natutool.com Open in urlscan Pro
139.59.250.113 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://natutool.com/hack-ff-auto-headshot/
Submission: On June 28 via manual (June 28th 2022, 4:18:03 am UTC) from US — Scanned from IS

Summary HTTP 136 Redirects Links 17 Behaviour Indicators

Summary

This website contacted 21 IPs in 6 countries across 23 domains to perform 136 HTTP transactions. The main IP is 139.59.250.113, located in Singapore, Singapore and belongs to DIGITALOCEAN-ASN, US. The main domain is natutool.com.
TLS certificate: Issued by R3 on June 21st 2022. Valid for: 3 months.

This is the only time natutool.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
22	139.59.250.113 139.59.250.113	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
7	142.250.185.202 142.250.185.202	15169 (GOOGLE) (GOOGLE)
17	142.250.185.99 142.250.185.99	15169 (GOOGLE) (GOOGLE)
1	172.217.18.8 172.217.18.8	15169 (GOOGLE) (GOOGLE)
16	172.217.16.194 172.217.16.194	15169 (GOOGLE) (GOOGLE)
2	142.250.185.78 142.250.185.78	15169 (GOOGLE) (GOOGLE)
17	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
1	172.217.18.2 172.217.18.2	15169 (GOOGLE) (GOOGLE)
1	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
2	142.250.186.66 142.250.186.66	15169 (GOOGLE) (GOOGLE)
20	172.217.16.193 172.217.16.193	15169 (GOOGLE) (GOOGLE)
15	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
3 6	142.250.186.36 142.250.186.36	15169 (GOOGLE) (GOOGLE)
2	142.250.186.170 142.250.186.170	15169 (GOOGLE) (GOOGLE)
2 2	108.128.215.255 108.128.215.255	16509 (AMAZON-02) (AMAZON-02)
1 1	18.195.144.156 18.195.144.156	16509 (AMAZON-02) (AMAZON-02)
2 2	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
2 2	34.98.67.61 34.98.67.61	15169 (GOOGLE) (GOOGLE)
2	35.227.252.103 35.227.252.103	15169 (GOOGLE) (GOOGLE)
2 2	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
1	35.179.81.5 35.179.81.5	16509 (AMAZON-02) (AMAZON-02)
2	142.250.180.163 142.250.180.163	15169 (GOOGLE) (GOOGLE)
1	74.125.140.156 74.125.140.156	15169 (GOOGLE) (GOOGLE)
1 1	91.228.74.168 91.228.74.168	16509 (AMAZON-02) (AMAZON-02)
2 2	104.36.113.23 104.36.113.23	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	192.0.73.2 192.0.73.2	2635 (AUTOMATTIC) (AUTOMATTIC)
1 1	142.250.186.110 142.250.186.110	15169 (GOOGLE) (GOOGLE)
2	209.85.226.71 209.85.226.71	15169 (GOOGLE) (GOOGLE)
136	21

22 139.59.250.113 (Singapore, Singapore)

ASN14061 (DIGITALOCEAN-ASN, US)

natutool.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.250.185.202 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f10.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 142.250.185.99 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.8 (United States)

ASN15169 (GOOGLE, US)
PTR: fra02s19-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 172.217.16.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f194.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.78 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 142.250.185.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.ee	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.2 (United States)

ASN15169 (GOOGLE, US)
PTR: fra02s19-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

adservice.google.ee	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f2.1e100.net

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 172.217.16.193 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f1.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.186.36 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.170 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f10.1e100.net

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.128.215.255 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-108-128-215-255.eu-west-1.compute.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.195.144.156 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-144-156.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.174.68 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.67.61 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 61.67.98.34.bc.googleusercontent.com

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.227.252.103 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.144.138 (Frankfurt am Main, Germany) 2 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.179.81.5 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-179-81-5.eu-west-2.compute.amazonaws.com

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.180.163 (United States)

ASN15169 (GOOGLE, US)
PTR: mil04s44-in-f3.1e100.net

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.125.140.156 (United States)

ASN15169 (GOOGLE, US)
PTR: wq-in-f156.1e100.net

bid.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.228.74.168 (United Kingdom) 1 redirects

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.36.113.23 (United States) 2 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.73.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.110 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f14.1e100.net

gcdn.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.85.226.71 (United States)

ASN15169 (GOOGLE, US)
PTR: ams17s07-in-f7.1e100.net

r2---sn-5hnekn7k.c.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
36	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 120 tpc.googlesyndication.com — Cisco Umbrella Rank: 160	423 KB
29	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 54 cm.g.doubleclick.net — Cisco Umbrella Rank: 205 bid.g.doubleclick.net — Cisco Umbrella Rank: 465	162 KB
22	natutool.com natutool.com	609 KB
19	gstatic.com fonts.gstatic.com www.gstatic.com csi.gstatic.com	155 KB
9	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 307 fonts.googleapis.com — Cisco Umbrella Rank: 71 imasdk.googleapis.com — Cisco Umbrella Rank: 425	135 KB
8	google.com 3 redirects adservice.google.com — Cisco Umbrella Rank: 92 www.google.com — Cisco Umbrella Rank: 8	1 KB
3	2mdn.net 1 redirects gcdn.2mdn.net — Cisco Umbrella Rank: 883 r2---sn-5hnekn7k.c.2mdn.net — Cisco Umbrella Rank: 620708	1 KB
3	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 179	128 KB
2	pubmatic.com 2 redirects image6.pubmatic.com — Cisco Umbrella Rank: 629	1 KB
2	rubiconproject.com 2 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 336	918 B
2	openx.net rtb.openx.net — Cisco Umbrella Rank: 1589	415 B
2	mookie1.com 2 redirects odr.mookie1.com — Cisco Umbrella Rank: 907	745 B
2	rlcdn.com 2 redirects id.rlcdn.com — Cisco Umbrella Rank: 635	572 B
2	everesttech.net 2 redirects pixel.everesttech.net — Cisco Umbrella Rank: 3023	752 B
2	google.ee adservice.google.ee — Cisco Umbrella Rank: 209335	914 B
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 49	20 KB
1	gravatar.com secure.gravatar.com — Cisco Umbrella Rank: 1519	2 KB
1	quantserve.com 1 redirects cms.quantserve.com — Cisco Umbrella Rank: 1107	477 B
1	innovid.com ag.innovid.com — Cisco Umbrella Rank: 1383	297 B
1	agkn.com 1 redirects d.agkn.com — Cisco Umbrella Rank: 557	761 B
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 867	644 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 89	40 KB
0	casalemedia.com Failed ssum-sec.casalemedia.com — Cisco Umbrella Rank: 576 Failed
136	23

	Domain	Requested by
22	natutool.com	natutool.com
20	tpc.googlesyndication.com	googleads.g.doubleclick.net imasdk.googleapis.com tpc.googlesyndication.com pagead2.googlesyndication.com
16	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com
16	pagead2.googlesyndication.com	natutool.com pagead2.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com tpc.googlesyndication.com
12	cm.g.doubleclick.net	googleads.g.doubleclick.net
9	www.gstatic.com	googleads.g.doubleclick.net
8	fonts.gstatic.com	natutool.com fonts.googleapis.com
6	www.google.com	3 redirects googleads.g.doubleclick.net tpc.googlesyndication.com
6	fonts.googleapis.com	googleads.g.doubleclick.net ajax.googleapis.com
3	www.googletagservices.com	googleads.g.doubleclick.net
2	r2---sn-5hnekn7k.c.2mdn.net	googleads.g.doubleclick.net
2	image6.pubmatic.com	2 redirects
2	csi.gstatic.com	imasdk.googleapis.com
2	pixel.rubiconproject.com	2 redirects
2	rtb.openx.net	googleads.g.doubleclick.net
2	odr.mookie1.com	2 redirects
2	id.rlcdn.com	2 redirects
2	pixel.everesttech.net	2 redirects
2	imasdk.googleapis.com	googleads.g.doubleclick.net
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.ee	pagead2.googlesyndication.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
1	gcdn.2mdn.net	1 redirects
1	secure.gravatar.com	natutool.com
1	cms.quantserve.com	1 redirects
1	bid.g.doubleclick.net	imasdk.googleapis.com
1	ag.innovid.com	googleads.g.doubleclick.net
1	d.agkn.com	1 redirects
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	www.googletagmanager.com	natutool.com
1	ajax.googleapis.com	natutool.com
0	ssum-sec.casalemedia.com Failed	googleads.g.doubleclick.net
136	32

This site contains links to these domains. Also see Links.

Domain
www.instagram.com
www.youtube.com
twitter.com
www.facebook.com
www.linkedin.com
www.tumblr.com
pinterest.com
reddit.com
vk.com
connect.ok.ru
getpocket.com
vi.wikipedia.org
suiueoi
api.whatsapp.com
telegram.me

Subject Issuer	Validity	Valid
natutool.com R3	`2022-06-21` - `2022-09-19`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.google.ee GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
*.innovid.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2022-03-15` - `2023-04-15`	a year	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
*.c.docs.google.com GTS CA 1C3	`2022-06-14` - `2022-08-23`	2 months	crt.sh

This page contains 19 frames:

Primary Page: https://natutool.com/hack-ff-auto-headshot/
Frame ID: 92F45547FA0953CC8E8614D3B463E32B
Requests: 71 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20190131/zrt_lookup.html
Frame ID: 05A4536C557392F39AA906056F14DA31
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4261401821259978&output=html&adk=2969136045&adf=3689892565&lmt=1656380139&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fnatutool.com%2Fhack-ff-auto-headshot%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656389873974&bpp=4&bdt=1132&idt=600&shv=r20220623&mjsv=m202206230101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8648122524355&frm=20&pv=2&ga_vid=909823206.1656389874&ga_sid=1656389875&ga_hid=1572151539&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31068195%2C42531607&oid=2&pvsid=3528220077371364&tmod=616590128&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=625
Frame ID: 25D010ABD60E0A63789EA392CCA1792B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4261401821259978&output=html&h=280&adk=4001486692&adf=1500004090&pi=t.aa~a.4288580353~i.8~rp.4&w=720&fwrn=4&fwrnh=100&lmt=1656380139&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=3040758229&psa=0&ad_type=text_image&format=720x280&url=https%3A%2F%2Fnatutool.com%2Fhack-ff-auto-headshot%2F&fwr=0&pra=3&rh=180&rw=720&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656389875504&bpp=4&bdt=2662&idt=-M&shv=r20220623&mjsv=m202206230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1fdae3e67b9e1017-22e2d120becd0001%3AT%3D1656389870%3ART%3D1656389870%3AS%3DALNI_MbVKDNpo_H8xzDoyqAVHH-mQuLSfQ&prev_fmts=0x0&nras=2&correlator=8648122524355&frm=20&pv=1&ga_vid=909823206.1656389874&ga_sid=1656389875&ga_hid=1572151539&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=246&ady=1884&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31068195%2C42531607&oid=2&pvsid=3528220077371364&tmod=616590128&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=ENE8O1KlP8&p=https%3A//natutool.com&dtd=25
Frame ID: 5B91C925BBB395E20E1FFC98D9816F62
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4261401821259978&output=html&h=280&adk=3384979410&adf=2554181317&pi=t.aa~a.3735058315~rp.4&w=370&fwrn=4&fwrnh=100&lmt=1656380139&rafmt=1&to=qs&pwprc=3040758229&psa=0&format=370x280&url=https%3A%2F%2Fnatutool.com%2Fhack-ff-auto-headshot%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656389875504&bpp=1&bdt=2662&idt=1&shv=r20220623&mjsv=m202206230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1fdae3e67b9e1017-22e2d120becd0001%3AT%3D1656389870%3ART%3D1656389870%3AS%3DALNI_MbVKDNpo_H8xzDoyqAVHH-mQuLSfQ&prev_fmts=0x0%2C720x280&nras=3&correlator=8648122524355&frm=20&pv=1&ga_vid=909823206.1656389874&ga_sid=1656389875&ga_hid=1572151539&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1419&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31068195%2C42531607&oid=2&pvsid=3528220077371364&tmod=616590128&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=2&fsb=1&xpc=dP71vToC9V&p=https%3A//natutool.com&dtd=33
Frame ID: C35FCFCCA7C58AFFFD216C361832FAD3
Requests: 20 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1
Frame ID: D8A331EE4D74A881248509CDA6374953
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1
Frame ID: C69FB890E41EC9ADCB70C926A97BD4F0
Requests: 14 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 9AC01FF70CC531C0FB3F6DCA602A9B92
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 0F8EB008DB1550A22CB586FA76DD7712
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: CCE6C4F50CC7B787DCA65BA29AB54469
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 5448BBF915583EF7E5E21E0B11C3CC91
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: A6467E374ADB1AB49ECE3127ACFB3103
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/NUf31DeV05jg6rbNTwXiBfRLQ8hv8NSyvu4XMwxgjz4.js
Frame ID: 39F2B57A08F107992636B47F75B48E35
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/NUf31DeV05jg6rbNTwXiBfRLQ8hv8NSyvu4XMwxgjz4.js
Frame ID: BF548D6F385D7241BD74AEA63C94D0CC
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: DED746CF00910EA7C79D2431F580F534
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/NUf31DeV05jg6rbNTwXiBfRLQ8hv8NSyvu4XMwxgjz4.js
Frame ID: EEAC869AD840BCE7139BE7FCD56FDCD6
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html
Frame ID: C73FB28B99988FA7DDEF0C1A1E8142F0
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: AB207A2ABD080EB1CFE6C8FC50CBCD1D
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: EF4917F1BF57BA040120E559A7BC8A8D
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Tải Hack FF OB34 (Menu Headshot, Chạy Nhanh, Xuyên Tường, DATA) 1.90.2

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

googleapis\.com/.+webfont

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

136
Requests

91 %
HTTPS

0 %
IPv6

23
Domains

32
Subdomains

21
IPs

6
Countries

1678 kB
Transfer

4082 kB
Size

19
Cookies

17 Outgoing links

These are links going to different origins than the main page.

URL: https://www.instagram.com/natu.tool/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCfI58JZSCGiq8KgbzK2LG0A
Title: YouTube

Search URL Search Domain Scan URL

URL: https://twitter.com/natutooll
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/natutool
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https://natutool.com/hack-ff-auto-headshot/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=T%E1%BA%A3i%20Hack%20FF%20OB34%20%28Menu%20Headshot%2C%20Ch%E1%BA%A1y%20Nhanh%2C%20Xuy%C3%AAn%20T%C6%B0%E1%BB%9Dng%2C%20DATA%29%201.90.2&url=https://natutool.com/hack-ff-auto-headshot/
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://natutool.com/hack-ff-auto-headshot/&title=T%E1%BA%A3i%20Hack%20FF%20OB34%20%28Menu%20Headshot%2C%20Ch%E1%BA%A1y%20Nhanh%2C%20Xuy%C3%AAn%20T%C6%B0%E1%BB%9Dng%2C%20DATA%29%201.90.2
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.tumblr.com/share/link?url=https://natutool.com/hack-ff-auto-headshot/&name=T%E1%BA%A3i%20Hack%20FF%20OB34%20%28Menu%20Headshot%2C%20Ch%E1%BA%A1y%20Nhanh%2C%20Xuy%C3%AAn%20T%C6%B0%E1%BB%9Dng%2C%20DATA%29%201.90.2
Title: Tumblr

Search URL Search Domain Scan URL

URL: https://pinterest.com/pin/create/button/?url=https://natutool.com/hack-ff-auto-headshot/&description=T%E1%BA%A3i%20Hack%20FF%20OB34%20%28Menu%20Headshot%2C%20Ch%E1%BA%A1y%20Nhanh%2C%20Xuy%C3%AAn%20T%C6%B0%E1%BB%9Dng%2C%20DATA%29%201.90.2&media=https://natutool.com/wp-content/uploads/2022/03/hack-ff-autoheadshot-ob33.jpg
Title: Pinterest

Search URL Search Domain Scan URL

URL: https://reddit.com/submit?url=https://natutool.com/hack-ff-auto-headshot/&title=T%E1%BA%A3i%20Hack%20FF%20OB34%20%28Menu%20Headshot%2C%20Ch%E1%BA%A1y%20Nhanh%2C%20Xuy%C3%AAn%20T%C6%B0%E1%BB%9Dng%2C%20DATA%29%201.90.2
Title: Reddit

Search URL Search Domain Scan URL

URL: https://vk.com/share.php?url=https://natutool.com/hack-ff-auto-headshot/
Title: VKontakte

Search URL Search Domain Scan URL

URL: https://connect.ok.ru/dk?st.cmd=WidgetSharePreview&st.shareUrl=https://natutool.com/hack-ff-auto-headshot/&description=T%E1%BA%A3i%20Hack%20FF%20OB34%20%28Menu%20Headshot%2C%20Ch%E1%BA%A1y%20Nhanh%2C%20Xuy%C3%AAn%20T%C6%B0%E1%BB%9Dng%2C%20DATA%29%201.90.2&media=https://natutool.com/wp-content/uploads/2022/03/hack-ff-autoheadshot-ob33.jpg
Title: Odnoklassniki

Search URL Search Domain Scan URL

URL: https://getpocket.com/save?title=T%E1%BA%A3i%20Hack%20FF%20OB34%20%28Menu%20Headshot%2C%20Ch%E1%BA%A1y%20Nhanh%2C%20Xuy%C3%AAn%20T%C6%B0%E1%BB%9Dng%2C%20DATA%29%201.90.2&url=https://natutool.com/hack-ff-auto-headshot/
Title: Pocket

Search URL Search Domain Scan URL

URL: https://vi.wikipedia.org/wiki/Garena_Free_Fire
Title: Garena Free Fire

Search URL Search Domain Scan URL

URL: http://suiueoi/
Title: Nguyễn Văn Tùng

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=T%E1%BA%A3i%20Hack%20FF%20OB34%20%28Menu%20Headshot%2C%20Ch%E1%BA%A1y%20Nhanh%2C%20Xuy%C3%AAn%20T%C6%B0%E1%BB%9Dng%2C%20DATA%29%201.90.2%20https://natutool.com/hack-ff-auto-headshot/
Title: WhatsApp

Search URL Search Domain Scan URL

URL: https://telegram.me/share/url?url=https://natutool.com/hack-ff-auto-headshot/&text=T%E1%BA%A3i%20Hack%20FF%20OB34%20%28Menu%20Headshot%2C%20Ch%E1%BA%A1y%20Nhanh%2C%20Xuy%C3%AAn%20T%C6%B0%E1%BB%9Dng%2C%20DATA%29%201.90.2
Title: Telegram

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 102

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 104

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 106

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DARnp8GDzORIMr27O4RodqUCi9-zGKBoo10S9MtWo1AovMs9EPzar9ElQ9N4_2ksV0Xv45xOImoVucGt5LfFOBAbe-DuXbpXVm5mN&google_gid=CAESEFHb_0aScpmYQk_UJZs5CdA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WXJxQThBQUFCVUZMV1dvSg&google_push=ARnp8GDzORIMr27O4RodqUCi9-zGKBoo10S9MtWo1AovMs9EPzar9ElQ9N4_2ksV0Xv45xOImoVucGt5LfFOBAbe-DuXbpXVm5mN

Request Chain 107

https://d.agkn.com/pixel/2175/?google_gid=CAESEMQSgjlt9aYSZYYyVdOnM3k&google_cver=1&google_push=ARnp8GAbodejbVsGIPD-jiyXGUGoQbhs96j0WDppCel3RH1Hlt_Pt6G04JM5nU6Q5TLvZkIuWxM0PHAj2nu5a1ndVTj2iKu42Y4a HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=ARnp8GAbodejbVsGIPD-jiyXGUGoQbhs96j0WDppCel3RH1Hlt_Pt6G04JM5nU6Q5TLvZkIuWxM0PHAj2nu5a1ndVTj2iKu42Y4a&google_hm=Q0FFU0VNUVNnamx0OWFZU1pZWXlWZE9uTTNr

Request Chain 108

https://id.rlcdn.com/466606.gif?cparams=google_push%3DARnp8GDe4CzewOLEp6aNBu3Mcrca-iVaI_gAAXrUwC__j3IJiJHQeVZ2ZkfYIxVwjSUhgWRiJflhwot1zAVW9jddyT915VOKzS-h&google_gid=CAESEIF9yYOWNh4Q0bE0FrjY_Zw&google_cver=1 HTTP 307
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCPCB6pUGEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BUm5wOEdEZTRDemV3T0xFcDZhTkJ1M01jcmNhLWlWYUlfZ0FBWHJVd0NfX2ozSUppSkhRZVZaMlprZllJeFZ3alNVaGdXUmlKZmxod290MXpBVlc5amRkeVQ5MTVWT0t6Uy1o HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwVWp2azJYWnJqZWp3Qnh3Z2pfMk9lMkI5aFhtZlo1aThRVHc4Wnlhak1mdw==&google_push

Request Chain 109

https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEPq2WXa2SOCFXWuJaBGt86Y&google_push=ARnp8GDM21aanSa5ma1TyOI73VRXOnjRkOa9FfmR8tbgCkd5dg22kccFcCHkrnU2bTCfP3ZNLClMNOhos_SjZiqYatCF78RIdQc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=ARnp8GDM21aanSa5ma1TyOI73VRXOnjRkOa9FfmR8tbgCkd5dg22kccFcCHkrnU2bTCfP3ZNLClMNOhos_SjZiqYatCF78RIdQc&google_hm=MTA4MjQyNjA5NjY5MzU4OTg1OTc

Request Chain 111

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEL8yrDqjPp0JuFu3GNQrwIo&google_cver=1&google_push=ARnp8GBoBKnplLqgx2otPAxqC2rpOC36fSdcya-Kun3IQz7y4NffCI3CcLigXoaxDmIOGbRFkI9OwRJcdwtpO8AfALQaVZX34Xaw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDRYTlJINVUtRC0zV0Q0&google_push=ARnp8GBoBKnplLqgx2otPAxqC2rpOC36fSdcya-Kun3IQz7y4NffCI3CcLigXoaxDmIOGbRFkI9OwRJcdwtpO8AfALQaVZX34Xaw

Request Chain 114

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 126

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEJISDHxs5v4a44B3jIG1mE8&google_cver=1&google_push=ARnp8GAOdjJ366Kh2n8q-5ldVkM2pENh2KKP9mlrFJQKC0HyHQ3OqQmjTwWXrNfaIPo3zcCp4TVqUCNeMNvYSJkXDuWNJusmu28 HTTP 302
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ARnp8GAOdjJ366Kh2n8q-5ldVkM2pENh2KKP9mlrFJQKC0HyHQ3OqQmjTwWXrNfaIPo3zcCp4TVqUCNeMNvYSJkXDuWNJusmu28&google_hm=AA

Request Chain 127

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DARnp8GDnF4b3D5rVkeXhtl1qJhc3T-DMk6-1jY4Li2L9UriRKCsVO6D5xufKPNEmRnbf-vsYgpZByBf90aDQwDlUpiMVDxeC4sTH&google_gid=CAESEEyUXp2QWZDYuvXv6u5H2w4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WXJxQThBQUFBQXhzelU0cA&google_push=ARnp8GDnF4b3D5rVkeXhtl1qJhc3T-DMk6-1jY4Li2L9UriRKCsVO6D5xufKPNEmRnbf-vsYgpZByBf90aDQwDlUpiMVDxeC4sTH

Request Chain 128

https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEJOmPAWOtIgD3RGJrva5J1Q&google_push=ARnp8GAr39oE75013im8M5Kd6c32HcVIhsrVR6hDBmRigO0eGW-U332ZnsIo_pP_d9KKMZ9_Km92JxUTn60PXpVBin7VGXzgxDTl&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=ARnp8GAr39oE75013im8M5Kd6c32HcVIhsrVR6hDBmRigO0eGW-U332ZnsIo_pP_d9KKMZ9_Km92JxUTn60PXpVBin7VGXzgxDTl&google_hm=MTA4MjQyNjA5NjY5MzU4OTg1OTc

Request Chain 130

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEHSZ3S7gr_y4hUl33DkXM0c&google_cver=1&google_push=ARnp8GBkfgrQWRNuY5tkG6lqQjABUPEzwz3JYZUXLVs7xdVFZJ39Nh9d6m5lmlvoUbVzPnZAiJtjJnsUjipUijdIG31PlMa34I6I HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEHSZ3S7gr_y4hUl33DkXM0c&google_cver=1&google_push=ARnp8GBkfgrQWRNuY5tkG6lqQjABUPEzwz3JYZUXLVs7xdVFZJ39Nh9d6m5lmlvoUbVzPnZAiJtjJnsUjipUijdIG31PlMa34I6I&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=eysgc1hkR56ny_1xKTYK-Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ARnp8GBkfgrQWRNuY5tkG6lqQjABUPEzwz3JYZUXLVs7xdVFZJ39Nh9d6m5lmlvoUbVzPnZAiJtjJnsUjipUijdIG31PlMa34I6I

Request Chain 131

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDkS6AkVIo5GrrXZPmk-x6Q&google_cver=1&google_push=ARnp8GD0UMb1voVjSdA2F-JRb-OXh-5Sai_epFBextlt8Wg-wQq0BIX5ae8vTFb1CqCL68hECuoJgrS7sMqLRMU7gr49TMtNIClz HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDRYTlJIOVMtMTEtREk2Vw==&google_push=ARnp8GD0UMb1voVjSdA2F-JRb-OXh-5Sai_epFBextlt8Wg-wQq0BIX5ae8vTFb1CqCL68hECuoJgrS7sMqLRMU7gr49TMtNIClz

Request Chain 132

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEBz4t0n092OBklXXyYPWAHE&google_cver=1&google_push=ARnp8GBGvj7j--mKSEnBHVGNiQGCP-OZYACrquZ74-ym8KAXFYVLJ8qPutQxd1pGVdMO6ex5SQCkmi20SSRFY3_3PTrFGXxVqIE HTTP 302
https://ssum-sec.casalemedia.com%2C%20r10.lb.indexww.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEBz4t0n092OBklXXyYPWAHE&google_push=ARnp8GBGvj7j--mKSEnBHVGNiQGCP-OZYACrquZ74-ym8KAXFYVLJ8qPutQxd1pGVdMO6ex5SQCkmi20SSRFY3_3PTrFGXxVqIE&s=184023&C=1

Request Chain 146

https://gcdn.2mdn.net/videoplayback/id/7aa5587842c60e82/itag/346/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1687925872/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signature/06778309B447A132743DE94AAA64FBCFD64BF238.409042712A5185575E0161D9F9C0170FF31DAB82/key/ck2/file/file.mp4 HTTP 302
https://r2---sn-5hnekn7k.c.2mdn.net/videoplayback/id/7aa5587842c60e82/itag/346/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1687925872/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/4F49B6A270A3138B15D2A3DB1668446C88CEBB2A.7EBD030AC2CC63229D135EFC92F9A526F736783D/key/cms1/cms_redirect/yes/mh/mT/mip/45.133.192.171/mm/42/mn/sn-5hnekn7k/ms/onc/mt/1656386435/mv/u/mvi/2/pl/23/file/file.mp4

136 HTTP transactions
32 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
natutool.com/hack-ff-auto-headshot/ 331 KB
70 KB 1815ms
519ms Document
text/html 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://natutool.com/hack-ff-auto-headshot/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx / LarVPS

Resource Hash

c97ec8c88cdf7ab75903775bd4c5f897246dd81f420006617e456cc60bbcea6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 28 Jun 2022 04:17:47 GMT
last-modified: Tue, 28 Jun 2022 01:35:39 GMT
server: nginx
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-download-options: noopen
x-powered-by: LarVPS
x-xss-protection: 1; mode=block

GET
H2 200 logo-natutool.jpg
natutool.com/wp-content/uploads/2021/05/ 6 KB
6 KB 1036ms
1033ms Image
image/jpeg 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://natutool.com/wp-content/uploads/2021/05/logo-natutool.jpg
Requested by: Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 4a507461f4686f5bd7ec2845511412b61fd8b45314c56ce31b5e912db3bb5118

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/hack-ff-auto-headshot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
date: Tue, 28 Jun 2022 04:17:48 GMT
last-modified: Sat, 29 May 2021 14:53:34 GMT
server: nginx
etag: "60b2556e-1860"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 6240
expires: Thu, 28 Jul 2022 04:17:48 GMT

GET
H2 200 hack-ff-autoheadshot-ob33-780x450.jpg
natutool.com/wp-content/uploads/2022/03/ 64 KB
64 KB 1039ms
1036ms Image
image/jpeg 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://natutool.com/wp-content/uploads/2022/03/hack-ff-autoheadshot-ob33-780x450.jpg
Requested by: Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 195e523652e2fc0b15af2045e0e5692f2ed31ffc728ebbe4fd1135d30a8aa3f2

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/hack-ff-auto-headshot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
date: Tue, 28 Jun 2022 04:17:48 GMT
last-modified: Sat, 26 Mar 2022 04:24:41 GMT
server: nginx
etag: "623e9589-10034"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 65588
expires: Thu, 28 Jul 2022 04:17:48 GMT

GET
H2 200 tielabs-fonticon.woff
natutool.com/wp-content/themes/natutool/assets/fonts/tielabs-fonticon/ 40 KB
40 KB 1036ms
1033ms Font
font/woff 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://natutool.com/wp-content/themes/natutool/assets/fonts/tielabs-fonticon/tielabs-fonticon.woff

Requested by

Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx / LarVPS

Resource Hash

82649ad7d4ec9c61f1e525b2dade75153ffb03610b88d22e1ba3ba98fd55de81

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://natutool.com/hack-ff-auto-headshot/
Origin: https://natutool.com
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:17:48 GMT
x-content-type-options: nosniff
last-modified: Mon, 02 Aug 2021 01:41:45 GMT
server: nginx
x-powered-by: LarVPS
x-download-options: noopen
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: font/woff
x-xss-protection: 1; mode=block
accept-ranges: bytes
content-length: 40536
etag: "61074d59-9e58"

GET
H2 200 fa-solid-900.woff2
natutool.com/wp-content/themes/natutool/assets/fonts/fontawesome/ 78 KB
78 KB 1036ms
1034ms Font
font/woff2 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://natutool.com/wp-content/themes/natutool/assets/fonts/fontawesome/fa-solid-900.woff2

Requested by

Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx / LarVPS

Resource Hash

7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://natutool.com/hack-ff-auto-headshot/
Origin: https://natutool.com
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:17:48 GMT
x-content-type-options: nosniff
last-modified: Mon, 02 Aug 2021 01:41:45 GMT
server: nginx
x-powered-by: LarVPS
x-download-options: noopen
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: font/woff2
x-xss-protection: 1; mode=block
accept-ranges: bytes
content-length: 79444
etag: "61074d59-13654"

GET
H2 200 fa-brands-400.woff2
natutool.com/wp-content/themes/natutool/assets/fonts/fontawesome/ 75 KB
75 KB 1037ms
1034ms Font
font/woff2 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://natutool.com/wp-content/themes/natutool/assets/fonts/fontawesome/fa-brands-400.woff2

Requested by

Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx / LarVPS

Resource Hash

5d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://natutool.com/hack-ff-auto-headshot/
Origin: https://natutool.com
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:17:48 GMT
x-content-type-options: nosniff
last-modified: Mon, 02 Aug 2021 01:41:45 GMT
server: nginx
x-powered-by: LarVPS
x-download-options: noopen
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: font/woff2
x-xss-protection: 1; mode=block
accept-ranges: bytes
content-length: 76612
etag: "61074d59-12b44"

GET
H2 200 fa-regular-400.woff2
natutool.com/wp-content/themes/natutool/assets/fonts/fontawesome/ 13 KB
14 KB 1037ms
1035ms Font
font/woff2 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://natutool.com/wp-content/themes/natutool/assets/fonts/fontawesome/fa-regular-400.woff2

Requested by

Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx / LarVPS

Resource Hash

6a8c8e9e1e7f692c21af1956de163f3d026778e6449fe93a09a671847ca1ae65

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://natutool.com/hack-ff-auto-headshot/
Origin: https://natutool.com
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:17:48 GMT
x-content-type-options: nosniff
last-modified: Mon, 02 Aug 2021 01:41:45 GMT
server: nginx
x-powered-by: LarVPS
x-download-options: noopen
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: font/woff2
x-xss-protection: 1; mode=block
accept-ranges: bytes
content-length: 13584
etag: "61074d59-3510"

GET
H2 200 webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1/ 13 KB
6 KB 326ms
104ms Script
text/javascript 142.250.185.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/webfont/1/webfont.js

Requested by

Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f10.1e100.net

Software

sffe /

Resource Hash

81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 23 Jun 2022 10:11:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 410796
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5437
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 23 Jun 2023 10:11:12 GMT

GET
H2 200 icons.woff2
natutool.com/wp-content/plugins/fixed-toc/frontend/assets/fonts/ 4 KB
4 KB 1037ms
1036ms Font
font/woff2 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://natutool.com/wp-content/plugins/fixed-toc/frontend/assets/fonts/icons.woff2?45335921

Requested by

Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx / LarVPS

Resource Hash

24555680b413d9b1d6d8eea400a95ae4e064030afadd57eff2bd67f4df3740a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://natutool.com/hack-ff-auto-headshot/
Origin: https://natutool.com
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:17:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 06 Jun 2021 04:10:18 GMT
server: nginx
x-powered-by: LarVPS
x-download-options: noopen
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: font/woff2
x-xss-protection: 1; mode=block
accept-ranges: bytes
content-length: 3644
etag: "60bc4aaa-e3c"

GET
H2 200 pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 326ms
105ms Font
font/woff2 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2

Requested by

Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://natutool.com/
Origin: https://natutool.com
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 19:25:00 GMT
x-content-type-options: nosniff
age: 463968
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7884
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 17:03:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 22 Jun 2023 19:25:00 GMT

GET
H2 200 pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 338ms
117ms Font
font/woff2 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2

Requested by

Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://natutool.com/
Origin: https://natutool.com
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 19:25:01 GMT
x-content-type-options: nosniff
age: 463967
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8000
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:59:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 22 Jun 2023 19:25:01 GMT

GET
H2 200 jquery.min.js Show response
natutool.com/wp-includes/js/jquery/ 87 KB
34 KB 1261ms
1259ms Script
application/javascript 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://natutool.com/wp-includes/js/jquery/jquery.min.js
Requested by: Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/hack-ff-auto-headshot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
date: Tue, 28 Jun 2022 04:17:48 GMT
content-encoding: gzip
last-modified: Tue, 20 Jul 2021 23:31:29 GMT
server: nginx
etag: W/"60f75cd1-15db1"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000, public
expires: Thu, 28 Jul 2022 04:17:48 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 103 KB
40 KB 347ms
117ms Script
application/javascript 172.217.18.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-162839140-3

Requested by

Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.8 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra02s19-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

f45e87f9cd0fa1fd7af2842b73611e4dcfc2a85f346f5e29f6f518909b3ce6d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:17:49 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40310
x-xss-protection: 0
last-modified: Tue, 28 Jun 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 28 Jun 2022 04:17:49 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 177 KB
57 KB 353ms
129ms Script
text/javascript 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4261401821259978

Requested by

Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

cafe /

Resource Hash

a795cbdec4969302eeb2d1c07efed1b3f68a8205c6fa58d59af8fff8c5cdd26b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://natutool.com/
Origin: https://natutool.com
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:17:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 58262
x-xss-protection: 0
server: cafe
etag: 1817173785991149661
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 28 Jun 2022 04:17:49 GMT

GET
DATA 200
OK truncated
/ 67 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 512490d9f9051205fd78d1ad38f3fa1d98b77607f449c64bb9c6dc2a296e83a6

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9c4926b247def1bd98c0f6f6fbbaba449e2702ecf71ca6fceeacf7db04f9e9c9

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e1e676877284d9b0e0956643c1169f238253d302d04e1e6b8220e632f090b384

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f10a76802a896aa836f3db5035f4a8a29cc8c3baf3e28f9959fb3afbe3908bde

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 36bfdde9c1c29e9c7c464f26ae9bec4b2ec99d147d21774cdc95c8c96f822739

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4d6d934900f2d828851c6dfc483464ccd4f62e0e0200d8e32dc8384e83b009fd

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a2d5e81ff590741bd950f52b5922d6dc075ee0bee17fed14e57b5b16db80e16a

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 37a2139f70993265efb63855323e3bb51c68ce52456d0efcb49ec0d3e5f33d80

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9a3599ea67617b75e841fc667a1cd5ac281c392546a31af864566b74848cbd46

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cf03b898346812f4d422a84770c0ae31667cf2beb9a7bb50fe5a86cb62ab97cf

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 477eed57bc25e0a48e9dfa25da6f9138ce253f66f92bd36853fb3f10d1513f9a

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6a4a013ee7c08697be8ebd17b121bea52222f589c2e0224e6371a0fd6c6c4713

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1b13d49f9e83aea16344d45a5b18a2447eb6225793b19844cefb7489c8d06237

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 67 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b274e2b26af7aa1cfbe857e6a2d8ed6d68f17139e7b08f3e890ba79581fd6ab1

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2f8600335c93b2fe049ac35bbed64f2e89c77aab5cafd2fd774bda6e92b7ecf9

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1fcb320aef3ee8462a16c5e64611689a33273cc1ca7d8d9d35675b36959d7535

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1edf6a20d793508f98a63ef2b068ee8504aee2ea9c31cb6ae80fff7029616691

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9a9e2044886649e9ca95d92a10a717c5d339fbaedaf9d0d741f4e039681ed45c

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 85b2f72103d0416979160c68b069403162eb102ebab15bbe7f0e641fd9e1fc85

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4fbe21387469aeeada56a7e744b857616e294085241216afd8824af7788bf3a8

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a8a5fba20efc1ccb915e2da1e146146afbf2cef3dc6c8514d8b92cbaee2e5546

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 31e488e6b2e797680175d6d44d3b4723d51eea0d26056e2315a846749f64c187

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 169de8fd7c5a07edd1accc2be9e0c3b68d6eef67e7c62b40e5486703106a9e0e

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9db74c641fdd03a841f8efaaae4d7afdbe6d30005639069e5dd262c030e0314a

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99170d6e8105764ef3cd7879af59dda58561e634d23352d8155dd95f4b02a946

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04a59f4b56d8d14ed7c127db4cfedf8caa618594e00b14bb9a6150182e7c31d3

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 15d51a96c00f46c89828a7e962637d786edd66bd3ddde40c395f8647649d958b

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 66 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1eb677ff632aae24e700d06662bdc24c74587fe63d27f506666a1d6922ad64f9

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 326ms
104ms Script
text/javascript 142.250.185.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-162839140-3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 4936
date: Tue, 28 Jun 2022 02:55:33 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Tue, 28 Jun 2022 04:55:33 GMT

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cdf072b797353602918996980c44cfe88d0067ac8bc2582aa01d55ba11fd8ecf

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 lazyload.min.js Show response
natutool.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/ 8 KB
3 KB 998ms
998ms Script
application/javascript 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://natutool.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/lazyload.min.js
Requested by: Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/hack-ff-auto-headshot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
date: Tue, 28 Jun 2022 04:17:49 GMT
content-encoding: gzip
last-modified: Thu, 02 Jun 2022 06:14:04 GMT
server: nginx
etag: W/"6298552c-2063"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000, public
expires: Thu, 28 Jul 2022 04:17:49 GMT

GET
H2 200 f87d234cbf60fa82ec4fb82c7e35af39.js Show response
natutool.com/wp-content/cache/min/1/ 231 KB
65 KB 999ms
999ms Script
application/javascript 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://natutool.com/wp-content/cache/min/1/f87d234cbf60fa82ec4fb82c7e35af39.js
Requested by: Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 2c30fc51273125f9c2af11890cd8620a42a18b9794555aeeb5438f3673c2ca19

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/hack-ff-auto-headshot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
date: Tue, 28 Jun 2022 04:17:49 GMT
content-encoding: gzip
last-modified: Wed, 25 May 2022 00:16:47 GMT
server: nginx
etag: "628d756f-10400"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000, public
content-length: 66560
expires: Thu, 28 Jul 2022 04:17:49 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202206230101/ 339 KB
120 KB 348ms
136ms Script
text/javascript 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202206230101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4261401821259978&plah=natutool.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4261401821259978

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

cafe /

Resource Hash

517ba165068755f33a47c052f603cefeafbe4410bc29d559e03bafc091e17b3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:17:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 122444
x-xss-protection: 0
server: cafe
etag: 9400295322627410379
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 28 Jun 2022 04:17:49 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220623/r20190131/ Frame 05A4 10 KB
5 KB 327ms
104ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220623/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4261401821259978

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

75a2067c9dff8e58ae83cdb8ee4fe896013966ac4e8f3f1d5e8a75f27c9a1ae2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://natutool.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

age: 29758
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4414
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Jun 2022 20:01:51 GMT
etag: 10429905676100781186
expires: Mon, 11 Jul 2022 20:01:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 325ms
112ms XHR
text/plain 142.250.185.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1572151539&t=pageview&_s=1&dl=https%3A%2F%2Fnatutool.com%2Fhack-ff-auto-headshot%2F&ul=en-us&de=UTF-8&dt=T%E1%BA%A3i%20Hack%20FF%20OB34%20(Menu%20Headshot%2C%20Ch%E1%BA%A1y%20Nhanh%2C%20Xuy%C3%AAn%20T%C6%B0%E1%BB%9Dng%2C%20DATA)%201.90.2&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=152263829&gjid=1710903138&cid=909823206.1656389874&tid=UA-162839140-3&_gid=304716561.1656389874&_r=1&gtm=2ou6r0&z=722347371

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://natutool.com/
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://natutool.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 216 B
644 B 351ms
113ms Script
text/javascript 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=natutool.com&callback=_gfp_s_&client=ca-pub-4261401821259978

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202206230101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4261401821259978&plah=natutool.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra02s19-in-f2.1e100.net

Software

cafe /

Resource Hash

4e8f0a2dbb1733990c2a04109ad26ef432995d68e58ec78902ad706bb1fb75ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:17:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 200
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.ee/adsid/ 107 B
792 B 347ms
115ms Script
application/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ee/adsid/integrator.js?domain=natutool.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 28 Jun 2022 04:17:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 348ms
117ms Script
application/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=natutool.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 28 Jun 2022 04:17:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 25D0 311 KB
69 KB 676ms
464ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4261401821259978&output=html&adk=2969136045&adf=3689892565&lmt=1656380139&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fnatutool.com%2Fhack-ff-auto-headshot%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656389873974&bpp=4&bdt=1132&idt=600&shv=r20220623&mjsv=m202206230101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8648122524355&frm=20&pv=2&ga_vid=909823206.1656389874&ga_sid=1656389875&ga_hid=1572151539&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31068195%2C42531607&oid=2&pvsid=3528220077371364&tmod=616590128&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=625

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

997102368fe90df52bc1f5fca3ccdd4d90ca284be92fed4231e3fe90e1547510

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://natutool.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 71070
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 28 Jun 2022 04:17:50 GMT
expires: Tue, 28 Jun 2022 04:17:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202206230101/ 149 KB
53 KB 127ms
127ms Script
text/javascript 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202206230101/reactive_library_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

cafe /

Resource Hash

f2f78d9ba4cac3736d56068718a35f724c8a35cad4e4586ea9466e5d1c4ed0cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:17:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54417
x-xss-protection: 0
server: cafe
etag: 10135704158391262157
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Tue, 28 Jun 2022 04:17:50 GMT

GET
H3 200 integrator.js Show response
adservice.google.ee/adsid/ 107 B
122 B 340ms
128ms Script
application/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ee/adsid/integrator.js?domain=natutool.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 28 Jun 2022 04:17:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 342ms
130ms Script
application/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=natutool.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 28 Jun 2022 04:17:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 5B91 100 KB
35 KB 470ms
469ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4261401821259978&output=html&h=280&adk=4001486692&adf=1500004090&pi=t.aa~a.4288580353~i.8~rp.4&w=720&fwrn=4&fwrnh=100&lmt=1656380139&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=3040758229&psa=0&ad_type=text_image&format=720x280&url=https%3A%2F%2Fnatutool.com%2Fhack-ff-auto-headshot%2F&fwr=0&pra=3&rh=180&rw=720&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656389875504&bpp=4&bdt=2662&idt=-M&shv=r20220623&mjsv=m202206230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1fdae3e67b9e1017-22e2d120becd0001%3AT%3D1656389870%3ART%3D1656389870%3AS%3DALNI_MbVKDNpo_H8xzDoyqAVHH-mQuLSfQ&prev_fmts=0x0&nras=2&correlator=8648122524355&frm=20&pv=1&ga_vid=909823206.1656389874&ga_sid=1656389875&ga_hid=1572151539&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=246&ady=1884&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31068195%2C42531607&oid=2&pvsid=3528220077371364&tmod=616590128&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=ENE8O1KlP8&p=https%3A//natutool.com&dtd=25

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

44fd195478555f2ff575f618381ab21116f45848c36ccd8ebd25a9dd68482006

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://natutool.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 36023
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 28 Jun 2022 04:17:51 GMT
expires: Tue, 28 Jun 2022 04:17:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C35F 81 KB
26 KB 656ms
655ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4261401821259978&output=html&h=280&adk=3384979410&adf=2554181317&pi=t.aa~a.3735058315~rp.4&w=370&fwrn=4&fwrnh=100&lmt=1656380139&rafmt=1&to=qs&pwprc=3040758229&psa=0&format=370x280&url=https%3A%2F%2Fnatutool.com%2Fhack-ff-auto-headshot%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656389875504&bpp=1&bdt=2662&idt=1&shv=r20220623&mjsv=m202206230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1fdae3e67b9e1017-22e2d120becd0001%3AT%3D1656389870%3ART%3D1656389870%3AS%3DALNI_MbVKDNpo_H8xzDoyqAVHH-mQuLSfQ&prev_fmts=0x0%2C720x280&nras=3&correlator=8648122524355&frm=20&pv=1&ga_vid=909823206.1656389874&ga_sid=1656389875&ga_hid=1572151539&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1419&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31068195%2C42531607&oid=2&pvsid=3528220077371364&tmod=616590128&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=2&fsb=1&xpc=dP71vToC9V&p=https%3A//natutool.com&dtd=33

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

d9ceed39ed254bd9506d76895a8d8b2049123952ef35814dbe912eee562fec00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://natutool.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 26446
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 28 Jun 2022 04:17:51 GMT
expires: Tue, 28 Jun 2022 04:17:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/ Frame D8A3 10 KB
4 KB 105ms
105ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

75a2067c9dff8e58ae83cdb8ee4fe896013966ac4e8f3f1d5e8a75f27c9a1ae2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://natutool.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

age: 12750
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4414
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 28 Jun 2022 00:45:20 GMT
etag: 10429905676100781186
expires: Tue, 12 Jul 2022 00:45:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/ Frame C69F 10 KB
4 KB 106ms
105ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

75a2067c9dff8e58ae83cdb8ee4fe896013966ac4e8f3f1d5e8a75f27c9a1ae2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://natutool.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

age: 12750
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4414
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 28 Jun 2022 00:45:20 GMT
etag: 10429905676100781186
expires: Tue, 12 Jul 2022 00:45:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame D8A3 4 KB
889 B 135ms
135ms Stylesheet
text/css 142.250.185.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f10.1e100.net

Software

ESF /

Resource Hash

c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 28 Jun 2022 03:51:41 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 28 Jun 2022 04:17:51 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 28 Jun 2022 04:17:51 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame D8A3 205 B
518 B 396ms
119ms Image
image/png 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 02:51:49 GMT
x-content-type-options: nosniff
age: 5162
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 28 Jun 2023 02:51:49 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame D8A3 604 B
695 B 397ms
120ms Image
image/png 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 27 Jun 2022 15:38:51 GMT
x-content-type-options: nosniff
age: 45540
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 27 Jun 2023 15:38:51 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220623/r20110914/elements/html/ Frame D8A3 19 KB
9 KB 380ms
104ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220623/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

ae2e1dc0161fa05e80b225682868a9bfbab08c503b2429f06339d4487f160ac2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:13:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 243
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8263
x-xss-protection: 0
server: cafe
etag: 17157773748623750166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Jul 2022 04:13:48 GMT

GET
H2 200 fa287546e1d5bd0678894d5c227e456c.js Show response
www.gstatic.com/mysidia/ Frame C69F 10 KB
5 KB 373ms
103ms Script
text/javascript 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/fa287546e1d5bd0678894d5c227e456c.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

fd49219477a365773f010355db7e75d2430693594965a28d835d7c579536948f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Jun 2022 09:05:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 587530
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4351
x-xss-protection: 0
last-modified: Wed, 15 Jun 2022 22:50:53 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 19 Sep 2022 09:05:41 GMT

GET
H2 200 db2e47a9a3671f527cf86ca9ac22fc67.js Show response
www.gstatic.com/mysidia/ Frame C69F 10 KB
4 KB 379ms
109ms Script
text/javascript 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/db2e47a9a3671f527cf86ca9ac22fc67.js?tag=text/vanilla_highlight

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

e3fbe67fed994d974916f80939f43e83889b033b3a565f349f26255620037a4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Jun 2022 09:05:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 587530
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4277
x-xss-protection: 0
last-modified: Fri, 17 Jun 2022 00:16:24 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 19 Sep 2022 09:05:41 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame C69F 8 KB
966 B 129ms
126ms Stylesheet
text/css 142.250.185.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f10.1e100.net

Software

ESF /

Resource Hash

4cf6f3dffbc65f9231255bf31f40ddc84a45bc57428b41d6786afc7153b90b7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 28 Jun 2022 03:53:21 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 28 Jun 2022 04:17:51 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 28 Jun 2022 04:17:51 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/ Frame C69F 2 KB
936 B 515ms
246ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 03:40:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2230
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Jul 2022 03:40:41 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220623/r20110914/ Frame C69F 21 KB
9 KB 384ms
116ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220623/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

a2625083f682f667dbd0121720f86b02cc023e7cc2c36d1fad2d1a3dbe0b8cc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 02:31:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6378
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8671
x-xss-protection: 0
server: cafe
etag: 18116328616323621410
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Jul 2022 02:31:33 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/ Frame C69F 3 KB
1 KB 515ms
246ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:05:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 756
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Jul 2022 04:05:15 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/ Frame C69F 17 KB
7 KB 400ms
132ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 482
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Jul 2022 04:09:49 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C69F 138 KB
43 KB 380ms
112ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

sffe /

Resource Hash

29a74bd48fa0b500b61194468e760e8acef2f465e782e0da3eb219850bcea8fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:17:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43256
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1656329918998510"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 28 Jun 2022 04:17:51 GMT

GET
H2 200 21b2dfe42abab24529e209ac1efa07c6.js Show response
www.gstatic.com/mysidia/ Frame C69F 31 KB
13 KB 390ms
122ms Script
text/javascript 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/21b2dfe42abab24529e209ac1efa07c6.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

b97d2c98f8bac4ee72d075d577db22903f83ae9a2742b9caef94f0842b459348

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 23 Jun 2022 00:25:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 445938
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13060
x-xss-protection: 0
last-modified: Thu, 23 Jun 2022 00:04:46 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 21 Sep 2022 00:25:33 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 9AC0 8 KB
893 B 345ms
114ms Stylesheet
text/css 142.250.185.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f10.1e100.net

Software

ESF /

Resource Hash

4cf6f3dffbc65f9231255bf31f40ddc84a45bc57428b41d6786afc7153b90b7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 28 Jun 2022 03:55:50 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 28 Jun 2022 04:17:51 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 28 Jun 2022 04:17:51 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/ Frame 9AC0 2 KB
983 B 338ms
239ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 03:40:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2230
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Jul 2022 03:40:41 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220623/r20110914/ Frame 9AC0 21 KB
9 KB 305ms
208ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220623/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

a2625083f682f667dbd0121720f86b02cc023e7cc2c36d1fad2d1a3dbe0b8cc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 02:31:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6378
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8671
x-xss-protection: 0
server: cafe
etag: 18116328616323621410
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Jul 2022 02:31:33 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/ Frame 9AC0 3 KB
1 KB 380ms
283ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:05:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 756
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Jul 2022 04:05:15 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/ Frame 9AC0 17 KB
7 KB 318ms
222ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 482
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Jul 2022 04:09:49 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9AC0 138 KB
42 KB 352ms
255ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

sffe /

Resource Hash

29a74bd48fa0b500b61194468e760e8acef2f465e782e0da3eb219850bcea8fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:17:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43256
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1656329918998510"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 28 Jun 2022 04:17:51 GMT

GET
H2 200 21b2dfe42abab24529e209ac1efa07c6.js Show response
www.gstatic.com/mysidia/ Frame 9AC0 31 KB
13 KB 302ms
205ms Script
text/javascript 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/21b2dfe42abab24529e209ac1efa07c6.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

b97d2c98f8bac4ee72d075d577db22903f83ae9a2742b9caef94f0842b459348

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 23 Jun 2022 00:25:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 445938
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13060
x-xss-protection: 0
last-modified: Thu, 23 Jun 2022 00:04:46 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 21 Sep 2022 00:25:33 GMT

GET
H2 200 fa287546e1d5bd0678894d5c227e456c.js Show response
www.gstatic.com/mysidia/ Frame 5B91 10 KB
4 KB 218ms
217ms Script
text/javascript 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/fa287546e1d5bd0678894d5c227e456c.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4261401821259978&output=html&h=280&adk=4001486692&adf=1500004090&pi=t.aa~a.4288580353~i.8~rp.4&w=720&fwrn=4&fwrnh=100&lmt=1656380139&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=3040758229&psa=0&ad_type=text_image&format=720x280&url=https%3A%2F%2Fnatutool.com%2Fhack-ff-auto-headshot%2F&fwr=0&pra=3&rh=180&rw=720&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656389875504&bpp=4&bdt=2662&idt=-M&shv=r20220623&mjsv=m202206230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1fdae3e67b9e1017-22e2d120becd0001%3AT%3D1656389870%3ART%3D1656389870%3AS%3DALNI_MbVKDNpo_H8xzDoyqAVHH-mQuLSfQ&prev_fmts=0x0&nras=2&correlator=8648122524355&frm=20&pv=1&ga_vid=909823206.1656389874&ga_sid=1656389875&ga_hid=1572151539&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=246&ady=1884&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31068195%2C42531607&oid=2&pvsid=3528220077371364&tmod=616590128&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=ENE8O1KlP8&p=https%3A//natutool.com&dtd=25

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

fd49219477a365773f010355db7e75d2430693594965a28d835d7c579536948f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Jun 2022 09:05:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 587530
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4351
x-xss-protection: 0
last-modified: Wed, 15 Jun 2022 22:50:53 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 19 Sep 2022 09:05:41 GMT

GET
H2 200 db2e47a9a3671f527cf86ca9ac22fc67.js Show response
www.gstatic.com/mysidia/ Frame 5B91 10 KB
4 KB 231ms
229ms Script
text/javascript 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/db2e47a9a3671f527cf86ca9ac22fc67.js?tag=text/vanilla_highlight

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

e3fbe67fed994d974916f80939f43e83889b033b3a565f349f26255620037a4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Jun 2022 09:05:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 587530
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4277
x-xss-protection: 0
last-modified: Fri, 17 Jun 2022 00:16:24 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 19 Sep 2022 09:05:41 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 5B91 8 KB
893 B 226ms
114ms Stylesheet
text/css 142.250.185.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f10.1e100.net

Software

ESF /

Resource Hash

4cf6f3dffbc65f9231255bf31f40ddc84a45bc57428b41d6786afc7153b90b7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 28 Jun 2022 03:53:21 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 28 Jun 2022 04:17:51 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 28 Jun 2022 04:17:51 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/ Frame 5B91 2 KB
902 B 303ms
137ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 03:40:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2230
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Jul 2022 03:40:41 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220623/r20110914/ Frame 5B91 21 KB
9 KB 235ms
234ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220623/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

a2625083f682f667dbd0121720f86b02cc023e7cc2c36d1fad2d1a3dbe0b8cc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 02:31:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6378
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8671
x-xss-protection: 0
server: cafe
etag: 18116328616323621410
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Jul 2022 02:31:33 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/ Frame 5B91 3 KB
1 KB 305ms
139ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 03:50:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1640
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Jul 2022 03:50:31 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5B91 138 KB
42 KB 325ms
324ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

sffe /

Resource Hash

29a74bd48fa0b500b61194468e760e8acef2f465e782e0da3eb219850bcea8fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:17:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43256
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1656329918998510"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 28 Jun 2022 04:17:51 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/ Frame 5B91 17 KB
7 KB 250ms
250ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 482
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Jul 2022 04:09:49 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 5B91 0
0 286ms
113ms Image
text/html 142.250.186.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ-amtRaPTf6olVjF1tF897zqRtH3SmNmn-nDko0hdjNCHiEctqEiBoTvkmgv3BZlKnNREXxXPDvuv_Z2DcYRzSXlu1mg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4261401821259978&output=html&h=280&adk=4001486692&adf=1500004090&pi=t.aa~a.4288580353~i.8~rp.4&w=720&fwrn=4&fwrnh=100&lmt=1656380139&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=3040758229&psa=0&ad_type=text_image&format=720x280&url=https%3A%2F%2Fnatutool.com%2Fhack-ff-auto-headshot%2F&fwr=0&pra=3&rh=180&rw=720&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656389875504&bpp=4&bdt=2662&idt=-M&shv=r20220623&mjsv=m202206230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1fdae3e67b9e1017-22e2d120becd0001%3AT%3D1656389870%3ART%3D1656389870%3AS%3DALNI_MbVKDNpo_H8xzDoyqAVHH-mQuLSfQ&prev_fmts=0x0&nras=2&correlator=8648122524355&frm=20&pv=1&ga_vid=909823206.1656389874&ga_sid=1656389875&ga_hid=1572151539&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=246&ady=1884&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31068195%2C42531607&oid=2&pvsid=3528220077371364&tmod=616590128&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=ENE8O1KlP8&p=https%3A//natutool.com&dtd=25
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s04-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 21b2dfe42abab24529e209ac1efa07c6.js Show response
www.gstatic.com/mysidia/ Frame 5B91 31 KB
13 KB 317ms
105ms Script
text/javascript 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/21b2dfe42abab24529e209ac1efa07c6.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

b97d2c98f8bac4ee72d075d577db22903f83ae9a2742b9caef94f0842b459348

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 23 Jun 2022 00:25:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 445938
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13060
x-xss-protection: 0
last-modified: Thu, 23 Jun 2022 00:04:46 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 21 Sep 2022 00:25:33 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame C69F 0
0 151ms
150ms Fetch
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CLz_67oC6YrSBDprt3gPE4aWwB7CXiNRq9qnP8vcPZBABII2E248BYOoBoAGwiv3DKMgBAakCBwBpz7LAsT6oAwHIA8sEqgSBAk_QduQKYi3Ag_VK6wT7N_SgsQAW5CXV6ZgqVrsHpElsNg_WEapHwkkRtcESNAQ80lHhfB5IMdP80hrQYedxSxDRUP9q9YLSXpKJe68ib-KrI8DexWRzWhzo0Mx2AYtVvVoZWQkRMgrLyYDvCOzxcVsBx6pjfPNa4me2EiiRcVU6EXrBSfM6ZKJhgQhGpDQquTTfysOuer3wPPjoFmkXwDybkw231Z6Z0C_gVyJccunuojhEC-q8Az10dYcGdhTs8juw9NsQ7dljrnrH4BaddmiC4O8rsV1NO9MnSwANbOvS2qCAXiR5QY4pa0YsCFQbTyaHrsxU36Vcx_9XtwLOJD1ZwATfq5Ps-wOAB7DCzaMDqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQuZEE0ggRCIDhgBAQARgfMgKqAjoCgECACgHICwHYEwOIFALQFQGAFwGyFxwKGggAEhRwdWItNDI2MTQwMTgyMTI1OTk3OBgA&sigh=JWXWliJ7qlI&uach_m=[UACH]

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 28 Jun 2022 04:17:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 0F8E 143 B
163 B 104ms
104ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

age: 2106
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Tue, 28 Jun 2022 03:42:45 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220623/r20110914/ Frame C35F 21 KB
8 KB 318ms
104ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220623/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4261401821259978&output=html&h=280&adk=3384979410&adf=2554181317&pi=t.aa~a.3735058315~rp.4&w=370&fwrn=4&fwrnh=100&lmt=1656380139&rafmt=1&to=qs&pwprc=3040758229&psa=0&format=370x280&url=https%3A%2F%2Fnatutool.com%2Fhack-ff-auto-headshot%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656389875504&bpp=1&bdt=2662&idt=1&shv=r20220623&mjsv=m202206230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1fdae3e67b9e1017-22e2d120becd0001%3AT%3D1656389870%3ART%3D1656389870%3AS%3DALNI_MbVKDNpo_H8xzDoyqAVHH-mQuLSfQ&prev_fmts=0x0%2C720x280&nras=3&correlator=8648122524355&frm=20&pv=1&ga_vid=909823206.1656389874&ga_sid=1656389875&ga_hid=1572151539&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1419&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31068195%2C42531607&oid=2&pvsid=3528220077371364&tmod=616590128&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=2&fsb=1&xpc=dP71vToC9V&p=https%3A//natutool.com&dtd=33

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

a2625083f682f667dbd0121720f86b02cc023e7cc2c36d1fad2d1a3dbe0b8cc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 03:55:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1365
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8671
x-xss-protection: 0
server: cafe
etag: 18116328616323621410
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Jul 2022 03:55:06 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame C35F 8 KB
716 B 115ms
114ms Stylesheet
text/css 142.250.185.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f10.1e100.net

Software

ESF /

Resource Hash

684dfe949ae87a38c2afbcee199f51b0025dd9121b524d62e881cf40846cdd21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 28 Jun 2022 03:49:02 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 28 Jun 2022 04:17:51 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 28 Jun 2022 04:17:51 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220613_RC00/ Frame C35F 14 KB
3 KB 329ms
105ms Stylesheet
text/css 142.250.186.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220613_RC00/outstream.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.170 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f10.1e100.net

Software

sffe /

Resource Hash

48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 27 Jun 2022 14:11:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50806
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2798
x-xss-protection: 0
last-modified: Mon, 13 Jun 2022 10:41:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 27 Jun 2023 14:11:05 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220613_RC00/ Frame C35F 351 KB
121 KB 332ms
108ms Script
text/javascript 142.250.186.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220613_RC00/outstream.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.170 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f10.1e100.net

Software

sffe /

Resource Hash

fd48ba2cec7ec8424c38af70d7516e7ce54aab084c075020f7e2a420d042a1da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 27 Jun 2022 14:11:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50806
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 123964
x-xss-protection: 0
last-modified: Mon, 13 Jun 2022 10:41:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 27 Jun 2023 14:11:05 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/ Frame C35F 17 KB
7 KB 321ms
108ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220623/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 482
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Jul 2022 04:09:49 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame C35F 0
0 332ms
112ms Image
text/html 142.250.186.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTsOROn7Fs3us5NtnhM055GPdrklghl5rCgRKRixgWXnpK9S6NL11YlTGJkdJOhiSs_RpJIPr46FVTZ4-YBRB_k1KeQRw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4261401821259978&output=html&h=280&adk=3384979410&adf=2554181317&pi=t.aa~a.3735058315~rp.4&w=370&fwrn=4&fwrnh=100&lmt=1656380139&rafmt=1&to=qs&pwprc=3040758229&psa=0&format=370x280&url=https%3A%2F%2Fnatutool.com%2Fhack-ff-auto-headshot%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656389875504&bpp=1&bdt=2662&idt=1&shv=r20220623&mjsv=m202206230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1fdae3e67b9e1017-22e2d120becd0001%3AT%3D1656389870%3ART%3D1656389870%3AS%3DALNI_MbVKDNpo_H8xzDoyqAVHH-mQuLSfQ&prev_fmts=0x0%2C720x280&nras=3&correlator=8648122524355&frm=20&pv=1&ga_vid=909823206.1656389874&ga_sid=1656389875&ga_hid=1572151539&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1419&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31068195%2C42531607&oid=2&pvsid=3528220077371364&tmod=616590128&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=2&fsb=1&xpc=dP71vToC9V&p=https%3A//natutool.com&dtd=33
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s04-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame C69F 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0d579fe25308b69603f13d7c50c772e621bc9b7ffe7b2e43e382a0d8a1fce70b

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame CCE6 143 B
163 B 104ms
103ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

age: 2106
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Tue, 28 Jun 2022 03:42:45 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 5B91 0
0 149ms
148ms Fetch
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CF6MP7oC6YpaWOtLJ1fAPreeJoA-b5Yq0aebNrdvWDrHd8MTLARABII2E248BYOoBoAGWq-akA8gBAakCBwBpz7LAsT6oAwHIA8sEqgT1AU_Q_DWLkMLXUWJMbXtttaNIs2QrhMPucFQOAHqe4buKoSJ71BllVYEURGsWvxoXQ0SNPBE8hltrGWe4tjzcBDc7_a5uB2Y5mRxjdd_lI46WHKjielkGFaKQZqOuGTGzFTi7ualD3KtY-7n5tWixQd5LEHI_SeFkc1oiph5NiZ9IpHG5H168IHX_citLIEEUk7PeJRXVNpPqy0Joe1oXA3InM35vIq-2HPnGb_88qaW9bQW_V9fJvGReSXRjYfzW994J4rhzmNdV6K3mAV8rQ4bThUrMoLSjSY7ZxYuErjKqLfVe-Gpr2-SWSDS9MslT56VAplRbwAThyeyv2QOSBQQIBBgBkgUECAUYBIAH0tSZW6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEEPuHBdIIEQiA4YAQEAEYHzICqgI6AoBAgAoByAsB2BMNiBQM0BUBgBcBshccChoIABIUcHViLTQyNjE0MDE4MjEyNTk5NzgYAA&sigh=t8UagxaOj0w&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4261401821259978&output=html&h=280&adk=4001486692&adf=1500004090&pi=t.aa~a.4288580353~i.8~rp.4&w=720&fwrn=4&fwrnh=100&lmt=1656380139&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=3040758229&psa=0&ad_type=text_image&format=720x280&url=https%3A%2F%2Fnatutool.com%2Fhack-ff-auto-headshot%2F&fwr=0&pra=3&rh=180&rw=720&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656389875504&bpp=4&bdt=2662&idt=-M&shv=r20220623&mjsv=m202206230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1fdae3e67b9e1017-22e2d120becd0001%3AT%3D1656389870%3ART%3D1656389870%3AS%3DALNI_MbVKDNpo_H8xzDoyqAVHH-mQuLSfQ&prev_fmts=0x0&nras=2&correlator=8648122524355&frm=20&pv=1&ga_vid=909823206.1656389874&ga_sid=1656389875&ga_hid=1572151539&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=246&ady=1884&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31068195%2C42531607&oid=2&pvsid=3528220077371364&tmod=616590128&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=ENE8O1KlP8&p=https%3A//natutool.com&dtd=25
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 28 Jun 2022 04:17:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 5448 143 B
163 B 106ms
105ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4261401821259978&output=html&h=280&adk=4001486692&adf=1500004090&pi=t.aa~a.4288580353~i.8~rp.4&w=720&fwrn=4&fwrnh=100&lmt=1656380139&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=3040758229&psa=0&ad_type=text_image&format=720x280&url=https%3A%2F%2Fnatutool.com%2Fhack-ff-auto-headshot%2F&fwr=0&pra=3&rh=180&rw=720&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656389875504&bpp=4&bdt=2662&idt=-M&shv=r20220623&mjsv=m202206230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1fdae3e67b9e1017-22e2d120becd0001%3AT%3D1656389870%3ART%3D1656389870%3AS%3DALNI_MbVKDNpo_H8xzDoyqAVHH-mQuLSfQ&prev_fmts=0x0&nras=2&correlator=8648122524355&frm=20&pv=1&ga_vid=909823206.1656389874&ga_sid=1656389875&ga_hid=1572151539&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=246&ady=1884&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31068195%2C42531607&oid=2&pvsid=3528220077371364&tmod=616590128&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=ENE8O1KlP8&p=https%3A//natutool.com&dtd=25
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

age: 2106
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Tue, 28 Jun 2022 03:42:45 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame A646 1 KB
749 B 105ms
105ms Document
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

age: 80647
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Jun 2022 05:53:44 GMT
etag: 48472445140208031
expires: Tue, 28 Jun 2022 05:53:44 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 0F8E
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

131ms
130ms

Document
text/html

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 28 Jun 2022 04:17:51 GMT
expires: Tue, 28 Jun 2022 04:17:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 28 Jun 2022 04:17:51 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 NUf31DeV05jg6rbNTwXiBfRLQ8hv8NSyvu4XMwxgjz4.js Show response
pagead2.googlesyndication.com/bg/ Frame 39F2 36 KB
14 KB 104ms
104ms Script
text/javascript 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/NUf31DeV05jg6rbNTwXiBfRLQ8hv8NSyvu4XMwxgjz4.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

sffe /

Resource Hash

3547f7d43795d398e0eab6cd4f05e205f44b43c86ff0d4b2beee17330c608f3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 27 Jun 2022 19:46:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30703
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13897
x-xss-protection: 0
last-modified: Tue, 21 Jun 2022 16:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 27 Jun 2023 19:46:08 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame CCE6
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

140ms
140ms

Document
text/html

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 28 Jun 2022 04:17:51 GMT
expires: Tue, 28 Jun 2022 04:17:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 28 Jun 2022 04:17:51 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 5B91 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 49e262eba995189e52372be18915d24f14ae4536f31d4dfbf408c2dc53e3d2f2

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A646
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DARnp8GDzORIMr27O4RodqUCi9-zGKBoo10S9MtWo1Ao...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WXJxQThBQUFCVUZMV1dvSg&google_push=ARnp8GDzORIMr27O4RodqUCi9-zGKBoo10S9MtWo1AovMs9EPzar9ElQ9N4_2ksV0Xv45xOImoVucGt5LfFOBAbe-DuXbpXVm5mN

170 B
188 B

281ms
124ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WXJxQThBQUFCVUZMV1dvSg&google_push=ARnp8GDzORIMr27O4RodqUCi9-zGKBoo10S9MtWo1AovMs9EPzar9ElQ9N4_2ksV0Xv45xOImoVucGt5LfFOBAbe-DuXbpXVm5mN

Requested by

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WXJxQThBQUFCVUZMV1dvSg&google_push=ARnp8GDzORIMr27O4RodqUCi9-zGKBoo10S9MtWo1AovMs9EPzar9ElQ9N4_2ksV0Xv45xOImoVucGt5LfFOBAbe-DuXbpXVm5mN
Date: Tue, 28 Jun 2022 04:17:52 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A646
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEMQSgjlt9aYSZYYyVdOnM3k&google_cver=1&google_push=ARnp8GAbodejbVsGIPD-jiyXGUGoQbhs96j0WDppCel3RH1Hlt_Pt6G04JM5nU6Q5TLvZkIuWxM0PHAj2nu5a1ndVTj2iKu42Y4a
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=ARnp8GAbodejbVsGIPD-jiyXGUGoQbhs96j0WDppCel3RH1Hlt_Pt6G04JM5nU6Q5TLvZkIuWxM0PHAj2nu5a1ndVTj2iKu42Y4a&google_hm=Q0FFU0VNUVNnamx0OWFZU...

170 B
188 B

269ms
136ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=ARnp8GAbodejbVsGIPD-jiyXGUGoQbhs96j0WDppCel3RH1Hlt_Pt6G04JM5nU6Q5TLvZkIuWxM0PHAj2nu5a1ndVTj2iKu42Y4a&google_hm=Q0FFU0VNUVNnamx0OWFZU1pZWXlWZE9uTTNr

Requested by

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 28 Jun 2022 04:17:52 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=ARnp8GAbodejbVsGIPD-jiyXGUGoQbhs96j0WDppCel3RH1Hlt_Pt6G04JM5nU6Q5TLvZkIuWxM0PHAj2nu5a1ndVTj2iKu42Y4a&google_hm=Q0FFU0VNUVNnamx0OWFZU1pZWXlWZE9uTTNr
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A646
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DARnp8GDe4CzewOLEp6aNBu3Mcrca-iVaI_gAAXrUwC__j3IJiJHQeVZ2ZkfYIxVwjSUhgWRiJflhwot1zAVW9jddyT915VOKzS-h&google_gid=CAESEIF9yYOWNh4Q0bE0FrjY_Zw&goo...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCPCB6pUGEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BUm5wOEdEZTRDemV3T0xFcDZhTkJ1M01jcmNhLWlWYUlfZ0FBWHJVd0NfX2ozSUppSkhRZVZaMlprZllJeFZ3alNVaGdXUmlKZmxod290MXpBVlc5am...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwVWp2azJYWnJqZWp3Qnh3Z2pfMk9lMkI5aFhtZlo1aThRVHc4Wnlhak1mdw==&google_push

170 B
188 B

117ms
115ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwVWp2azJYWnJqZWp3Qnh3Z2pfMk9lMkI5aFhtZlo1aThRVHc4Wnlhak1mdw==&google_push

Requested by

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 28 Jun 2022 04:17:52 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwVWp2azJYWnJqZWp3Qnh3Z2pfMk9lMkI5aFhtZlo1aThRVHc4Wnlhak1mdw==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A646
Redirect Chain

https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEPq2WXa2SOCFXWuJaBGt86Y&google_push=ARnp8GDM21aanSa5ma1TyOI73VRXOnjRkOa9FfmR8tbgCkd5dg22kccFcCHkrnU2bTCfP3ZNLClMNOhos_SjZiqYatCF78R...
https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=ARnp8GDM21aanSa5ma1TyOI73VRXOnjRkOa9FfmR8tbgCkd5dg22kccFcCHkrnU2bTCfP3ZNLClMNOhos_SjZiqYatCF78RIdQc&google_hm=MTA4MjQyNjA5NjY5MzU...

170 B
188 B

360ms
129ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=ARnp8GDM21aanSa5ma1TyOI73VRXOnjRkOa9FfmR8tbgCkd5dg22kccFcCHkrnU2bTCfP3ZNLClMNOhos_SjZiqYatCF78RIdQc&google_hm=MTA4MjQyNjA5NjY5MzU4OTg1OTc

Requested by

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:52 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
location: https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=ARnp8GDM21aanSa5ma1TyOI73VRXOnjRkOa9FfmR8tbgCkd5dg22kccFcCHkrnU2bTCfP3ZNLClMNOhos_SjZiqYatCF78RIdQc&google_hm=MTA4MjQyNjA5NjY5MzU4OTg1OTc
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame A646 43 B
351 B 324ms
110ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEDBZe3rWO09OO_OfjmlkKMI&google_cver=1&google_push=ARnp8GDrq83CFeUgvG-vsudV7Bj3sopnrFk-NGk3YXn0dr2CCb9d1D-DPUqP9Pr9FTxfVNH--Vs9jkuCtNzD9UfnDQUxNrzb33qH
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4261401821259978&output=html&h=280&adk=4001486692&adf=1500004090&pi=t.aa~a.4288580353~i.8~rp.4&w=720&fwrn=4&fwrnh=100&lmt=1656380139&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=3040758229&psa=0&ad_type=text_image&format=720x280&url=https%3A%2F%2Fnatutool.com%2Fhack-ff-auto-headshot%2F&fwr=0&pra=3&rh=180&rw=720&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656389875504&bpp=4&bdt=2662&idt=-M&shv=r20220623&mjsv=m202206230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1fdae3e67b9e1017-22e2d120becd0001%3AT%3D1656389870%3ART%3D1656389870%3AS%3DALNI_MbVKDNpo_H8xzDoyqAVHH-mQuLSfQ&prev_fmts=0x0&nras=2&correlator=8648122524355&frm=20&pv=1&ga_vid=909823206.1656389874&ga_sid=1656389875&ga_hid=1572151539&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=246&ady=1884&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31068195%2C42531607&oid=2&pvsid=3528220077371364&tmod=616590128&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=ENE8O1KlP8&p=https%3A//natutool.com&dtd=25
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:51 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 7ctunhlpg94ul8sdqsvsrgduvf3hamr4

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A646
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEL8yrDqjPp0JuFu3GNQrwIo&google_cver=1&google_push=ARnp8GBoBKnplLqgx2otPAxqC2rpOC36fSdcya-Kun3IQz7y4NffCI3CcLigXoaxDmIOGbRFkI9...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDRYTlJINVUtRC0zV0Q0&google_push=ARnp8GBoBKnplLqgx2otPAxqC2rpOC36fSdcya-Kun3IQz7y4NffCI3CcLigXoaxDmIOGbRFkI9OwRJcdwtpO8AfALQaVZX34Xaw

170 B
188 B

217ms
123ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDRYTlJINVUtRC0zV0Q0&google_push=ARnp8GBoBKnplLqgx2otPAxqC2rpOC36fSdcya-Kun3IQz7y4NffCI3CcLigXoaxDmIOGbRFkI9OwRJcdwtpO8AfALQaVZX34Xaw

Requested by

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDRYTlJINVUtRC0zV0Q0&google_push=ARnp8GBoBKnplLqgx2otPAxqC2rpOC36fSdcya-Kun3IQz7y4NffCI3CcLigXoaxDmIOGbRFkI9OwRJcdwtpO8AfALQaVZX34Xaw
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Expires: 0

GET
H2 200 trk
ag.innovid.com/ Frame A646 43 B
297 B 488ms
104ms Image
image/gif 35.179.81.5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESED2UGm-ngEYEpV6LmVtzGTA&google_cver=1&google_push=ARnp8GBlBIQeB9hItFDPtToeWePlKkw3DLqWDoBEBWKSEDEWUsfEArQmaUCPMzQzkV5SaxFiDyTzGk2fVQsF4Oo3SDBR9bRBnE9b
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4261401821259978&output=html&h=280&adk=4001486692&adf=1500004090&pi=t.aa~a.4288580353~i.8~rp.4&w=720&fwrn=4&fwrnh=100&lmt=1656380139&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=3040758229&psa=0&ad_type=text_image&format=720x280&url=https%3A%2F%2Fnatutool.com%2Fhack-ff-auto-headshot%2F&fwr=0&pra=3&rh=180&rw=720&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656389875504&bpp=4&bdt=2662&idt=-M&shv=r20220623&mjsv=m202206230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1fdae3e67b9e1017-22e2d120becd0001%3AT%3D1656389870%3ART%3D1656389870%3AS%3DALNI_MbVKDNpo_H8xzDoyqAVHH-mQuLSfQ&prev_fmts=0x0&nras=2&correlator=8648122524355&frm=20&pv=1&ga_vid=909823206.1656389874&ga_sid=1656389875&ga_hid=1572151539&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=246&ady=1884&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31068195%2C42531607&oid=2&pvsid=3528220077371364&tmod=616590128&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=ENE8O1KlP8&p=https%3A//natutool.com&dtd=25
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.179.81.5 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-179-81-5.eu-west-2.compute.amazonaws.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:52 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame A646 0
78 B 118ms
113ms Image
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JgHRxpEmryYomG7NaPg7CwvIJBKu5geASELduOw8-dLzGkUJhh47smwt8ErSWsTO93eCT6

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:17:51 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 5448
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

128ms
123ms

Document
text/html

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 28 Jun 2022 04:17:52 GMT
expires: Tue, 28 Jun 2022 04:17:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 28 Jun 2022 04:17:51 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 NUf31DeV05jg6rbNTwXiBfRLQ8hv8NSyvu4XMwxgjz4.js Show response
pagead2.googlesyndication.com/bg/ Frame BF54 36 KB
14 KB 105ms
104ms Script
text/javascript 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/NUf31DeV05jg6rbNTwXiBfRLQ8hv8NSyvu4XMwxgjz4.js

Requested by

Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

sffe /

Resource Hash

3547f7d43795d398e0eab6cd4f05e205f44b43c86ff0d4b2beee17330c608f3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 27 Jun 2022 19:46:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30704
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13897
x-xss-protection: 0
last-modified: Tue, 21 Jun 2022 16:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 27 Jun 2023 19:46:08 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame 5B91 28 KB
28 KB 409ms
108ms Font
font/woff2 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 08:44:44 GMT
x-content-type-options: nosniff
age: 502388
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 22 Jun 2023 08:44:44 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame C35F 0
327 B 390ms
131ms Ping
image/gif 142.250.180.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~l4xnrknu&c=6784480047745&slotId=3392240023872.5&qqid=CLyJ-Y6lz_gCFRVkFQgd5E0H0g&fb=outstream-lima&sei=44729911%2C44730425%2C44730426%2C44752538%2C420706098&nsei=44714510%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220613_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.180.163 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: mil04s44-in-f3.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:52 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame C35F 15 KB
16 KB 422ms
121ms Font
font/woff2 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 08:44:49 GMT
x-content-type-options: nosniff
age: 502383
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 22 Jun 2023 08:44:49 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2
fonts.gstatic.com/s/roboto/v30/ Frame C35F 12 KB
12 KB 493ms
191ms Font
font/woff2 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

fc66f942651a9fe1a598770d3d896529dcd7a03d02f40655451513093103e61b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 27 Jun 2022 17:04:23 GMT
x-content-type-options: nosniff
age: 40409
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11824
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 27 Jun 2023 17:04:23 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame C35F 15 KB
15 KB 464ms
163ms Font
font/woff2 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 27 Jun 2022 11:07:47 GMT
x-content-type-options: nosniff
age: 61805
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 27 Jun 2023 11:07:47 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C35F 0
20 B 138ms
138ms Image
image/gif 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=CTqTB7oC6YrzaOpXI1fAP5JudkA3Lybjsau3t5a72D-74wbKKDhABII2E248BYOoBoAGmq7m3KMgBBagDAcgDmwSqBI0CT9D6AeA3QXxsPH70b0Jw3oY2tdhn7Aq8rKjmUbuo0gltsPQsgce_M_fI8Mm5KjndW5yaN8rg8RJ5BbijtwDPHRx2eYEMXwUN4QhtzQ0FD1pKJW3rMph4WW6vnIffmdV2tGqnhY5Uc_jRcQyHERhy1R5kuoK3ldM5uDAVK_KlwzsBNogoi-JGHMOr-DfEPax3V4QRLwn0Zi8qquFdZXWtln2navhUrfdQynD6DegTLbYAVxkcajra9DPeHdqnL-jF83tdfnnYO88ADdSDaB9ZevyBcUG8pxxiftIbCoWXASD_gV0E3dnQtChaxsg2jyXMUd3ZOII7JP_I-Ql02OQ3xgVtdCkBmfHUoqoUjNHABKKEzqGCBOAEA5AGAaAGdoAHpuOJlwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCBEIgOGAEBABGB8yAqoCOgKAQIAKAcgLAeALAYAMAbATovTAD8gT0J2l4APQEwDYEwqIFALYFAHQFQH4FgGAFwE&eventType=clickstring&clientTime=1656389876839&ai=CTqTB7oC6YrzaOpXI1fAP5JudkA3Lybjsau3t5a72D-74wbKKDhABII2E248BYOoBoAGmq7m3KMgBBagDAcgDmwSqBI0CT9D6AeA3QXxsPH70b0Jw3oY2tdhn7Aq8rKjmUbuo0gltsPQsgce_M_fI8Mm5KjndW5yaN8rg8RJ5BbijtwDPHRx2eYEMXwUN4QhtzQ0FD1pKJW3rMph4WW6vnIffmdV2tGqnhY5Uc_jRcQyHERhy1R5kuoK3ldM5uDAVK_KlwzsBNogoi-JGHMOr-DfEPax3V4QRLwn0Zi8qquFdZXWtln2navhUrfdQynD6DegTLbYAVxkcajra9DPeHdqnL-jF83tdfnnYO88ADdSDaB9ZevyBcUG8pxxiftIbCoWXASD_gV0E3dnQtChaxsg2jyXMUd3ZOII7JP_I-Ql02OQ3xgVtdCkBmfHUoqoUjNHABKKEzqGCBOAEA5AGAaAGdoAHpuOJlwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCBEIgOGAEBABGB8yAqoCOgKAQIAKAcgLAeALAYAMAbATovTAD8gT0J2l4APQEwDYEwqIFALYFAHQFQH4FgGAFwE

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame C35F 28 KB
16 KB 376ms
138ms XHR
text/xml 74.125.140.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-CADXzjGxggPseePHRV0uuOFhpRmAeyPKAen6Huprgbkh4G6k12XN3mTUcUPcBLogg95OEegrS4tnfoiio0Du4dBXVkyg&cry=1&dbm_d=AKAmf-AqRtozJirhs60LFiePCkJwcTFMtWrbKgtdeIZZJ2LwfFi_tpLa9z7NmTj4gU6mYRJ5Lst_Wz5wu3p5uueyIqh2X4AczIXrBe8SGYZD3LpjFPlCa1nmc8eXkkIRE1H9nF_EZxkZz7jArbfNbQxhaTk1cjVl-JJZaW26qAW2O3Ch7KOgkEaMoNJkaoCpwWSqIhZQS1T-STZtZt1i-60sl6ZzhgqxRdRjLe7eU3e1YBglENQuzQAn9sBqPv-CBUnfNl3ptK8G--no3Ma4VrPg-gSpPudI3QACus3nfeifzlFehIOb1YSmfhjv1_18G3uti2f_qYZ3zJv8u5UujK0riop3tyiIKYbMWnezXyEy8jhr5UmtMfZAcrsyYgdvFEQtZWiMlahYHUUI8iBcb_eKYiAOHjpYotU6bdyoTgThz_gWMFiLknl1G9b-vYL4Zo10tgB-MMUtAuyavQMANx4WQP175_A5igowZXaa9HdyMqxmi0aFYbG7i6_iq20cBjg6djXPpowkb755ozKvhEzQL7h6_ffap5rVE2tjaGoQYxw6QOsAp7qSGF_Xv9zDogXj4ztDz8H4-Q5tkxvXoeMA5P4qEL7S40h3sEYh3yKV_DcTdYM8rTB7wgP4O4mU4rQBN6TGe01a5VHlKcwUtAAvZM03TPLdrJkxeF73BKJBaLnjvMHv1vkYDnfIYMOZ0GCWxA0nMLhK1fDHyFBiIyHsDqMZMxNiHnV-63H0wrA8Urtan4GCYe4IUODJIcy69gcGCJ4tUGia6ose7Sb0L2mTmSWzFUeGMksV4YhYX32qHm92EV4PtacxNpqTUBSXqkVU8FGHvbwbC-2fBnVKpLemSwIWN8GmCTU3C4foxEam1UMzyVJYJ-sug8DCUlKvU-CMjtdh9eS-XTjPoDqO3-IItfkhXznwyiSdLLpvfVlax8F8ILpq5fx7AR8sAv4HCLFEBEOH9DuDSY5g-E-phPVnylvAuTvp_liDyOddU57J8Ugnw6sKBbU_2NTw4zUH5LBKUr3HOAbC8_-_tu13zn6jSxCbWC2dspqbACa8s9zryLEeJVrJaVKPF97A7fjg8mSm5XBQ2nWlvGj1t_fxzZ_ZWyYJh1S8iXsw3bodJzznLC6cdHvGOg96ER-vKZbYT8U9Gw-xWl8nQl6n5PCp77hFWOGymGfna2i2dV06puCxIaiailzEpI955UKwQ5ZdC7UyD-cQoANuY0flGMg9fH2EmPYnMMofnEOUl-PSWJnUd8YDmJC251w8hjuzzv4er8zJmRsnoysT9LkP1-ASNdEEtNxqWy2TP-S8862swbxHtISc9Jr_WYFOWZDpD7HK-jF-sBscBRHiVQvBZ0IKAjiyr4tDTFEtwU45UnWUcni-PZFKZiwgd0eurnesHomkb0WIgYy5rM9anIEceHf-ozbXf0n8O6LFC_mRks7wSRD_S-JCDRSp9goCMD252Ky9zRzeoQNYd5HV-A2aoa7x7PJ5jXo7WAWdc2t-C_ITK5Sl-6HtDqf1O46gnWao5QK2MVlODrXSzGrX9VwLAAQlmhE7w-F5orBabtMkTah7070RhlH72u7IFB_tqs_kIgOGWxegZgmyFRrOqli1tLgdCZs80wq4mQnGoxbIxbhoR79HY05l4kOlDeiCpTemvkG7oYpDv4h08dgxahHoT3M0LSm0JKtbYpmM8MDJK--mNuQEEIeeZgaD_kbrEWpmlIHz2mChEeZYFCcjNVyc77kkhVmm5e6ca3vEyCILePGbHewewYBPY9fugNzMEtewR2WXrZAqhDB3NT0mfZuX1C_BFRPskCI8NHmogVoswON1LTI4I6iTOAq3NRwscX9zye6IcaU5F1d4yGZm_9iBtEShSGmMp2IUggjr8uWQuKP3FtsKZQ6Xnq00WN7J30_JiZJx1Ne3x5uMX6ePc9su4Y6PKWgaIVuBgFE8QXkLiSuZSq6qAZrHtVdyFWvKFFpalt16I_kNMorFUehBvqvzRz_b5DKHg5I24M1izzmqr4eg0IJTe3D3aIzOWeSlcQW5SEaSQWCgRGKnbHmMO6EOdnd9x5A4QlpUz4v3_oLLRT1a4UOM58qlRwEoDq5bxEyPgquKg8yDL46AXq-NoEENcQmo4yeRT34fzPk6fXZM-E8T-YDPdRTsR6bfss0jXYML-izez8NVPiE6uFa_GcMtz8J-9o9PDF4WejFap2KKRligZXh34WjyDKKJj3N_aYVhh_V89SdjkhmLvpx-ceTM8GpcZ1g3DPo0wJ8s54WtpbkT7hyrfQRgnYUtOw_sjX_6rDv4G-V_TbvsV_Fj42GYlahqbCfpSHlLhbHrodD1elixOMI1mXfudU5gATGUoA6M-fXN8N2bnB-w4DVrdpO5GV502FZhErCOR_xqZ7kMt2ZBuz7ZQebaoFQWeM_mu-OLqXCNtxcEuTGmfJD2mrn1E7_xjwzVzavffyDISbqcFxrVZKpuWliVgkWHpZfDOyXi0gJioESjnuXeCxwdn5_HadotTg1c5JudunEUKUMfhwPTdSwnStlA588n85A2dyzy9os_Z8FLSH3JYt5xXkeDKgS7epxO8skUvTOpTX7vyU3SYXuc3ZJbvYrBvNtq1NNf6J8lyM9NJzYe27kFVbs67sPv28XuY5zim8pbJQ7LfiplhYpw-loqW35JsTZ6tlBLBkVID5w31PMsoPvv4hVcXxnAxBsJv-oyI2DrOwxQBWn-ZkARLsw5IPSe3Cn3F3VivzzbJLZIcC4861qpsHEm0diBbTzjGMtCTJhXWa3hrkYDTZv9ye9gItHPQ--OsFvcTsSY5Z1bJWWBVWNFPy-lD36SLO2d_r1L3qWwsW_L7qRgYxuf8tBD0GhY3f5YW6kGaEhpElpI1ryrgm7l4rawPUjTWR_bJK6Y3s3XyIPdi78l6B1dY5VzBgy3lH8I9ZytZxANpNPJkueDiH281sXGqFtfURp-TY0NX_L08Y5Mo5qZAZLIovDhUt6ZFZ6WgeZ5HZQJ5j5ihGbyixokgkcic1f5j97Sqxz4ouDihBL-L_UhNTbagdCMXBCwxV_ZPebQc_wwZ7UoF-omh2UQxgmagiEKGBbsYXjO2J_q-6AN2e5-ITIH8jkD-nkFLRa28L6Ehcu9puehgKVQ8vTrjxcEBg1VLwpXth9Fe1CFclp0GRqtMnvqxd8kD2_R6FPX_0SxLX8foy6EXJw6fqyWWdBsqu9vULZ2P-JEfH6kQCh8crpg5fbtjehvGmd7LFc807cMM9d4J0HkEYDkkzx4gm0YhWAqC7rFxkExSDv6IqmSo4A21N7C0phFzDc-AI-lJV1YpuBut4FZ5BpPMy2elkVFRpQUjD0DkaQDsXJiwpzuIx5JoQyiQ5i4QoUA6Yo&cid=CAASJORodBrRoYSeXCWncvN3FuAdjeuYCk8hOkOBgcELG2o0InVqMA&sdkv=h.0.0.0&osd=2&frm=2&vis=1&sdr=1

