyaOfCh1l0wi6;met=1;&timestamp=1690461490514;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS