three-back.work Open in urlscan Pro
150.95.54.210 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://mail.three-back.work/
Effective URL:
https://three-back.work/
Submission: On August 25 via api (August 25th 2021, 12:29:13 pm UTC) from GB

Summary HTTP 193 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 30 IPs in 5 countries across 22 domains to perform 193 HTTP transactions. The main IP is 150.95.54.210, located in Japan and belongs to INTERQ GMO Internet,Inc, JP. The main domain is three-back.work.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 18th 2021. Valid for: 3 months.

This is the only time three-back.work was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 50	150.95.54.210 150.95.54.210	7506 (INTERQ GM...) (INTERQ GMO Internet)
2	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
1	13.224.96.45 13.224.96.45	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6812:15b7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2.18.232.182 2.18.232.182	16625 (AKAMAI-AS) (AKAMAI-AS)
1	147.92.146.123 147.92.146.123	38631 (LINE LINE...) (LINE LINE Corporation)
16	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
1	13.224.96.14 13.224.96.14	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:831::200e	15169 (GOOGLE) (GOOGLE)
3	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
26	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
39	2a00:1450:400... 2a00:1450:4001:812::2001	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
6 9	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
4	142.250.200.67 142.250.200.67	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:809::2006	15169 (GOOGLE) (GOOGLE)
4	172.217.18.98 172.217.18.98	15169 (GOOGLE) (GOOGLE)
1	2620:116:800d... 2620:116:800d:21:5a23:9c4e:e774:96c1	16509 (AMAZON-02) (AMAZON-02)
2 2	104.111.215.191 104.111.215.191	16625 (AKAMAI-AS) (AKAMAI-AS)
5	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
2 2	35.186.253.211 35.186.253.211	15169 (GOOGLE) (GOOGLE)
2 2	185.64.189.115 185.64.189.115	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1	2a05:d01c:1d8... 2a05:d01c:1d8:8101:8678:af0d:fda8:5a84	16509 (AMAZON-02) (AMAZON-02)
3	192.0.77.48 192.0.77.48	2635 (AUTOMATTIC) (AUTOMATTIC)
6	2404:6800:400... 2404:6800:4001:80c::2003	15169 (GOOGLE) (GOOGLE)
193	30

50 150.95.54.210 (Japan) 1 redirects

ASN7506 (INTERQ GMO Internet,Inc, JP)
PTR: jp37a.mixhost.jp

mail.three-back.work	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
three-back.work	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.96.45 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-96-45.zrh50.r.cloudfront.net

b.st-hatena.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:15b7 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.pixabay.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.232.182 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-232-182.deploy.static.akamaitechnologies.com

scdn.line-apps.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.92.146.123 (Japan)

ASN38631 (LINE LINE Corporation, JP)

qr-official.line.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.96.14 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-96-14.zrh50.r.cloudfront.net

b.hatena.ne.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

39 2a00:1450:4001:812::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany) 6 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.200.67 (United States)

ASN15169 (GOOGLE, US)
PTR: mad07s24-in-f3.1e100.net

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.18.98 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s05-in-f98.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:5a23:9c4e:e774:96c1 (United States)

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.215.191 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com

e.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.186.253.211 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.189.115 (United Kingdom) 2 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d01c:1d8:8101:8678:af0d:fda8:5a84 (London, United Kingdom)

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.0.77.48 (United States)

ASN2635 (AUTOMATTIC, US)
PTR: s.w.org

s.w.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2404:6800:4001:80c::2003 (Australia)

ASN15169 (GOOGLE, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
57	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	784 KB
50	three-back.work 1 redirects mail.three-back.work three-back.work	663 KB
37	doubleclick.net googleads.g.doubleclick.net securepubads.g.doubleclick.net cm.g.doubleclick.net	332 KB
17	google.com 6 redirects fundingchoicesmessages.google.com adservice.google.com www.google.com	89 KB
13	gstatic.com fonts.gstatic.com csi.gstatic.com	47 KB
7	googletagservices.com www.googletagservices.com	251 KB
3	w.org s.w.org	2 KB
3	googleapis.com ajax.googleapis.com fonts.googleapis.com	178 KB
2	pubmatic.com 2 redirects image6.pubmatic.com	1 KB
2	openx.net 2 redirects rtb.openx.net	764 B
2	addthis.com 2 redirects e.dlx.addthis.com	1 KB
2	2mdn.net s0.2mdn.net	111 KB
2	google.de adservice.google.de	287 B
1	innovid.com ag.innovid.com	297 B
1	rubiconproject.com 1 redirects pixel.rubiconproject.com	457 B
1	quantserve.com cms.quantserve.com	464 B
1	googleadservices.com partner.googleadservices.com	409 B
1	hatena.ne.jp b.hatena.ne.jp	372 B
1	line.me qr-official.line.me	946 B
1	line-apps.com scdn.line-apps.com	4 KB
1	pixabay.com cdn.pixabay.com	121 KB
1	st-hatena.com b.st-hatena.com	11 KB
193	22

	Domain	Requested by
49	three-back.work	three-back.work
39	tpc.googlesyndication.com	googleads.g.doubleclick.net three-back.work tpc.googlesyndication.com pagead2.googlesyndication.com
26	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net three-back.work
18	pagead2.googlesyndication.com	three-back.work pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com securepubads.g.doubleclick.net
10	csi.gstatic.com	pagead2.googlesyndication.com securepubads.g.doubleclick.net tpc.googlesyndication.com
9	www.google.com	6 redirects googleads.g.doubleclick.net tpc.googlesyndication.com
7	www.googletagservices.com	pagead2.googlesyndication.com googleads.g.doubleclick.net
6	securepubads.g.doubleclick.net	googleads.g.doubleclick.net
6	fundingchoicesmessages.google.com	pagead2.googlesyndication.com
5	cm.g.doubleclick.net	three-back.work googleads.g.doubleclick.net
3	s.w.org	three-back.work
3	fonts.gstatic.com	fonts.googleapis.com
2	image6.pubmatic.com	2 redirects
2	rtb.openx.net	2 redirects
2	e.dlx.addthis.com	2 redirects
2	s0.2mdn.net	tpc.googlesyndication.com
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
2	ajax.googleapis.com	three-back.work tpc.googlesyndication.com
1	ag.innovid.com	googleads.g.doubleclick.net
1	pixel.rubiconproject.com	1 redirects
1	cms.quantserve.com	googleads.g.doubleclick.net
1	fonts.googleapis.com	googleads.g.doubleclick.net
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	b.hatena.ne.jp	three-back.work
1	qr-official.line.me	three-back.work
1	scdn.line-apps.com	three-back.work
1	cdn.pixabay.com	three-back.work
1	b.st-hatena.com	three-back.work
1	mail.three-back.work	1 redirects
193	30

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
b.hatena.ne.jp
line.me
nav.cx
kerosuke-net.com
ja.wordpress.org
manualstinger.com

Subject Issuer	Validity	Valid
three-back.work cPanel, Inc. Certification Authority	`2021-08-18` - `2021-11-16`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.b.st-hatena.com Amazon	`2020-10-25` - `2021-11-24`	a year	crt.sh
pixabay.com Cloudflare Inc ECC CA-3	`2021-05-12` - `2022-05-11`	a year	crt.sh
line-apps.com DigiCert SHA2 Secure Server CA	`2021-01-14` - `2022-01-18`	a year	crt.sh
*.line.me GlobalSign RSA OV SSL CA 2018	`2020-06-17` - `2022-09-05`	2 years	crt.sh
*.b.hatena.ne.jp Amazon	`2020-10-20` - `2021-11-19`	a year	crt.sh
*.google.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
*.innovid.com RapidSSL RSA CA 2018	`2020-02-07` - `2022-04-07`	2 years	crt.sh
*.w.org Sectigo RSA Domain Validation Secure Server CA	`2019-12-19` - `2021-12-18`	2 years	crt.sh

This page contains 25 frames:

Primary Page: https://three-back.work/
Frame ID: A21CFC88AC6E3A90D8257E76E29CCE3A
Requests: 78 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210819/r20190131/zrt_lookup.html
Frame ID: BF5D46B4018C5E4B24B6C7A6E7C0F825
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&adk=1812271804&adf=3025194257&lmt=1629894532&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fthree-back.work%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=126&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2488773060453&rume=1&frm=20&pv=2&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=361
Frame ID: E24573A470DA29AE35FA251A2950C96A
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=5723592&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=218&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=moewzZI2iC&p=https%3A//three-back.work&dtd=368
Frame ID: A30975AD64652A46B6CE2C656C1354E3
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=4251178241&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=225&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2335&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=uODy3iUpDI&p=https%3A//three-back.work&dtd=371
Frame ID: 56A3ED44414F3943C4A9ACB0463550C9
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=169&slotname=8212816143&adk=730500670&adf=3217087521&pi=t.ma~as.8212816143&w=300&lmt=1629894532&rafmt=11&psa=0&format=300x169&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=226&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=4811&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=FgfLg2sH4U&p=https%3A//three-back.work&dtd=374
Frame ID: 10F8F834396CB211C4CF6AF19C38ABFF
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=3174676765&adf=240109791&pi=t.aa~a.4062378494~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169&nras=2&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=1322&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=yCkwOZdJsl&p=https%3A//three-back.work&dtd=15
Frame ID: 191006290C8ECCC912483FA7750E038E
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46
Frame ID: 52B5EEE378B3A4967A31FBC204393B88
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=240&adk=2162206099&adf=832817466&pi=t.aa~a.3867071496~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x240&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2047&idt=1&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600%2C300x600&nras=4&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=3741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=L0WjF9hXaz&p=https%3A//three-back.work&dtd=52
Frame ID: 1FF4C63E25D3FE0E37D561727EEBDEE6
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 4BF23F773FD8BE103176809202448C5B
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 616CCF3D76C033EEE9BCE68F6B8C0251
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17232005278383265105/index.html
Frame ID: 912E855F43D109DA3DCFE1ACA5D11234
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=C6EcdhTcmYdmCCYHy3wO2tK7QDPzTisJjw4DTzt0NpqDA4ngQASDH5Ph5YJUCoAH_hK3tA8gBCagDAcgDSKoEsgFP0BFgV48PVAKqJL82cScpSylEk_tzOXEs7d08NONQqTiwVjNqLfBHRkr2t0lY1dcNWWyarF9G6gH0HaI87TbnefhIFuIHN3M36E6EXAe7dewFnOksWBHbSLVh1lDs7vc2Sq-Mztmahy-5R7TGQ8ebPkJh6_eZ5NphJRPbBXqDq9Ek03V3Wxnxt0HkiLNcdBIFjr5RYwtW7g9DT8C9H8DikE4rQ3s40JNW3kD6I8CgkNRqwASsgMfC-AKSBQQIBBgBkgUECAUYBKAGLoAHkvuaHagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAPIHBBCSswfSCAkIgOGAEBABGB-ACgHICwHYEwzQFQGAFwGyFxwKGggAEhRwdWItMTU4MTcwNTI4MjE3ODU1MhgA&sigh=MDIQ1-0Z6Cc&template_id=419
Frame ID: 4A13DD6B51C97BB84C8388512FC0DFAE
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 61B4D743D4012DF46AF72BC53209C03F
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: D8B4E6E6BEE58A3B0D1F3E1C7552C1F2
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: C46405749934C50E93706D8B3153027F
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: BA60BF5CFEB770455B5BFD2C1D6521EA
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/D3lOyaz33AOyGTIEqdOSEmJb5cnEgELXkEp-WZBOrR0.js
Frame ID: 754A0C69FB5FFAA41E30DEB9BC855C93
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/D3lOyaz33AOyGTIEqdOSEmJb5cnEgELXkEp-WZBOrR0.js
Frame ID: 58D2B6B95620AB894FDEDE23CCCDCA08
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7154416178616298156/index.html
Frame ID: 584449E7165FD9FC9E3F98C9E38F5783
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 3F2E4938740142E01FB88F4134FD23DE
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/D3lOyaz33AOyGTIEqdOSEmJb5cnEgELXkEp-WZBOrR0.js
Frame ID: 1ED7969FCBDCAD1665A414D362B0DE1C
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/D3lOyaz33AOyGTIEqdOSEmJb5cnEgELXkEp-WZBOrR0.js
Frame ID: ACD5170690666767C16F98EAE18E988F
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: BADEC09E19D59508D14839141E4281B5
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: CF814FB686141CA4FD80405540D08864
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

FX自動売買blog｜みうラボ

Page URL History Show full URLs

https://mail.three-back.work/ HTTP 302
https://three-back.work/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Slick (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

html /<link [^>]+(?:\/([\d.]+)\/)?slick-theme\.css/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

html /<link [^>]+(?:\/([\d.]+)\/)?slick-theme\.css/i

Page Statistics

193
Requests

99 %
HTTPS

58 %
IPv6

22
Domains

30
Subdomains

30
IPs

5
Countries

2595 kB
Transfer

6153 kB
Size

5
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/sharer.php?src=bm&u=https%3A%2F%2Fthree-back.work&t=%E5%85%BC%E6%A5%AD%E6%8A%95%E8%B3%87%E5%AE%B6%E3%81%A3%E3%81%BD%E3%81%84%E3%81%93%E3%81%A8%E3%82%92%E3%81%A4%E3%81%B6%E3%82%84%E3%81%84%E3%81%A6%E3%81%84%E3%81%8D%E3%81%BE%E3%81%99%E3%80%82%E4%B8%BB%E3%81%ABFX%E8%87%AA%E5%8B%95%E5%A3%B2%E8%B2%B7%E3%82%B7%E3%82%B9%E3%83%86%E3%83%A0%28EA%29%E3%81%A7%E3%81%AE%E9%81%8B%E7%94%A8%E5%A0%B1%E5%91%8A%E3%82%84%E3%80%81%E3%81%9D%E3%81%AE%E4%BB%96%E5%88%86%E6%95%A3%E6%8A%95%E8%B3%87%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6%E3%82%82%E3%81%A1%E3%82%87%E3%81%84%E3%81%A1%E3%82%87%E3%81%84%E3%81%94%E7%B4%B9%E4%BB%8B%E3%81%97%E3%81%A6%E3%81%84%E3%81%8D%E3%81%BE%E3%81%99%E3%80%82%20-%20FX%E8%87%AA%E5%8B%95%E5%A3%B2%E8%B2%B7blog%EF%BD%9C%E3%81%BF%E3%81%86%E3%83%A9%E3%83%9C
Title: Share Share

Search URL Search Domain Scan URL

URL: https://b.hatena.ne.jp/entry/
Title: Hatena Hatena

Search URL Search Domain Scan URL

URL: https://line.me/R/msg/text/?%E5%85%BC%E6%A5%AD%E6%8A%95%E8%B3%87%E5%AE%B6%E3%81%A3%E3%81%BD%E3%81%84%E3%81%93%E3%81%A8%E3%82%92%E3%81%A4%E3%81%B6%E3%82%84%E3%81%84%E3%81%A6%E3%81%84%E3%81%8D%E3%81%BE%E3%81%99%E3%80%82%E4%B8%BB%E3%81%ABFX%E8%87%AA%E5%8B%95%E5%A3%B2%E8%B2%B7%E3%82%B7%E3%82%B9%E3%83%86%E3%83%A0%28EA%29%E3%81%A7%E3%81%AE%E9%81%8B%E7%94%A8%E5%A0%B1%E5%91%8A%E3%82%84%E3%80%81%E3%81%9D%E3%81%AE%E4%BB%96%E5%88%86%E6%95%A3%E6%8A%95%E8%B3%87%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6%E3%82%82%E3%81%A1%E3%82%87%E3%81%84%E3%81%A1%E3%82%87%E3%81%84%E3%81%94%E7%B4%B9%E4%BB%8B%E3%81%97%E3%81%A6%E3%81%84%E3%81%8D%E3%81%BE%E3%81%99%E3%80%82%20-%20FX%E8%87%AA%E5%8B%95%E5%A3%B2%E8%B2%B7blog%EF%BD%9C%E3%81%BF%E3%81%86%E3%83%A9%E3%83%9C%0Ahttps%3A%2F%2Fthree-back.work
Title: LINE

Search URL Search Domain Scan URL

URL: http://nav.cx/5Z0HHab

Search URL Search Domain Scan URL

URL: https://kerosuke-net.com/%e3%81%8a%e9%87%91%e3%82%92%e6%8c%81%e3%81%a4%e3%81%aa%e3%82%89%e9%8a%80%e3%82%92%e6%8c%81%e3%81%a6%e3%80%80%ef%bd%9e%e3%81%aa%e3%81%9c%e9%8a%80%e3%81%aa%e3%81%ae%e3%81%8b%ef%
Title: お金を持つなら銀を持て　～なぜ銀なのか～ | 気付けば社長よりも幸せになっていたパパリーマン

Search URL Search Domain Scan URL

URL: https://ja.wordpress.org/
Title: WordPress.org

Search URL Search Domain Scan URL

URL: http://manualstinger.com/cr
Title: AFFINGER5

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://mail.three-back.work/ HTTP 302
https://three-back.work/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 123

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 127

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 151

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 155

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJ5fakFzDrTi4BU1ssqe8OYvs1gAFNJ8uWRt8fe6DEM78nu_covfuejQyIjWYPAijeHLHQ14Zjtn8YTi0tYFvc0xzx3rsCe&google_gid=CAESEL4PGJrDizLw_dkD9Bzpsms&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJ5fakFzDrTi4BU1ssqe8OYvs1gAFNJ8uWRt8fe6DEM78nu_covfuejQyIjWYPAijeHLHQ14Zjtn8YTi0tYFvc0xzx3rsCe&google_gid=CAESEL4PGJrDizLw_dkD9Bzpsms&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA4MjUxMjI4NTQwMDAxMDM1OTEzNTc1MA%3D%3D&google_push=AYg5qPJ5fakFzDrTi4BU1ssqe8OYvs1gAFNJ8uWRt8fe6DEM78nu_covfuejQyIjWYPAijeHLHQ14Zjtn8YTi0tYFvc0xzx3rsCe

Request Chain 156

https://rtb.openx.net/sync/dds?google_gid=CAESEAtFo-J7VMM8x5rljmX_pfg&google_cver=1&google_push=AYg5qPIjmsYL0tsMRAUVUhkX_y7JWlhYZCfUzwH5moQCHhnp6pT3A_Im-cuTUFiiIF4lXU_yj4SFRCygAUspgwQdQneFtnGhylxK HTTP 302
https://rtb.openx.net/sync/dds?google_gid=CAESEAtFo-J7VMM8x5rljmX_pfg&google_cver=1&google_push=AYg5qPIjmsYL0tsMRAUVUhkX_y7JWlhYZCfUzwH5moQCHhnp6pT3A_Im-cuTUFiiIF4lXU_yj4SFRCygAUspgwQdQneFtnGhylxK&ox_sc=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIjmsYL0tsMRAUVUhkX_y7JWlhYZCfUzwH5moQCHhnp6pT3A_Im-cuTUFiiIF4lXU_yj4SFRCygAUspgwQdQneFtnGhylxK&google_hm=nGLo7fmOyGwrynwWeCQVWw==

Request Chain 157

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEHIzMvm62ToNTMWu3IUUbzc&google_cver=1&google_push=AYg5qPIEKdB2tcdl0AX_xruzMMJVYPZUNemlL6MpFdgUvh8qvxB8VPomQQf4cgcoy-rorgoQU4LvqkLeZ6f2uGp0ye_WuhnoG8EB HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEHIzMvm62ToNTMWu3IUUbzc&google_cver=1&google_push=AYg5qPIEKdB2tcdl0AX_xruzMMJVYPZUNemlL6MpFdgUvh8qvxB8VPomQQf4cgcoy-rorgoQU4LvqkLeZ6f2uGp0ye_WuhnoG8EB&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YTw17UR7TI2vb3TLEqDAFw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIEKdB2tcdl0AX_xruzMMJVYPZUNemlL6MpFdgUvh8qvxB8VPomQQf4cgcoy-rorgoQU4LvqkLeZ6f2uGp0ye_WuhnoG8EB

Request Chain 158

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEFM4Pl-r7FDdLOwNQUeRlj0&google_cver=1&google_push=AYg5qPI5UUED-1yo90f2n9Td5oBZRXbkQK_liL94zv0snF8TYK8PG-RAjne90dY4X73zBGGnoSl0moM_T2pgrjPhtINQmpImPVMI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NSSDRGT0ctWi0xR0Yx&google_push=AYg5qPI5UUED-1yo90f2n9Td5oBZRXbkQK_liL94zv0snF8TYK8PG-RAjne90dY4X73zBGGnoSl0moM_T2pgrjPhtINQmpImPVMI

Request Chain 159

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_cver=1&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC

Request Chain 166

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 173

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 179

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

193 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
three-back.work/
Redirect Chain

https://mail.three-back.work/
https://three-back.work/

88 KB
15 KB

575ms
573ms

Document
text/html

150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 7361ed8e531bf4dcdd1fc63a49f0dff0f1c88a960f689dbbef8322081a2c39bc

Request headers

:method: GET
:authority: three-back.work
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
link: <https://three-back.work/index.php?rest_route=/>; rel="https://api.w.org/"
content-encoding: br
vary: Accept-Encoding
date: Wed, 25 Aug 2021 12:28:50 GMT
server: LiteSpeed

Redirect headers

location: https://three-back.work/
content-type: text/html; charset=UTF-8
content-length: 0
date: Wed, 25 Aug 2021 12:28:50 GMT
server: LiteSpeed
cache-control: no-cache, no-store, must-revalidate, max-age=0
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000

GET
H2 200 default-font-css.php
three-back.work/wp-content/plugins/japanese-font-for-tinymce/ 57 B
179 B 280ms
275ms Stylesheet
text/css 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/plugins/japanese-font-for-tinymce/default-font-css.php?fn&ver=5.8
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 615ad880102b508eabed46867224661b5142ad5bd9a0d87cff05712ea373035b

Request headers

:path: /wp-content/plugins/japanese-font-for-tinymce/default-font-css.php?fn&ver=5.8
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css; charset: UTF-8;charset=UTF-8
cache-control: public, max-age=604800
content-length: 48
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 style.min.css
three-back.work/wp-includes/css/dist/block-library/ 79 KB
10 KB 280ms
275ms Stylesheet
text/css 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-includes/css/dist/block-library/style.min.css?ver=5.8
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Request headers

:path: /wp-includes/css/dist/block-library/style.min.css?ver=5.8
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
last-modified: Sun, 08 Aug 2021 06:42:01 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 9960
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 styles.css
three-back.work/wp-content/plugins/contact-form-7/includes/css/ 3 KB
881 B 280ms
276ms Stylesheet
text/css 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.4.2
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 070edfef42e0980783d0acf8fa9ca6a9833b994eca13ffaa94e9a2deb47c92cf

Request headers

:path: /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.4.2
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
last-modified: Wed, 14 Jul 2021 12:01:46 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 824
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 drawit.min.css
three-back.work/wp-content/plugins/drawit/css/ 1 KB
483 B 280ms
276ms Stylesheet
text/css 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/plugins/drawit/css/drawit.min.css?ver=1.1.3
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 745d8f58c6d5bf0e360b3665c7ea60fddfb2820d4d62e904a4043c4f145ba38f

Request headers

:path: /wp-content/plugins/drawit/css/drawit.min.css?ver=1.1.3
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
last-modified: Tue, 15 Oct 2019 13:47:45 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 425
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 addfont.css
three-back.work/wp-content/plugins/japanese-font-for-tinymce/ 3 KB
701 B 281ms
276ms Stylesheet
text/css 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/plugins/japanese-font-for-tinymce/addfont.css?ver=5.8
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: af55f0c6a549d286354966d0e237909396d3c0af5a5a7b8ee750e147d6a9da85

Request headers

:path: /wp-content/plugins/japanese-font-for-tinymce/addfont.css?ver=5.8
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
last-modified: Fri, 16 Jul 2021 00:10:14 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 643
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 screen.min.css
three-back.work/wp-content/plugins/table-of-contents-plus/ 1 KB
436 B 281ms
276ms Stylesheet
text/css 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/plugins/table-of-contents-plus/screen.min.css?ver=2106
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 2e36bd3bdbb929f427e79a6c84b7922b4375589386981eba29eb0cff57b02b1b

Request headers

:path: /wp-content/plugins/table-of-contents-plus/screen.min.css?ver=2106
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
last-modified: Wed, 23 Jun 2021 12:02:11 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 378
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 normalize.css
three-back.work/wp-content/themes/affinger5/css/ 2 KB
799 B 281ms
277ms Stylesheet
text/css 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/themes/affinger5/css/normalize.css?ver=1.5.9
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 72e5e3fcd775fb75052cfa8980a8664b47e978d986fc7ab4ccd5f5c70c2ce9fb

Request headers

:path: /wp-content/themes/affinger5/css/normalize.css?ver=1.5.9
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
last-modified: Sat, 15 Feb 2020 03:29:40 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 741
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 font-awesome.min.css
three-back.work/wp-content/themes/affinger5/css/fontawesome/css/ 30 KB
7 KB 281ms
277ms Stylesheet
text/css 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/themes/affinger5/css/fontawesome/css/font-awesome.min.css?ver=4.7.0
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

:path: /wp-content/themes/affinger5/css/fontawesome/css/font-awesome.min.css?ver=4.7.0
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
last-modified: Sat, 15 Feb 2020 03:29:40 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 6658
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 font-awesome-animation.min.css
three-back.work/wp-content/themes/affinger5/css/fontawesome/css/ 18 KB
2 KB 281ms
277ms Stylesheet
text/css 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/themes/affinger5/css/fontawesome/css/font-awesome-animation.min.css?ver=5.8
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 3a4b03a6c128b46647ca81421d1b1db2577751a66b09c13677c8d753cac18c7a

Request headers

:path: /wp-content/themes/affinger5/css/fontawesome/css/font-awesome-animation.min.css?ver=5.8
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
last-modified: Sat, 15 Feb 2020 03:29:40 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 1592
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 style.css
three-back.work/wp-content/themes/affinger5/st_svg/ 2 KB
660 B 281ms
278ms Stylesheet
text/css 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/themes/affinger5/st_svg/style.css?ver=5.8
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 03d741330bbcf02d10b49ae22496c2dca57d21ed1d5a49ac303ef12869680d49

Request headers

:path: /wp-content/themes/affinger5/st_svg/style.css?ver=5.8
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
last-modified: Sat, 15 Feb 2020 03:29:40 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 626
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 slick.css
three-back.work/wp-content/themes/affinger5/vendor/slick/ 2 KB
517 B 281ms
278ms Stylesheet
text/css 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/themes/affinger5/vendor/slick/slick.css?ver=1.8.0
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: de1e399b07289f3b0a8d35142e363e128124a1185770e214e25e58030dad48e5

Request headers

:path: /wp-content/themes/affinger5/vendor/slick/slick.css?ver=1.8.0
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
last-modified: Sat, 15 Feb 2020 03:29:40 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 483
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 slick-theme.css
three-back.work/wp-content/themes/affinger5/vendor/slick/ 3 KB
797 B 281ms
278ms Stylesheet
text/css 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/themes/affinger5/vendor/slick/slick-theme.css?ver=1.8.0
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 7adaf08052c6a6a0f8a0d0055b4f191fd07389fe41c972b69573472b2ecb406a

Request headers

:path: /wp-content/themes/affinger5/vendor/slick/slick-theme.css?ver=1.8.0
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
last-modified: Sat, 15 Feb 2020 03:29:40 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 763
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 style.css
three-back.work/wp-content/themes/affinger5/ 201 KB
36 KB 281ms
278ms Stylesheet
text/css 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/themes/affinger5/style.css?ver=5.8
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: e7363a2cbc6f57fe286b6fbdb6f13c57be00b8ef05e9afe1b82ac88d6026d7d3

Request headers

:path: /wp-content/themes/affinger5/style.css?ver=5.8
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
last-modified: Sat, 15 Feb 2020 03:29:40 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 36317
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 style.css
three-back.work/wp-content/themes/affinger5-child/ 3 KB
877 B 539ms
536ms Stylesheet
text/css 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/themes/affinger5-child/style.css?ver=5.8
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 0d421ab8abaa2d4b88ecc19902a04d9b5ac812bbb4be158dd1a72437ab32926b

Request headers

:path: /wp-content/themes/affinger5-child/style.css?ver=5.8
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
last-modified: Sat, 09 Nov 2019 14:54:56 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 820
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 st-rankcss.php
three-back.work/wp-content/themes/affinger5/ 14 KB
3 KB 540ms
538ms Stylesheet
text/css 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/themes/affinger5/st-rankcss.php
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 1f88721b914f3ea902885d622d6d7d8327b47e3714d0b6b3a8cf39604ee8b67c

Request headers

:path: /wp-content/themes/affinger5/st-rankcss.php
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
expires: Wed, 01 Sep 2021 12:28:51 GMT
server: LiteSpeed
cache-control: public, max-age=604800
vary: Accept-Encoding
content-type: text/css; charset=utf-8

GET
H2 200 jquery.fancybox.min.css
three-back.work/wp-content/plugins/easy-fancybox/css/ 4 KB
1 KB 540ms
537ms Stylesheet
text/css 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/plugins/easy-fancybox/css/jquery.fancybox.min.css?ver=1.3.24
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: f34bb7d9c8f2db0e78e5d7b226bc169182f8c22e7cd1a3e7b5767519b709c1bc

Request headers

:path: /wp-content/plugins/easy-fancybox/css/jquery.fancybox.min.css?ver=1.3.24
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
last-modified: Mon, 14 Oct 2019 04:59:34 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 969
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 st-themecss-loader.php
three-back.work/wp-content/themes/affinger5/ 65 KB
13 KB 540ms
538ms Stylesheet
text/css 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/themes/affinger5/st-themecss-loader.php?ver=5.8
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: a986c1b3b11a193434bcbd30c93a88bb86f08c2bd43f442ccdb1fc0eae9f7df4

Request headers

:path: /wp-content/themes/affinger5/st-themecss-loader.php?ver=5.8
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: no-cache, must-revalidate, max-age=0
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 table-of-content-frontend.css
three-back.work/wp-content/plugins/cm-table-of-content/assets/css/ 1 KB
289 B 539ms
537ms Stylesheet
text/css 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/plugins/cm-table-of-content/assets/css/table-of-content-frontend.css?ver=5.8
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: ea8082a6abf62fbbf414a90dee70cf79916101737ca24079413708515a1e1a99

Request headers

:path: /wp-content/plugins/cm-table-of-content/assets/css/table-of-content-frontend.css?ver=5.8
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
last-modified: Fri, 04 Jun 2021 00:02:58 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 232
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.11.3/ 94 KB
94 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js?ver=1.11.3

Requested by

Host: three-back.work
URL: https://three-back.work/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 14:11:03 GMT
x-content-type-options: nosniff
age: 80268
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95992
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 Aug 2022 14:11:03 GMT

GET
H2 200 quicktags.min.js Show response
three-back.work/wp-includes/js/ 11 KB
3 KB 578ms
576ms Script
application/javascript 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-includes/js/quicktags.min.js?ver=5.8
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 758415fd3b5867003c3649969039694ee59b4774bb58246f3ec644e1dc577885

Request headers

:path: /wp-includes/js/quicktags.min.js?ver=5.8
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
last-modified: Sun, 08 Aug 2021 06:42:03 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 3338
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 qt-btn.js Show response
three-back.work/wp-content/plugins/drawit/js/ 4 KB
1 KB 578ms
576ms Script
application/javascript 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/plugins/drawit/js/qt-btn.js?ver=1.1.3
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 96e3246024b7d036175aef66849fdd5890c4d8f863bf827e5a57838b703b3d3b

Request headers

:path: /wp-content/plugins/drawit/js/qt-btn.js?ver=1.1.3
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
last-modified: Tue, 15 Oct 2019 13:47:45 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 1312
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 139 KB
49 KB 39ms
37ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: three-back.work
URL: https://three-back.work/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4c8391b3547e1287b47be67fdf25bc781345919f26cbaff911863a3463f10d59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49973
x-xss-protection: 0
server: cafe
etag: 3087659792122686807
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 25 Aug 2021 12:28:51 GMT

GET
H2 200 15722441229840726-1-e1572355941876.png
three-back.work/wp-content/uploads/2019/10/ 9 KB
9 KB 294ms
294ms Image
image/png 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://three-back.work/wp-content/uploads/2019/10/15722441229840726-1-e1572355941876.png
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 023cd7e2d58f71286cca9d16a22508396798a90df55452def220aaccb03648ac

Request headers

:path: /wp-content/uploads/2019/10/15722441229840726-1-e1572355941876.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
last-modified: Tue, 29 Oct 2019 13:32:26 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 9484
expires: Wed, 01 Sep 2021 12:28:52 GMT

GET
H2 200 bookmark_button.js Show response
b.st-hatena.com/js/ 35 KB
11 KB 106ms
29ms Script
application/x-javascript 13.224.96.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://b.st-hatena.com/js/bookmark_button.js

Requested by

Host: three-back.work
URL: https://three-back.work/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.45 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-96-45.zrh50.r.cloudfront.net

Software

nginx /

Resource Hash

df7082849e38de724a9e44f1169768edf49b462f04d295927960d588a735bb5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
last-modified: Mon, 23 Aug 2021 06:10:06 GMT
server: nginx
age: 72030
etag: W/"61233bbe-8aee"
x-cache: Hit from cloudfront
content-type: application/x-javascript
access-control-allow-origin: https://b.hatena.ne.jp
cache-control: max-age=86400
date: Tue, 24 Aug 2021 16:28:21 GMT
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: LZ1LeNiMW66O2NXhCAPP7t4Gf8SyplcwaswSv89sSRn48n4KlckbzA==
via: 1.1 08c5e904e2f0226b2d9c1417f32b12f2.cloudfront.net (CloudFront)
expires: Wed, 25 Aug 2021 16:28:20 GMT

GET
H2 200 dog-1532627_960_720.png
cdn.pixabay.com/photo/2016/07/21/14/18/ 120 KB
121 KB 73ms
48ms Image
image/webp 2606:4700::6812:15b7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.pixabay.com/photo/2016/07/21/14/18/dog-1532627_960_720.png
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15b7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 340cebbd102b7e2229ef3e3d11779474717b3c1dd3446bf696deea24fab1df55

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
cf-cache-status: HIT
age: 3046804
cf-polished: origFmt=png, origSize=196841
cf-ray: 6844d2986e2ac2e0-FRA
x-amz-replication-status: COMPLETED
content-disposition: inline; filename="dog-1532627_960_720.webp"
cf-bgj: imgq:85,h2pri
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 123000
x-amz-id-2: cFmQwja7NMN3yCnDHuf5pvEHQC/B0vjH7Pf2Y62Cz0jiqYNb5v8wFkOR4X+ndoJ0evBHd7/5noQ=
last-modified: Wed, 27 Feb 2019 12:15:40 GMT
server: cloudflare
etag: "d91af8a3713a48a7686bce2c97f51e6b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
x-amz-request-id: HH87VG7FR5Y0Q228
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000
x-amz-version-id: 3nMd4YsopvtB75977Dmrac_3hyMg3_1R
accept-ranges: bytes
content-type: image/webp
expires: Thu, 25 Aug 2022 12:28:51 GMT

GET
H2 200 ja.png
scdn.line-apps.com/n/line_add_friends/btn/ 4 KB
4 KB 101ms
26ms Image
image/png 2.18.232.182
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scdn.line-apps.com/n/line_add_friends/btn/ja.png
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.182 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-182.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: faf3a5b0232e4515f5c4b91225ab985faa6813ee78d0123a560def12ebe56597

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
last-modified: Mon, 19 Nov 2018 05:53:09 GMT
server: nginx
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=20049540
accept-ranges: bytes
content-length: 3973
expires: Thu, 14 Apr 2022 13:47:51 GMT

GET
H2 200 486walue.png
qr-official.line.me/sid/M/ 816 B
946 B 890ms
266ms Image
image/png 147.92.146.123
LINE LINE Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qr-official.line.me/sid/M/486walue.png
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 147.92.146.123 , Japan, ASN38631 (LINE LINE Corporation, JP),
Reverse DNS
Software: nginx /
Resource Hash: b03f8824c87fa1c322b227aeddb87d0bffb142815c18699c6fba59a59901a748

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
cache-control: max-age=86400
server: nginx
expires: Thu, 26 Aug 2021 12:28:52 GMT

GET
H2 200 search.png
three-back.work/wp-content/themes/affinger5/images/ 356 B
388 B 1571ms
1570ms Image
image/png 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://three-back.work/wp-content/themes/affinger5/images/search.png
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: eeccf8db2f38aff197eb60e56e0957b2035e3e4e51b6f2117d32e139ee711eff

Request headers

:path: /wp-content/themes/affinger5/images/search.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
last-modified: Sat, 15 Feb 2020 03:29:40 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 356
expires: Wed, 01 Sep 2021 12:28:52 GMT

GET
H2 200 wp-emoji-release.min.js Show response
three-back.work/wp-includes/js/ 18 KB
5 KB 276ms
272ms Script
application/javascript 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-includes/js/wp-emoji-release.min.js?ver=5.8
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Request headers

:path: /wp-includes/js/wp-emoji-release.min.js?ver=5.8
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:54 GMT
content-encoding: br
last-modified: Sun, 08 Aug 2021 06:42:03 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 4539
expires: Wed, 01 Sep 2021 12:28:54 GMT

GET
H2 200 regenerator-runtime.min.js Show response
three-back.work/wp-includes/js/dist/vendor/ 6 KB
2 KB 271ms
270ms Script
application/javascript 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.7
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: e87a1c5e24f9a7c7dcb437417f0b05b0a3c12947ce32d65c990c988a8b5ed4d7

Request headers

:path: /wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.7
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
last-modified: Sun, 08 Aug 2021 06:42:02 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 2308
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 wp-polyfill.min.js Show response
three-back.work/wp-includes/js/dist/vendor/ 16 KB
6 KB 272ms
271ms Script
application/javascript 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 293913879d30bab7499013e935009f5183facbddd63bfc9656a859622590b80b

Request headers

:path: /wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:51 GMT
content-encoding: br
last-modified: Sun, 08 Aug 2021 06:42:02 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 5805
expires: Wed, 01 Sep 2021 12:28:51 GMT

GET
H2 200 index.js Show response
three-back.work/wp-content/plugins/contact-form-7/includes/js/ 13 KB
4 KB 271ms
269ms Script
application/javascript 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.4.2
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: eea0b9621509f98be77c5af1e9b5c952a675bda2b27c419876364017069e0c19

Request headers

:path: /wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.4.2
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
content-encoding: br
last-modified: Wed, 14 Jul 2021 12:01:46 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 3837
expires: Wed, 01 Sep 2021 12:28:52 GMT

GET
H2 200 drawit-iframe.js Show response
three-back.work/wp-content/plugins/drawit/js/ 301 B
253 B 272ms
269ms Script
application/javascript 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/plugins/drawit/js/drawit-iframe.js?ver=1.1.3
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 2a4524121bf19007ba74de48ee59ab4226c29928282ef0534f07b499b3ca1c0d

Request headers

:path: /wp-content/plugins/drawit/js/drawit-iframe.js?ver=1.1.3
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
content-encoding: br
last-modified: Tue, 15 Oct 2019 13:47:45 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 149
expires: Wed, 01 Sep 2021 12:28:52 GMT

GET
H2 200 front.min.js Show response
three-back.work/wp-content/plugins/table-of-contents-plus/ 6 KB
2 KB 272ms
270ms Script
application/javascript 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/plugins/table-of-contents-plus/front.min.js?ver=2106
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 4b179562b883c1257aabbad3a5641f965dd7331faa31fe06382a5d8c62d5ee19

Request headers

:path: /wp-content/plugins/table-of-contents-plus/front.min.js?ver=2106
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
content-encoding: br
last-modified: Wed, 23 Jun 2021 12:02:11 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 2181
expires: Wed, 01 Sep 2021 12:28:52 GMT

GET
H2 200 slick.js Show response
three-back.work/wp-content/themes/affinger5/vendor/slick/ 86 KB
14 KB 272ms
270ms Script
application/javascript 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/themes/affinger5/vendor/slick/slick.js?ver=1.5.9
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 3e65bc436e35cb24f4020abe8a71906ea53ca284df84095d6824e27f55883f90

Request headers

:path: /wp-content/themes/affinger5/vendor/slick/slick.js?ver=1.5.9
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
content-encoding: br
last-modified: Sat, 15 Feb 2020 03:29:40 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 14755
expires: Wed, 01 Sep 2021 12:28:52 GMT

GET
H2 200 base.js Show response
three-back.work/wp-content/themes/affinger5/js/ 12 KB
3 KB 271ms
269ms Script
application/javascript 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/themes/affinger5/js/base.js?ver=5.8
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 33a707e8755868f0d81e6d05162dd0239ed27ace94378585c2e82f306fa69f2e

Request headers

:path: /wp-content/themes/affinger5/js/base.js?ver=5.8
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
content-encoding: br
last-modified: Sat, 15 Feb 2020 03:29:40 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 2845
expires: Wed, 01 Sep 2021 12:28:52 GMT

GET
H2 200 scroll.js Show response
three-back.work/wp-content/themes/affinger5/js/ 1018 B
475 B 271ms
270ms Script
application/javascript 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/themes/affinger5/js/scroll.js?ver=5.8
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 7437a5077982ed799fe7c545a0524124c2b620c79a27ac7662b61199b775c567

Request headers

:path: /wp-content/themes/affinger5/js/scroll.js?ver=5.8
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
content-encoding: br
last-modified: Sat, 15 Feb 2020 03:29:40 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 441
expires: Wed, 01 Sep 2021 12:28:52 GMT

GET
H2 200 st-copy-text.js Show response
three-back.work/wp-content/themes/affinger5/js/ 2 KB
672 B 1387ms
1382ms Script
application/javascript 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/themes/affinger5/js/st-copy-text.js?ver=5.8
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 56bf2dfb9f1735d0ec217531e6a064b01a5056e7b9f78246c93427299572421a

Request headers

:path: /wp-content/themes/affinger5/js/st-copy-text.js?ver=5.8
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
content-encoding: br
last-modified: Sat, 15 Feb 2020 03:29:40 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 638
expires: Wed, 01 Sep 2021 12:28:52 GMT

GET
H2 200 jquery.fancybox.min.js Show response
three-back.work/wp-content/plugins/easy-fancybox/js/ 19 KB
6 KB 789ms
789ms Script
application/javascript 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/plugins/easy-fancybox/js/jquery.fancybox.min.js?ver=1.3.24
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 948f0c154ad97428bc1d1dee456f2e20ec4e0e302b0d3189e08a4573cb63cdb3

Request headers

:path: /wp-content/plugins/easy-fancybox/js/jquery.fancybox.min.js?ver=1.3.24
pragma: no-cache
cookie: __gads=ID=9ce33a21236479a2-223f2ff8b4c9000a:T=1629894532:RT=1629894532:S=ALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw; FCCDCF=[null,null,["[[],[],[],[],null,null,true]",1629894532799],null,null]
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:53 GMT
content-encoding: br
last-modified: Mon, 14 Oct 2019 04:59:34 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 5950
expires: Wed, 01 Sep 2021 12:28:53 GMT

GET
H2 200 jquery.easing.min.js Show response
three-back.work/wp-content/plugins/easy-fancybox/js/ 2 KB
836 B 790ms
789ms Script
application/javascript 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/plugins/easy-fancybox/js/jquery.easing.min.js?ver=1.4.1
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 0ec98adf593ebcc01bec60b1f494dacd47522abfef9038a714101d83f45e165d

Request headers

:path: /wp-content/plugins/easy-fancybox/js/jquery.easing.min.js?ver=1.4.1
pragma: no-cache
cookie: __gads=ID=9ce33a21236479a2-223f2ff8b4c9000a:T=1629894532:RT=1629894532:S=ALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw; FCCDCF=[null,null,["[[],[],[],[],null,null,true]",1629894532799],null,null]
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:53 GMT
content-encoding: br
last-modified: Mon, 14 Oct 2019 04:59:34 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 733
expires: Wed, 01 Sep 2021 12:28:53 GMT

GET
H2 200 jquery.mousewheel.min.js Show response
three-back.work/wp-content/plugins/easy-fancybox/js/ 3 KB
1 KB 267ms
266ms Script
application/javascript 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/plugins/easy-fancybox/js/jquery.mousewheel.min.js?ver=3.1.13
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: dd9bfe5f04d4e393463f42b4f503763c36693306dffef16d481e0c071b61ae64

Request headers

:path: /wp-content/plugins/easy-fancybox/js/jquery.mousewheel.min.js?ver=3.1.13
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:53 GMT
content-encoding: br
last-modified: Mon, 14 Oct 2019 04:59:34 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 1051
expires: Wed, 01 Sep 2021 12:28:53 GMT

GET
H2 200 wp-embed.min.js Show response
three-back.work/wp-includes/js/ 1 KB
769 B 276ms
272ms Script
application/javascript 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-includes/js/wp-embed.min.js?ver=5.8
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

:path: /wp-includes/js/wp-embed.min.js?ver=5.8
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:54 GMT
content-encoding: br
last-modified: Mon, 15 Feb 2021 03:44:58 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 663
expires: Wed, 01 Sep 2021 12:28:54 GMT