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220613_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.140.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wq-in-f156.1e100.net

Software

cafe /

Resource Hash

a9052109e22a8dd392b2027c99e6270a7e89651bd3f34967c3637e16b74472ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:17:52 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15326
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame C35F 0
0 143ms
143ms Fetch
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CaI4P7oC6YrzaOpXI1fAP5JudkA3Lybjsau3t5a72D-74wbKKDhABII2E248BYOoBoAGmq7m3KMgBBagDAaoEigJP0PoB4DdBfGw8fvRvQnDehja12GfsCrysqOZRu6jSCW2w9CyBx78z98jwybkqOd1bnJo3yuDxEnkFuKO3AM8dHHZ5gQxfBQ3hCG3NDQUPWkolbesymHhZbq-ch9-Z1Xa0aqeFjlRz-NFxDIcRGHLVHmS6greV0zm4MBUr8qXDOwE2iCiL4kYcw6v4N8Q9rHdXhBEvCfRmLyqq4V1lda2Wfadq-FSt91DKcPoN6BMttgBXGRxqOtr0M94d2qcv6MXze11-edg7zwAN1INoH1l6pIDrtC81WvCKHbYrZDospD7l28XGQR2VsL_m1jwLLOVJJ0Ph5r3HYd_XEfFbMRZe6sljBRlvC2GDS8AEooTOoYIE4AQDiAWXoKW5QJIFBggDEAIYAZIFBggdEAQYAZIFBggdEAEYAZIFBggeEAEYAZAGAaAGdoAHpuOJlwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHChDFxAwYneKszAHSCBEIgOGAEBABGB8yAqoCOgKAQIAKAcgLAbATovTAD8gT0J2l4APQEwDYEwqIFALYFAHQFQGAFwGyFxwKGggAEhRwdWItNDI2MTQwMTgyMTI1OTk3OBgA&sigh=tP8iZZqWy8Q&uach_m=[UACH]&cid=CAQSOwCNIrLM7k95lQz7Torr76g0UK_QVLnRvkf1qF9xJ44zRz8XVDswUfmJ2J4lN8e6C8K1UoU5y0O5gUCe&vt=10

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4261401821259978&output=html&h=280&adk=3384979410&adf=2554181317&pi=t.aa~a.3735058315~rp.4&w=370&fwrn=4&fwrnh=100&lmt=1656380139&rafmt=1&to=qs&pwprc=3040758229&psa=0&format=370x280&url=https%3A%2F%2Fnatutool.com%2Fhack-ff-auto-headshot%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656389875504&bpp=1&bdt=2662&idt=1&shv=r20220623&mjsv=m202206230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1fdae3e67b9e1017-22e2d120becd0001%3AT%3D1656389870%3ART%3D1656389870%3AS%3DALNI_MbVKDNpo_H8xzDoyqAVHH-mQuLSfQ&prev_fmts=0x0%2C720x280&nras=3&correlator=8648122524355&frm=20&pv=1&ga_vid=909823206.1656389874&ga_sid=1656389875&ga_hid=1572151539&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1419&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31068195%2C42531607&oid=2&pvsid=3528220077371364&tmod=616590128&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=2&fsb=1&xpc=dP71vToC9V&p=https%3A//natutool.com&dtd=33
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 28 Jun 2022 04:17:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame DED7 1 KB
749 B 104ms
104ms Document
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

age: 80648
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Jun 2022 05:53:44 GMT
etag: 48472445140208031
expires: Tue, 28 Jun 2022 05:53:44 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame C35F 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e252130921f27ce13d97766404376f55002f8cf3d87ada342cf3ba83d1cc812c

Request headers

accept-language: is-IS,is;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DED7
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEJISDHxs5v4a44B3jIG1mE8&google_cver=1&google_push=ARnp8GAOdjJ366Kh2n8q-5ldVkM2pENh2KKP9mlrFJQKC0HyHQ3OqQmjTw...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ARnp8GAOdjJ366Kh2n8q-5ldVkM2pENh2KKP9mlrFJQKC0HyHQ3OqQmjTwWXrNfaIPo3zcCp4TVqUCNeMNvYSJkXDuWNJusmu28&google_hm=AA

170 B
188 B

114ms
114ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ARnp8GAOdjJ366Kh2n8q-5ldVkM2pENh2KKP9mlrFJQKC0HyHQ3OqQmjTwWXrNfaIPo3zcCp4TVqUCNeMNvYSJkXDuWNJusmu28&google_hm=AA

Requested by

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:52 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ARnp8GAOdjJ366Kh2n8q-5ldVkM2pENh2KKP9mlrFJQKC0HyHQ3OqQmjTwWXrNfaIPo3zcCp4TVqUCNeMNvYSJkXDuWNJusmu28&google_hm=AA
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DED7
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DARnp8GDnF4b3D5rVkeXhtl1qJhc3T-DMk6-1jY4Li2L...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WXJxQThBQUFBQXhzelU0cA&google_push=ARnp8GDnF4b3D5rVkeXhtl1qJhc3T-DMk6-1jY4Li2L9UriRKCsVO6D5xufKPNEmRnbf-vsYgpZByBf90aDQwDlUpiMVDxeC4sTH

170 B
188 B

131ms
129ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WXJxQThBQUFBQXhzelU0cA&google_push=ARnp8GDnF4b3D5rVkeXhtl1qJhc3T-DMk6-1jY4Li2L9UriRKCsVO6D5xufKPNEmRnbf-vsYgpZByBf90aDQwDlUpiMVDxeC4sTH

Requested by

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WXJxQThBQUFBQXhzelU0cA&google_push=ARnp8GDnF4b3D5rVkeXhtl1qJhc3T-DMk6-1jY4Li2L9UriRKCsVO6D5xufKPNEmRnbf-vsYgpZByBf90aDQwDlUpiMVDxeC4sTH
Date: Tue, 28 Jun 2022 04:17:52 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DED7
Redirect Chain

https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEJOmPAWOtIgD3RGJrva5J1Q&google_push=ARnp8GAr39oE75013im8M5Kd6c32HcVIhsrVR6hDBmRigO0eGW-U332ZnsIo_pP_d9KKMZ9_Km92JxUTn60PXpVBin7VGXz...
https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=ARnp8GAr39oE75013im8M5Kd6c32HcVIhsrVR6hDBmRigO0eGW-U332ZnsIo_pP_d9KKMZ9_Km92JxUTn60PXpVBin7VGXzgxDTl&google_hm=MTA4MjQyNjA5NjY5Mz...

170 B
188 B

118ms
117ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=ARnp8GAr39oE75013im8M5Kd6c32HcVIhsrVR6hDBmRigO0eGW-U332ZnsIo_pP_d9KKMZ9_Km92JxUTn60PXpVBin7VGXzgxDTl&google_hm=MTA4MjQyNjA5NjY5MzU4OTg1OTc

Requested by

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:52 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
location: https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=ARnp8GAr39oE75013im8M5Kd6c32HcVIhsrVR6hDBmRigO0eGW-U332ZnsIo_pP_d9KKMZ9_Km92JxUTn60PXpVBin7VGXzgxDTl&google_hm=MTA4MjQyNjA5NjY5MzU4OTg1OTc
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame DED7 43 B
64 B 223ms
111ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEF0cT1TjR-QzdhNhB-8s1SQ&google_cver=1&google_push=ARnp8GAJttAh9uCw5pkqEwGAGEaew9BqCewAsuBnNLz3KISAgf4e3aboLbk4eoe0btvfeSh3nz1IzCpY5J-jDdwiKcWsO2f66mYW
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4261401821259978&output=html&h=280&adk=3384979410&adf=2554181317&pi=t.aa~a.3735058315~rp.4&w=370&fwrn=4&fwrnh=100&lmt=1656380139&rafmt=1&to=qs&pwprc=3040758229&psa=0&format=370x280&url=https%3A%2F%2Fnatutool.com%2Fhack-ff-auto-headshot%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1656389875504&bpp=1&bdt=2662&idt=1&shv=r20220623&mjsv=m202206230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1fdae3e67b9e1017-22e2d120becd0001%3AT%3D1656389870%3ART%3D1656389870%3AS%3DALNI_MbVKDNpo_H8xzDoyqAVHH-mQuLSfQ&prev_fmts=0x0%2C720x280&nras=3&correlator=8648122524355&frm=20&pv=1&ga_vid=909823206.1656389874&ga_sid=1656389875&ga_hid=1572151539&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1015&ady=1419&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31068195%2C42531607&oid=2&pvsid=3528220077371364&tmod=616590128&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=2&fsb=1&xpc=dP71vToC9V&p=https%3A//natutool.com&dtd=33
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:51 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: gjh5iabtinrarr2s4athbmp3ru6406ek

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DED7
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=eysgc1hkR56ny_1xKTYK-Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

115ms
114ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=eysgc1hkR56ny_1xKTYK-Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ARnp8GBkfgrQWRNuY5tkG6lqQjABUPEzwz3JYZUXLVs7xdVFZJ39Nh9d6m5lmlvoUbVzPnZAiJtjJnsUjipUijdIG31PlMa34I6I

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=eysgc1hkR56ny_1xKTYK-Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ARnp8GBkfgrQWRNuY5tkG6lqQjABUPEzwz3JYZUXLVs7xdVFZJ39Nh9d6m5lmlvoUbVzPnZAiJtjJnsUjipUijdIG31PlMa34I6I
date: Tue, 28 Jun 2022 04:17:51 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DED7
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDkS6AkVIo5GrrXZPmk-x6Q&google_cver=1&google_push=ARnp8GD0UMb1voVjSdA2F-JRb-OXh-5Sai_epFBextlt8Wg-wQq0BIX5ae8vTFb1CqCL68hECuo...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDRYTlJIOVMtMTEtREk2Vw==&google_push=ARnp8GD0UMb1voVjSdA2F-JRb-OXh-5Sai_epFBextlt8Wg-wQq0BIX5ae8vTFb1CqCL68hECuoJgrS7sMqLRMU7gr49TMtNIClz

170 B
188 B

122ms
121ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDRYTlJIOVMtMTEtREk2Vw==&google_push=ARnp8GD0UMb1voVjSdA2F-JRb-OXh-5Sai_epFBextlt8Wg-wQq0BIX5ae8vTFb1CqCL68hECuoJgrS7sMqLRMU7gr49TMtNIClz

Requested by

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDRYTlJIOVMtMTEtREk2Vw==&google_push=ARnp8GD0UMb1voVjSdA2F-JRb-OXh-5Sai_epFBextlt8Wg-wQq0BIX5ae8vTFb1CqCL68hECuoJgrS7sMqLRMU7gr49TMtNIClz
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Expires: 0

GET

https://ssum-sec.casalemedia.com%2C%20r10.lb.indexww.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEBz4t0n092OBklXXyYPWAHE&google_push=ARnp8GBGvj7j--mKSEnBHVGNiQGCP-OZYACrquZ74-ym8KAXFYVLJ8qPutQxd1pGVdMO6ex5SQCkmi20SSRFY3_3PTrFGXxVqIE&s=184023&C=1
https://ssum-sec.casalemedia.com%2C%20r10.lb.indexww.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEBz4t0n092OBklXXyYPWAHE&google_push=ARnp8GBGvj7j--mKSEnBHVGNiQGCP-OZYACrquZ74-ym8KAXFYVLJ8qPutQxd1pGVdMO6ex5SQCkmi20SSRFY3_3PTrFGXxVqIE&s=184023&C=1 Frame DED7
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEBz4t0n092OBklXXyYPWAHE&google_cver=1&googl...
https://ssum-sec.casalemedia.com%2C%20r10.lb.indexww.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEBz4t0n092OBkl...

0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame DED7 0
12 B 231ms
121ms Image
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JqbnzRvtxs6xgEdRiN24MlF2cuKpCFOgAM23tKuvQbP4ynNAsK-5AHk3rYPGjPhQ3Rsqvo

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:17:52 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 bc7c0d449c410dbcd8d491dc1b6dccee
secure.gravatar.com/avatar/ 2 KB
2 KB 349ms
104ms Image
image/jpeg 192.0.73.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/bc7c0d449c410dbcd8d491dc1b6dccee?s=140&d=mm&r=g
Requested by: Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 75c48da0c2de6b357969f59ffb9152a2239089397ee29715d9cab44e3c26e80c

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT ams 2
date: Tue, 28 Jun 2022 04:17:52 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="bc7c0d449c410dbcd8d491dc1b6dccee.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/bc7c0d449c410dbcd8d491dc1b6dccee?s=140&d=mm&r=g>; rel="canonical"
content-length: 2094
expires: Tue, 28 Jun 2022 04:22:52 GMT

GET
H2 200 plants-vs-zombies-2-390x220.jpg
natutool.com/wp-content/uploads/2022/04/ 18 KB
18 KB 416ms
413ms Image
image/jpeg 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://natutool.com/wp-content/uploads/2022/04/plants-vs-zombies-2-390x220.jpg
Requested by: Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 38bc1b3a152aa82b36dd8edb065c627e8ebcfc8d949dd03f1212c0d56114219f

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/hack-ff-auto-headshot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
date: Tue, 28 Jun 2022 04:17:52 GMT
last-modified: Thu, 14 Apr 2022 10:02:01 GMT
server: nginx
etag: "6257f119-4791"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 18321
expires: Thu, 28 Jul 2022 04:17:52 GMT

GET
H2 200 office-365-e5-mien-phi-220x150.jpg
natutool.com/wp-content/uploads/2021/09/ 7 KB
7 KB 417ms
413ms Image
image/jpeg 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://natutool.com/wp-content/uploads/2021/09/office-365-e5-mien-phi-220x150.jpg
Requested by: Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: acd0f2b4b19641fb0a2214038f24c7adf782616b576bba2d9581d1923fb146f2

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/hack-ff-auto-headshot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
date: Tue, 28 Jun 2022 04:17:52 GMT
last-modified: Thu, 09 Sep 2021 03:07:30 GMT
server: nginx
etag: "61397a72-1b1f"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 6943
expires: Thu, 28 Jul 2022 04:17:52 GMT

GET
H2 200 active-Office-2019-Professional-Plus-220x150.jpg
natutool.com/wp-content/uploads/2021/05/ 8 KB
8 KB 417ms
414ms Image
image/jpeg 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://natutool.com/wp-content/uploads/2021/05/active-Office-2019-Professional-Plus-220x150.jpg
Requested by: Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 8562e6099569a1c822b90dfabe12e824e4603381894d5e2ce690ae83749f74f4

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/hack-ff-auto-headshot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
date: Tue, 28 Jun 2022 04:17:52 GMT
last-modified: Thu, 10 Jun 2021 09:52:40 GMT
server: nginx
etag: "60c1e0e8-1e48"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 7752
expires: Thu, 28 Jul 2022 04:17:52 GMT

GET
H2 200 ms-office-2016-220x150.jpg
natutool.com/wp-content/uploads/2021/05/ 3 KB
4 KB 417ms
415ms Image
image/jpeg 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://natutool.com/wp-content/uploads/2021/05/ms-office-2016-220x150.jpg
Requested by: Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 761018c02956a3c156ecdcaa25b3ad66a8caea8dc9fa3fb763f380c52e6722ae

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/hack-ff-auto-headshot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
date: Tue, 28 Jun 2022 04:17:52 GMT
last-modified: Tue, 02 Nov 2021 15:18:06 GMT
server: nginx
etag: "618156ae-dfd"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 3581
expires: Thu, 28 Jul 2022 04:17:52 GMT

GET
H2 200 hack-ff-autoheadshot-ob33-220x150.jpg
natutool.com/wp-content/uploads/2022/03/ 9 KB
9 KB 418ms
415ms Image
image/jpeg 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://natutool.com/wp-content/uploads/2022/03/hack-ff-autoheadshot-ob33-220x150.jpg
Requested by: Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: ec3d68fcc43e03ed50021010dd095482258b994dc96a07814a46439e4d5b662b

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/hack-ff-auto-headshot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
date: Tue, 28 Jun 2022 04:17:52 GMT
last-modified: Sat, 26 Mar 2022 04:24:40 GMT
server: nginx
etag: "623e9588-23ef"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 9199
expires: Thu, 28 Jul 2022 04:17:52 GMT

GET
H2 200 phan-mem-office-2010-220x150.jpg
natutool.com/wp-content/uploads/2021/11/ 14 KB
15 KB 511ms
508ms Image
image/jpeg 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://natutool.com/wp-content/uploads/2021/11/phan-mem-office-2010-220x150.jpg
Requested by: Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 722ffe08a48bc767cc518899637ec5d7c0f74643f5eeabb1d9eac92c64ad7ac9

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/hack-ff-auto-headshot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
date: Tue, 28 Jun 2022 04:17:52 GMT
last-modified: Thu, 25 Nov 2021 02:55:38 GMT
server: nginx
etag: "619efb2a-399f"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 14751
expires: Thu, 28 Jul 2022 04:17:52 GMT

GET
H2 200 picsart-390x220.jpg
natutool.com/wp-content/uploads/2021/12/ 18 KB
18 KB 568ms
566ms Image
image/jpeg 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://natutool.com/wp-content/uploads/2021/12/picsart-390x220.jpg
Requested by: Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: cc170447eaa9b14b8d19085ef29f4a300d3658d9a6abbbbc9986d5cc8f7eb4c3

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/hack-ff-auto-headshot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
date: Tue, 28 Jun 2022 04:17:52 GMT
last-modified: Mon, 27 Dec 2021 09:32:16 GMT
server: nginx
etag: "61c98820-47b6"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 18358
expires: Thu, 28 Jul 2022 04:17:52 GMT

GET
H2 200 cai-dat-clash-of-clans-apk-mod-vo-han-tien-mien-phi-390x220.jpg
natutool.com/wp-content/uploads/2022/03/ 29 KB
29 KB 669ms
668ms Image
image/jpeg 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://natutool.com/wp-content/uploads/2022/03/cai-dat-clash-of-clans-apk-mod-vo-han-tien-mien-phi-390x220.jpg
Requested by: Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 4053ea92812ed236f3f5c4961639fc43cc27d76230ebaf132e7ba66317a060c7

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/hack-ff-auto-headshot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
date: Tue, 28 Jun 2022 04:17:52 GMT
last-modified: Wed, 09 Mar 2022 10:18:36 GMT
server: nginx
etag: "62287efc-72d9"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 29401
expires: Thu, 28 Jul 2022 04:17:52 GMT

GET
H2 200 subway-surfers-390x220.jpg
natutool.com/wp-content/uploads/2021/12/ 30 KB
30 KB 695ms
693ms Image
image/jpeg 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://natutool.com/wp-content/uploads/2021/12/subway-surfers-390x220.jpg
Requested by: Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 4d16cb2dfb4f3070064113d68b3e0a2582bc2ec1b44a50e86fa8f2b1b2497cc0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/hack-ff-auto-headshot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
date: Tue, 28 Jun 2022 04:17:52 GMT
last-modified: Tue, 28 Dec 2021 08:50:07 GMT
server: nginx
etag: "61cacfbf-78e8"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 30952
expires: Thu, 28 Jul 2022 04:17:52 GMT

GET
H2 200 office-365-e5-mien-phi-390x220.jpg
natutool.com/wp-content/uploads/2021/09/ 16 KB
17 KB 772ms
771ms Image
image/jpeg 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://natutool.com/wp-content/uploads/2021/09/office-365-e5-mien-phi-390x220.jpg
Requested by: Host: natutool.com
URL: https://natutool.com/hack-ff-auto-headshot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: ce0c78c66290daf1f6c9cee9d8d257f4474a6f82434df7104871366f6e32862b

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/hack-ff-auto-headshot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
date: Tue, 28 Jun 2022 04:17:52 GMT
last-modified: Thu, 09 Sep 2021 03:07:30 GMT
server: nginx
etag: "61397a72-412e"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 16686
expires: Thu, 28 Jul 2022 04:17:52 GMT

GET
H3 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame C35F 41 KB
15 KB 105ms
104ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220613_RC00/outstream.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Jun 2022 12:03:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 576856
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 Jun 2023 12:03:36 GMT

HEAD
H/1.1

200
OK

file.mp4
r2---sn-5hnekn7k.c.2mdn.net/videoplayback/id/7aa5587842c60e82/itag/346/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1687925872/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame C35F
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/7aa5587842c60e82/itag/346/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1687925872/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signa...
https://r2---sn-5hnekn7k.c.2mdn.net/videoplayback/id/7aa5587842c60e82/itag/346/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1687925872/sparams/acao,ctier,expire,id,ip,ipbits,ita...

0
0

1369ms
99ms

Fetch
video/mp4

209.85.226.71
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r2---sn-5hnekn7k.c.2mdn.net/videoplayback/id/7aa5587842c60e82/itag/346/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1687925872/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/4F49B6A270A3138B15D2A3DB1668446C88CEBB2A.7EBD030AC2CC63229D135EFC92F9A526F736783D/key/cms1/cms_redirect/yes/mh/mT/mip/45.133.192.171/mm/42/mn/sn-5hnekn7k/ms/onc/mt/1656386435/mv/u/mvi/2/pl/23/file/file.mp4

Requested by

Protocol

HTTP/1.1

Server

209.85.226.71 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams17s07-in-f7.1e100.net

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 28 Jun 2022 04:17:54 GMT
X-Content-Type-Options: nosniff
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 1988785
Last-Modified: Wed, 08 Jun 2022 11:54:30 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Tue, 28 Jun 2022 04:17:54 GMT

Redirect headers

date: Tue, 28 Jun 2022 04:17:52 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 644
x-xss-protection: 0
pragma: no-cache
server: ClientMapServer
location: https://r2---sn-5hnekn7k.c.2mdn.net/videoplayback/id/7aa5587842c60e82/itag/346/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1687925872/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/4F49B6A270A3138B15D2A3DB1668446C88CEBB2A.7EBD030AC2CC63229D135EFC92F9A526F736783D/key/cms1/cms_redirect/yes/mh/mT/mip/45.133.192.171/mm/42/mn/sn-5hnekn7k/ms/onc/mt/1656386435/mv/u/mvi/2/pl/23/file/file.mp4
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: https://googleads.g.doubleclick.net
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 admin-ajax.php Show response
natutool.com/wp-admin/ 69 B
486 B 733ms
733ms XHR
text/html 139.59.250.113
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://natutool.com/wp-admin/admin-ajax.php?postviews_id=11479&action=tie_postviews&_=1656389877019

Requested by

Host: natutool.com
URL: https://natutool.com/wp-includes/js/jquery/jquery.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.59.250.113 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx / LarVPS

Resource Hash

06cf75957da6d90658e431d50da2cb5fb7f06cf085c9d2960466cb1568b60b34

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://natutool.com/hack-ff-auto-headshot/
X-Requested-With: XMLHttpRequest
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:17:53 GMT
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-powered-by: LarVPS
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
x-xss-protection: 1; mode=block
cache-control: no-cache, must-revalidate, max-age=0
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-robots-tag: noindex
vary: Accept-Encoding
x-content-type-options: nosniff, nosniff
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame C69F 0
0 140ms
140ms Fetch
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CbKTF7oC6YrSBDprt3gPE4aWwB7CXiNRq9qnP8vcPZBABII2E248BYOoBoAGwiv3DKMgBAakCBwBpz7LAsT6oAwGqBIECT9B25ApiLcCD9UrrBPs39KCxABbkJdXpmCpWuwekSWw2D9YRqkfCSRG1wRI0BDzSUeF8Hkgx0_zSGtBh53FLENFQ_2r1gtJekol7ryJv4qsjwN7FZHNaHOjQzHYBi1W9WhlZCREyCsvJgO8I7PFxWwHHqmN881riZ7YSKJFxVToResFJ8zpkomGBCEakNCq5NN_Kw656vfA8-OgWaRfAPJuTDbfVnpnQL-BXIlxy6e6iOEQL6rwDPXR1hwZ2FOzyO7D02xDt2WOuesfgFp12aILg7yuxXU070ydLAA1s69LaoIBeJHlBjilrRiwIVBtPJoeuzFTfpVzH_1e3As4kPVnABN-rk-z7A4AHsMLNowOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBC5kQTSCBEIgOGAEBABGB8yAqoCOgKAQIAKAcgLAdgTA4gUAtAVAYAXAbIXHAoaCAASFHB1Yi00MjYxNDAxODIxMjU5OTc4GAA&sigh=MySZsW2tDik&vt=1&uach_m=[UACH]&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 28 Jun 2022 04:17:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C69F 42 B
64 B 350ms
140ms Fetch
image/gif 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstRSjkSLP5bRQMD2BWhWnxACG-3nx7lBqyZ5QrNHOPgc0jSba4U4dC7cSjYK1vnEDL_uTwdbO6qmeVVwcBLUpS7Ptk0VMqCrArVRt_MMmtOYKL1y8zoTgMHx0QrhgCug6wI0esSag&sai=AMfl-YQjtXFBvGqqeDIAuQEI0FE3NY6L6F6wC5ura7aXSETv6upZOya0H_rcsy4o6fhXV1FC4ys6mr4v7N9A&sig=Cg0ArKJSzJpzAqCmVVq_EAE&id=lidar2&mcvt=1057&p=0,0,124,1005&mtos=448,1057,1057,1057,1057&tos=448,609,0,0,0&v=20220627&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=2969136041&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&pay=1&rst=1656389875584&rpt=744&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 NUf31DeV05jg6rbNTwXiBfRLQ8hv8NSyvu4XMwxgjz4.js Show response
pagead2.googlesyndication.com/bg/ Frame EEAC 36 KB
14 KB 104ms
104ms Script
text/javascript 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/NUf31DeV05jg6rbNTwXiBfRLQ8hv8NSyvu4XMwxgjz4.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

sffe /

Resource Hash

3547f7d43795d398e0eab6cd4f05e205f44b43c86ff0d4b2beee17330c608f3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 27 Jun 2022 19:46:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30704
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13897
x-xss-protection: 0
last-modified: Tue, 21 Jun 2022 16:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 27 Jun 2023 19:46:08 GMT

GET
H3 200 css
fonts.googleapis.com/ 2 KB
484 B 113ms
113ms Stylesheet
text/css 142.250.185.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Poppins:600,regular&subset=latin&display=swap

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1/webfont.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f10.1e100.net

Software

ESF /

Resource Hash

b5f7b4aead302c8e16d539d0b5dbd685eaa308bafc2a4e64e7ee24bff768990c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 28 Jun 2022 02:40:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 28 Jun 2022 04:17:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 28 Jun 2022 04:17:52 GMT

GET
H3 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame C73F 23 KB
9 KB 104ms
104ms Document
text/html 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

accept-ranges: bytes
age: 576589
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8727
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Jun 2022 12:08:03 GMT
expires: Wed, 21 Jun 2023 12:08:03 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pxiByp8kv8JHgFVrLEj6Z1JlFc-K.woff2
fonts.gstatic.com/s/poppins/v20/ 5 KB
5 KB 105ms
105ms Font
font/woff2 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLEj6Z1JlFc-K.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins:600,regular&subset=latin&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

9c15f7b06458075c69b40e79f03e62d43017ecf4c618487add407ee47e438684

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://natutool.com
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 08:45:32 GMT
x-content-type-options: nosniff
age: 502341
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5512
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:59:05 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 22 Jun 2023 08:45:32 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2
fonts.gstatic.com/s/roboto/v30/ Frame C35F 5 KB
5 KB 107ms
107ms Font
font/woff2 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

4ec57f2a80b91090971b83970230ca09ab3568c5f5b224896ca9aa6180a76aa9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 27 Jun 2022 13:17:17 GMT
x-content-type-options: nosniff
age: 54036
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5548
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 27 Jun 2023 13:17:17 GMT

GET
H3 200 NUf31DeV05jg6rbNTwXiBfRLQ8hv8NSyvu4XMwxgjz4.js Show response
pagead2.googlesyndication.com/bg/ Frame C73F 36 KB
14 KB 106ms
105ms Script
text/javascript 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/NUf31DeV05jg6rbNTwXiBfRLQ8hv8NSyvu4XMwxgjz4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

sffe /

Resource Hash

3547f7d43795d398e0eab6cd4f05e205f44b43c86ff0d4b2beee17330c608f3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 27 Jun 2022 19:46:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30705
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13897
x-xss-protection: 0
last-modified: Tue, 21 Jun 2022 16:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 27 Jun 2023 19:46:08 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
10 KB 119ms
118ms XHR
application/json 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220623&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

cafe /

Resource Hash

bd5cce8e7cf401f9ad9f6ff35a7e4cca0aec15e3e6e255ce653c9136fe357c55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 28 Jun 2022 04:17:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10599
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 125ms
125ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:17:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 28 Jun 2022 04:17:53 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C73F 0
20 B 141ms
141ms Image
image/gif 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.0.0.0&bgai=BzHVX8IC6Ypz0Hqm5nsEPiaifwAIAAAAAOAHgBAI&bg=!m5ilmNzNAAa8IIBmnCA7ACkAdvg8WsLzVQ5UzxnP5ksPlenw8DVVhJFTXOMTN3iH0uw-mIP9Vs9_-QIAAAB8UgAAAAFoAQeZAsCgtaRyv_IqyS93NDhU9i_vMqvD516D1yrJMY74Pq06aj_12MBrazDFDzJwYcTdmErYM8jKTYLEZVuUy8El5Qy1ZCWpEi9QTxMGirpt_2FVQncprUBRgyBEdlbhzKdlM870tksSfy1BquE0Mj4MixZCXMJB8YTT8Sp42CZnoz5pL0q6N_u0CnhcBbxYwKmdfSR1qdhenhmaP5scD0UBKCtU0p6aOBk4NRR-7404yBeZ83FGI8Y_giF3YKAAwqUGbn5XpypXvx1l1awjOd7JYaKGwlGogZapASJgsbOcc2zLrY4Vkxwxdt8G2g_chTQXruucbsi2w0ZfLHBxMterho-RsABCs0SrI6zdzbZTTiNp-zQIepuIX62qYrX3D-P3dSXuvArufjiGDrqhWFJMk4roDtYLv0vVD28NvlNMke9MWKpuCuy59sj36kCc7ifP1-Xe2rTfSSk_lFj0I4URQOnYq6TtXAUVeZcHOGXo7o2XYN25KEWpxw20K5kScQMGk8usPnsN7USB8Y4ucvdpO6lw0C918NzR4o1a000iektZFiSRULhQY8eKOgE2qJWMTCk_gdNxI4NFi4yEV8DbhA6cRWr4auTBX_p9Cqm5YIH4W8aqg-0_matNZ-r_iyQTmEZyI-xuwp85pounQbS3AsT3aDaCvhdXmplkVIIpiGbD66FKZQyAVUoJDoO1wAv_5__xmUBtLALBFaf12M-XhA9Lvroz6jtAZIAFUH5rpWtYKyHYmUtJG3IP9evt0AZWC0Ej5HVkj1ex_zP4RriAadM_QswKs2EDEviyyspSSy9eXAXQlhmQN-EHeC3ogrWFhQO9TlUlkx_S0GR-bMDA9ROGNECXoj7o1GrY273RvH9dRPrX_fmo4K-jf7ihFyuJ0V5_FBgQS8fUgKN_8-kLXxs5qJTgXBlyZYTY-OXgrA-zOQ

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame AB20 13 KB
5 KB 108ms
106ms Document
text/html 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://natutool.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

accept-ranges: bytes
age: 22199
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 27 Jun 2022 22:07:54 GMT
expires: Tue, 27 Jun 2023 22:07:54 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame EF49 783 B
536 B 331ms
115ms Document
text/html 142.250.186.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.36 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f4.1e100.net

Software

GSE /

Resource Hash

904bab1f52f68756036bb8968134db5f588a468fb7c24c3d01d371cecf6dd0aa

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-_hD6RNGqps0Kg18TSjh8Iw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://natutool.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-_hD6RNGqps0Kg18TSjh8Iw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 28 Jun 2022 04:17:53 GMT
expires: Tue, 28 Jun 2022 04:17:53 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 NUf31DeV05jg6rbNTwXiBfRLQ8hv8NSyvu4XMwxgjz4.js Show response
pagead2.googlesyndication.com/bg/ Frame AB20 36 KB
14 KB 106ms
106ms Script
text/javascript 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/NUf31DeV05jg6rbNTwXiBfRLQ8hv8NSyvu4XMwxgjz4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

sffe /

Resource Hash

3547f7d43795d398e0eab6cd4f05e205f44b43c86ff0d4b2beee17330c608f3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 27 Jun 2022 19:46:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30705
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13897
x-xss-protection: 0
last-modified: Tue, 21 Jun 2022 16:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 27 Jun 2023 19:46:08 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame EF49 0
0 153ms
153ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220623&jk=3528220077371364&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.16.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s08-in-f194.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame AB20 0
9 B 105ms
105ms Image
text/plain 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?LTCsWA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.16.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s08-in-f1.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 04:17:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

POST
H3 204 csi
csi.gstatic.com/ Frame C35F 0
17 B 360ms
129ms Ping
image/gif 142.250.180.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=2~l4xnrko9&c=6784480047745&slotId=3392240023872.5&qqid=CLyJ-Y6lz_gCFRVkFQgd5E0H0g&fb=outstream-lima&gpm_i=9&gpm_c=9&gpm_a=9&smb=1000&br=862&mt=video%2Fmp4&vs=720x720&ulv=1&cll=0&vast_v=2.0&vmfc=11&vhc=0&msm=1&aits=0%2C18%2C22%2C692%2C59%2C342%2C343%2C344%2C345%2C346%2C347&webm=0&vp9=0&vamt=video%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4&hvmf=false&vms=1&bit=346&vsrc=web_video_ads&ape=1&ple=1
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220613_RC00/outstream.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.180.163 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: mil04s44-in-f3.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Jun 2022 04:17:54 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 149ms
148ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20220623&jk=3528220077371364&bg=!CwilCEzNAAa8IIBmnCA7ACkAdvg8Wjb8_EqgMqT7QigbrU4aqHoj3Nk_Upwt7jYoD9j-4WHB5sykGwIAAABWUgAAAAdoAQcKAAEwmQKhHH1Ywnu9Mw2cERYqOaDeEOC7-WhcVCmJE6QBVHEIf5w6SwlETgYKwRpMlhqEmpNWrz5tlYpoLjdT62-bDWbSXx86Nse1pyLcGYKlJuzkq-bpMNnVa96JDpVcWug763MpQ48ONzgjsQ-KT_PHFWVi-kuN2LmIyWIXICHH1TnUxRwa8JkADndrfi41rrLozXk-ldoYNL9uezH21DQI7LY2bxUhM3X_KMgCe62TikzOZVsUXRq9moUZzIyipavYKoluo7qTQopq8eOERNjPM5XFbdYBVNRzxqwnHoS5n1Wtp4jEtoNgIGLLER_Ho-7vpi1RWDaU6GSr7lIxbPq2-BvrScyVV4fi5vd5SS2ooE4Lt15BZ3NhCx0GzKvgMFbi9SDXlU7ifvC7HvzC7Yg8UcscAw70B1kMmYDqvpmHFQ7dzY00TxPMTJyr3w-Eb2TIUPnpJyJPTdrTgnPaVEqBGwtheceyIsz7kyJgOdfRZ7rzi8axChAelXkBxnyg24IB0rVoUScj7kOZp5s4NT5Ef9-4h5eA2L4XV_9qgEyZNBl8kCYMLbW--qR2n6X94t6qsAJfXel_HoWkOsIpSpXDFi8MOtGu9qgH6Dys7VPSwyXIaPL3mGTejmKsPM9iE_YRnKv0jcQeYtiYZfYF1cP9RW4wLAYkXR0RcaSPt_hjNy10R_cUb3RnRH_JUKzg7XG5y5CuLf2fcTmTU-qk6Uo8h9wBFFwDqv2FfssnSluNoEpnw3zAa0M1SvVx7SCCDYXnmNLI3yL3mqevKnsvWan0yz6Mx6z37eAYIko1Ik57oxdPMdI7pW3Wfvz_QGUHiWoTVRXX50P7MFD67F74_0c9tghSCms65y0bApwiv9xj5RnYzrUY3ZSGd8zs4NM94jOsJezHXw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.16.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s08-in-f194.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://natutool.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1 206
Partial Content file.mp4
r2---sn-5hnekn7k.c.2mdn.net/videoplayback/id/7aa5587842c60e82/itag/346/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1687925872/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame C35F 86 KB
0 3622ms
101ms Media
video/mp4 209.85.226.71
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

209.85.226.71 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams17s07-in-f7.1e100.net

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Encoding: identity;q=1, *;q=0
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=0-

Response headers

Date: Tue, 28 Jun 2022 04:17:57 GMT
X-Content-Type-Options: nosniff
Content-Range: bytes 0-1988784/1988785
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 1988785
Last-Modified: Wed, 08 Jun 2022 11:54:30 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: https://googleads.g.doubleclick.net
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: https://googleads.g.doubleclick.net
Expires: Tue, 28 Jun 2022 04:17:57 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com%2C%20r10.lb.indexww.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEBz4t0n092OBklXXyYPWAHE&google_push=ARnp8GBGvj7j--mKSEnBHVGNiQGCP-OZYACrquZ74-ym8KAXFYVLJ8qPutQxd1pGVdMO6ex5SQCkmi20SSRFY3_3PTrFGXxVqIE&s=184023&C=1

Verdicts & Comments Add Verdict or Comment

107 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.natutool.com/	1970-01-20 21:37:41	Name: _ga Value: GA1.2.909823206.1656389874
.natutool.com/	1970-01-20 04:07:56	Name: _gid Value: GA1.2.304716561.1656389874
.natutool.com/	1970-01-20 04:06:29	Name: _gat_gtag_UA_162839140_3 Value: 1
.natutool.com/	1970-01-20 13:28:05	Name: __gads Value: ID=1fdae3e67b9e1017-22e2d120becd0001:T=1656389870:RT=1656389870:S=ALNI_MbVKDNpo_H8xzDoyqAVHH-mQuLSfQ
.doubleclick.net/	1970-01-20 13:28:05	Name: IDE Value: AHWqTUkwYyV4gAIN1zj5FYcLFelk-vjC-FU0WqzrP2Ria5T3OA5t7jSPoVIjG9LCOgI
.doubleclick.net/	1970-01-20 04:06:33	Name: DSID Value: NO_DATA
.mookie1.com/	1970-01-20 13:35:17	Name: id Value: 10824260966935898597
.mookie1.com/	1970-01-20 13:35:17	Name: mdata Value: 1\|10824260966935898597\|1656389872133
.mookie1.com/	1970-01-20 13:35:17	Name: ov Value: f98a024fa241c43d6ea5b1fdae59a42d
.rlcdn.com/	1970-01-20 12:52:05	Name: rlas3 Value: 9oA+vTquRspVLIxoGAEq5gernLAsgtDIJRHUvv33SkE=
.agkn.com/	1970-01-20 12:52:05	Name: ab Value: 0001%3ARVN2gihBsWp36Z3%2B203G3c2sOR0UywJj
.agkn.com/	1970-01-20 12:52:05	Name: u Value: C\|0CEAqTT1wKk09cAAAAAAAAQ13AQCAAQpAAAAAAA
.innovid.com/	1970-01-20 06:16:05	Name: uuid Value: 374ad438-952c-4fef-a99e-8e88244849de-20220628 00:17:52
.rlcdn.com/	1970-01-20 05:32:53	Name: pxrc Value: CPCB6pUGEgUI6AcQABIGCOndKhAA
.quantserve.com/	1970-01-20 13:36:44	Name: mc Value: 62ba80f0-9c643-4202b-0dd56
.casalemedia.com/	1970-01-20 12:52:05	Name: CMID Value: YrqA8Is1CgCkL5.k306juQAA
.casalemedia.com/	1970-01-20 06:16:05	Name: CMPS Value: 1874
.pubmatic.com/	1970-01-20 04:07:56	Name: KTPCACOOKIE Value: YES
.pubmatic.com/	1970-01-20 06:16:05	Name: KADUSERCOOKIE Value: 7B2B2073-5864-479E-A7CB-FD7129360AF9

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://ssum-sec.casalemedia.com%2C%20r10.lb.indexww.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEBz4t0n092OBklXXyYPWAHE&google_push=ARnp8GBGvj7j--mKSEnBHVGNiQGCP-OZYACrquZ74-ym8KAXFYVLJ8qPutQxd1pGVdMO6ex5SQCkmi20SSRFY3_3PTrFGXxVqIE&s=184023&C=1 Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
javascript	warning	URL: https://googleads.g.doubleclick.net/pagead/html/r20220623/r20110914/zrt_lookup.html?fsb=1#RS-1-&adk=2969136041&client=ca-pub-4261401821259978&fa=1&ifi=11&uci=a!b&btvi=3&xpc=oWGCOdvqUN&p=https%3A//natutool.com Message: The resource https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://natutool.com/hack-ff-auto-headshot/ Message: The resource https://natutool.com/wp-content/themes/natutool/assets/fonts/fontawesome/fa-brands-400.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.ee
ag.innovid.com
ajax.googleapis.com
bid.g.doubleclick.net
cm.g.doubleclick.net
cms.quantserve.com
csi.gstatic.com
d.agkn.com
fonts.googleapis.com
fonts.gstatic.com
gcdn.2mdn.net
googleads.g.doubleclick.net
id.rlcdn.com
image6.pubmatic.com
imasdk.googleapis.com
natutool.com
odr.mookie1.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.everesttech.net
pixel.rubiconproject.com
r2---sn-5hnekn7k.c.2mdn.net
rtb.openx.net
secure.gravatar.com
ssum-sec.casalemedia.com
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
ssum-sec.casalemedia.com
104.36.113.23
108.128.215.255
139.59.250.113
142.250.180.163
142.250.184.226
142.250.185.130
142.250.185.202
142.250.185.78
142.250.185.99
142.250.186.110
142.250.186.162
142.250.186.170
142.250.186.36
142.250.186.66
172.217.16.193
172.217.16.194
172.217.18.2
172.217.18.8
18.195.144.156
192.0.73.2
209.85.226.71
34.98.67.61
35.179.81.5
35.227.252.103
35.244.174.68
69.173.144.138
74.125.140.156
91.228.74.168
04a59f4b56d8d14ed7c127db4cfedf8caa618594e00b14bb9a6150182e7c31d3
06cf75957da6d90658e431d50da2cb5fb7f06cf085c9d2960466cb1568b60b34
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0d579fe25308b69603f13d7c50c772e621bc9b7ffe7b2e43e382a0d8a1fce70b
15d51a96c00f46c89828a7e962637d786edd66bd3ddde40c395f8647649d958b
169de8fd7c5a07edd1accc2be9e0c3b68d6eef67e7c62b40e5486703106a9e0e
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
195e523652e2fc0b15af2045e0e5692f2ed31ffc728ebbe4fd1135d30a8aa3f2
1b13d49f9e83aea16344d45a5b18a2447eb6225793b19844cefb7489c8d06237
1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306
1eb677ff632aae24e700d06662bdc24c74587fe63d27f506666a1d6922ad64f9
1edf6a20d793508f98a63ef2b068ee8504aee2ea9c31cb6ae80fff7029616691
1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954
1fcb320aef3ee8462a16c5e64611689a33273cc1ca7d8d9d35675b36959d7535
24555680b413d9b1d6d8eea400a95ae4e064030afadd57eff2bd67f4df3740a9
29a74bd48fa0b500b61194468e760e8acef2f465e782e0da3eb219850bcea8fb
2c30fc51273125f9c2af11890cd8620a42a18b9794555aeeb5438f3673c2ca19
2f8600335c93b2fe049ac35bbed64f2e89c77aab5cafd2fd774bda6e92b7ecf9
31e488e6b2e797680175d6d44d3b4723d51eea0d26056e2315a846749f64c187
3547f7d43795d398e0eab6cd4f05e205f44b43c86ff0d4b2beee17330c608f3e
36bfdde9c1c29e9c7c464f26ae9bec4b2ec99d147d21774cdc95c8c96f822739
37a2139f70993265efb63855323e3bb51c68ce52456d0efcb49ec0d3e5f33d80
38bc1b3a152aa82b36dd8edb065c627e8ebcfc8d949dd03f1212c0d56114219f
4053ea92812ed236f3f5c4961639fc43cc27d76230ebaf132e7ba66317a060c7
44fd195478555f2ff575f618381ab21116f45848c36ccd8ebd25a9dd68482006
477eed57bc25e0a48e9dfa25da6f9138ce253f66f92bd36853fb3f10d1513f9a
48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7
49e262eba995189e52372be18915d24f14ae4536f31d4dfbf408c2dc53e3d2f2
4a507461f4686f5bd7ec2845511412b61fd8b45314c56ce31b5e912db3bb5118
4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08
4cf6f3dffbc65f9231255bf31f40ddc84a45bc57428b41d6786afc7153b90b7a
4d16cb2dfb4f3070064113d68b3e0a2582bc2ec1b44a50e86fa8f2b1b2497cc0
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4d6d934900f2d828851c6dfc483464ccd4f62e0e0200d8e32dc8384e83b009fd
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e8f0a2dbb1733990c2a04109ad26ef432995d68e58ec78902ad706bb1fb75ee
4ec57f2a80b91090971b83970230ca09ab3568c5f5b224896ca9aa6180a76aa9
4fbe21387469aeeada56a7e744b857616e294085241216afd8824af7788bf3a8
512490d9f9051205fd78d1ad38f3fa1d98b77607f449c64bb9c6dc2a296e83a6
517ba165068755f33a47c052f603cefeafbe4410bc29d559e03bafc091e17b3f
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
684dfe949ae87a38c2afbcee199f51b0025dd9121b524d62e881cf40846cdd21
6a4a013ee7c08697be8ebd17b121bea52222f589c2e0224e6371a0fd6c6c4713
6a8c8e9e1e7f692c21af1956de163f3d026778e6449fe93a09a671847ca1ae65
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
722ffe08a48bc767cc518899637ec5d7c0f74643f5eeabb1d9eac92c64ad7ac9
75a2067c9dff8e58ae83cdb8ee4fe896013966ac4e8f3f1d5e8a75f27c9a1ae2
75c48da0c2de6b357969f59ffb9152a2239089397ee29715d9cab44e3c26e80c
761018c02956a3c156ecdcaa25b3ad66a8caea8dc9fa3fb763f380c52e6722ae
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7
81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee
82649ad7d4ec9c61f1e525b2dade75153ffb03610b88d22e1ba3ba98fd55de81
84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30
8562e6099569a1c822b90dfabe12e824e4603381894d5e2ce690ae83749f74f4
85b2f72103d0416979160c68b069403162eb102ebab15bbe7f0e641fd9e1fc85
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6
904bab1f52f68756036bb8968134db5f588a468fb7c24c3d01d371cecf6dd0aa
981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0
99170d6e8105764ef3cd7879af59dda58561e634d23352d8155dd95f4b02a946
997102368fe90df52bc1f5fca3ccdd4d90ca284be92fed4231e3fe90e1547510
9a3599ea67617b75e841fc667a1cd5ac281c392546a31af864566b74848cbd46
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9a9e2044886649e9ca95d92a10a717c5d339fbaedaf9d0d741f4e039681ed45c
9c15f7b06458075c69b40e79f03e62d43017ecf4c618487add407ee47e438684
9c4926b247def1bd98c0f6f6fbbaba449e2702ecf71ca6fceeacf7db04f9e9c9
9db74c641fdd03a841f8efaaae4d7afdbe6d30005639069e5dd262c030e0314a
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a2625083f682f667dbd0121720f86b02cc023e7cc2c36d1fad2d1a3dbe0b8cc6
a2d5e81ff590741bd950f52b5922d6dc075ee0bee17fed14e57b5b16db80e16a
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a795cbdec4969302eeb2d1c07efed1b3f68a8205c6fa58d59af8fff8c5cdd26b
a8a5fba20efc1ccb915e2da1e146146afbf2cef3dc6c8514d8b92cbaee2e5546
a9052109e22a8dd392b2027c99e6270a7e89651bd3f34967c3637e16b74472ae
acd0f2b4b19641fb0a2214038f24c7adf782616b576bba2d9581d1923fb146f2
ae2e1dc0161fa05e80b225682868a9bfbab08c503b2429f06339d4487f160ac2
b274e2b26af7aa1cfbe857e6a2d8ed6d68f17139e7b08f3e890ba79581fd6ab1
b5f7b4aead302c8e16d539d0b5dbd685eaa308bafc2a4e64e7ee24bff768990c
b97d2c98f8bac4ee72d075d577db22903f83ae9a2742b9caef94f0842b459348
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
bd5cce8e7cf401f9ad9f6ff35a7e4cca0aec15e3e6e255ce653c9136fe357c55
c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205
c97ec8c88cdf7ab75903775bd4c5f897246dd81f420006617e456cc60bbcea6a
cc170447eaa9b14b8d19085ef29f4a300d3658d9a6abbbbc9986d5cc8f7eb4c3
cdf072b797353602918996980c44cfe88d0067ac8bc2582aa01d55ba11fd8ecf
ce0c78c66290daf1f6c9cee9d8d257f4474a6f82434df7104871366f6e32862b
cf03b898346812f4d422a84770c0ae31667cf2beb9a7bb50fe5a86cb62ab97cf
d9ceed39ed254bd9506d76895a8d8b2049123952ef35814dbe912eee562fec00
e1e676877284d9b0e0956643c1169f238253d302d04e1e6b8220e632f090b384
e252130921f27ce13d97766404376f55002f8cf3d87ada342cf3ba83d1cc812c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3fbe67fed994d974916f80939f43e83889b033b3a565f349f26255620037a4d
ec3d68fcc43e03ed50021010dd095482258b994dc96a07814a46439e4d5b662b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f10a76802a896aa836f3db5035f4a8a29cc8c3baf3e28f9959fb3afbe3908bde
f2f78d9ba4cac3736d56068718a35f724c8a35cad4e4586ea9466e5d1c4ed0cf
f45e87f9cd0fa1fd7af2842b73611e4dcfc2a85f346f5e29f6f518909b3ce6d5
f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fc66f942651a9fe1a598770d3d896529dcd7a03d02f40655451513093103e61b
fd48ba2cec7ec8424c38af70d7516e7ce54aab084c075020f7e2a420d042a1da
fd49219477a365773f010355db7e75d2430693594965a28d835d7c579536948f

natutool.com Open in urlscan Pro 139.59.250.113 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

136 Requests

91 %HTTPS

0 %IPv6

23 Domains

32 Subdomains

21 IPs

6 Countries

1678 kBTransfer

4082 kBSize

19 Cookies

17 Outgoing links

Redirected requests

136 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 32 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

natutool.com Open in urlscan Pro
139.59.250.113 Public Scan

Screenshot
Live screenshot

Full Image

136
Requests

91 %
HTTPS

0 %
IPv6

23
Domains

32
Subdomains

21
IPs

6
Countries

1678 kB
Transfer

4082 kB
Size

19
Cookies

136 HTTP transactions
32 data transactions