GET
H2 200 matomo.js Show response
three-back.work/miulabo/ 61 KB
19 KB 276ms
272ms Script
application/javascript 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/miulabo/matomo.js
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 382843b96a3a0f2c2b38c583563caad12733ae44b4b5f1b97abe948fc461596f

Request headers

:path: /miulabo/matomo.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:54 GMT
content-encoding: br
last-modified: Mon, 11 Jan 2021 10:13:00 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 19278
expires: Wed, 01 Sep 2021 12:28:54 GMT

GET
H2 200 p5.png
three-back.work/wp-content/uploads/2019/10/ 135 B
200 B 294ms
293ms Image
image/png 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://three-back.work/wp-content/uploads/2019/10/p5.png
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 8255707b639b721c4c5a4329de6574331aadb575cedc7f032aa4858a0db73ae6

Request headers

:path: /wp-content/uploads/2019/10/p5.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
last-modified: Tue, 22 Oct 2019 13:10:37 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 135
expires: Wed, 01 Sep 2021 12:28:52 GMT

GET
H2 200 st-themecss-loader.php
three-back.work/wp-content/themes/affinger5/ 64 KB
64 KB 1581ms
1581ms Image
text/css 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://three-back.work/wp-content/themes/affinger5/st-themecss-loader.php?ver=5.8
Requested by: Host: three-back.work
URL: https://three-back.work/wp-content/themes/affinger5/st-themecss-loader.php?ver=5.8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /wp-content/themes/affinger5/st-themecss-loader.php?ver=5.8
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: three-back.work
referer: https://three-back.work/wp-content/themes/affinger5/st-themecss-loader.php?ver=5.8
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/wp-content/themes/affinger5/st-themecss-loader.php?ver=5.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:52 GMT
content-encoding: br
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: no-cache, must-revalidate, max-age=0
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 fontawesome-webfont.woff2
three-back.work/wp-content/themes/affinger5/css/fontawesome/fonts/ 75 KB
75 KB 267ms
266ms Font
font/woff2 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/themes/affinger5/css/fontawesome/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: three-back.work
URL: https://three-back.work/wp-content/themes/affinger5/css/fontawesome/css/font-awesome.min.css?ver=4.7.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

:path: /wp-content/themes/affinger5/css/fontawesome/fonts/fontawesome-webfont.woff2?v=4.7.0
pragma: no-cache
origin: https://three-back.work
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: three-back.work
referer: https://three-back.work/wp-content/themes/affinger5/css/fontawesome/css/font-awesome.min.css?ver=4.7.0
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://three-back.work
Referer: https://three-back.work/wp-content/themes/affinger5/css/fontawesome/css/font-awesome.min.css?ver=4.7.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
last-modified: Sat, 15 Feb 2020 03:29:40 GMT
server: LiteSpeed
content-type: font/woff2
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 77160
expires: Wed, 01 Sep 2021 12:28:52 GMT

GET
H2 200 drawit-diagram-9.png
three-back.work/wp-content/uploads/2019/11/ 325 KB
325 KB 266ms
265ms Image
image/png 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://three-back.work/wp-content/uploads/2019/11/drawit-diagram-9.png
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 8f35757970e1ff0371dd3b3e16bf38f582072bf88cd9bdb7fccd25af04458dc7

Request headers

:path: /wp-content/uploads/2019/11/drawit-diagram-9.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
last-modified: Sat, 09 Nov 2019 02:28:35 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 333054
expires: Wed, 01 Sep 2021 12:28:52 GMT

GET
H2 200 landscape-2990060_960_720-150x150.jpg
three-back.work/wp-content/uploads/2021/08/ 5 KB
5 KB 921ms
921ms Image
image/jpeg 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://three-back.work/wp-content/uploads/2021/08/landscape-2990060_960_720-150x150.jpg
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 58629af3bd5fba642a9d794dc638478c29cb9daba582a7267fb608d6b3d36eb7

Request headers

:path: /wp-content/uploads/2021/08/landscape-2990060_960_720-150x150.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
last-modified: Sun, 15 Aug 2021 12:21:59 GMT
server: LiteSpeed
content-type: image/jpeg
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 5468
expires: Wed, 01 Sep 2021 12:28:52 GMT

GET
H2 200 entrepreneur-1340649_960_720-150x150.jpg
three-back.work/wp-content/uploads/2021/08/ 8 KB
8 KB 921ms
921ms Image
image/jpeg 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://three-back.work/wp-content/uploads/2021/08/entrepreneur-1340649_960_720-150x150.jpg
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: fbb12ac6c339e865da5258237ebae68e2314f9afa18e1494f49c357d9cd8a9c1

Request headers

:path: /wp-content/uploads/2021/08/entrepreneur-1340649_960_720-150x150.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
last-modified: Sun, 08 Aug 2021 07:01:59 GMT
server: LiteSpeed
content-type: image/jpeg
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 7698
expires: Wed, 01 Sep 2021 12:28:52 GMT

GET
H2 200 %E3%82%B3%E3%83%A1%E3%83%B3%E3%83%88-2020-09-07-164206-150x150.jpg
three-back.work/wp-content/uploads/2020/09/ 4 KB
4 KB 921ms
921ms Image
image/jpeg 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://three-back.work/wp-content/uploads/2020/09/%E3%82%B3%E3%83%A1%E3%83%B3%E3%83%88-2020-09-07-164206-150x150.jpg
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: f15837157125dd8537e5c8691e10932f3c55f1a0cdadbf0d05dd6fabc7be8291

Request headers

:path: /wp-content/uploads/2020/09/%E3%82%B3%E3%83%A1%E3%83%B3%E3%83%88-2020-09-07-164206-150x150.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
last-modified: Mon, 07 Sep 2020 07:42:38 GMT
server: LiteSpeed
content-type: image/jpeg
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 3942
expires: Wed, 01 Sep 2021 12:28:52 GMT

GET
H2 200 stsvg.ttf
three-back.work/wp-content/themes/affinger5/st_svg/fonts/ 3 KB
3 KB 271ms
270ms Font
font/ttf 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/wp-content/themes/affinger5/st_svg/fonts/stsvg.ttf?poe1v2
Requested by: Host: three-back.work
URL: https://three-back.work/wp-content/themes/affinger5/st_svg/style.css?ver=5.8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 398b6670ad0185a0996862a28b55e1bebac53a1cc7f8ed8e26e89b65eabf965d

Request headers

:path: /wp-content/themes/affinger5/st_svg/fonts/stsvg.ttf?poe1v2
pragma: no-cache
origin: https://three-back.work
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: three-back.work
referer: https://three-back.work/wp-content/themes/affinger5/st_svg/style.css?ver=5.8
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://three-back.work
Referer: https://three-back.work/wp-content/themes/affinger5/st_svg/style.css?ver=5.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
last-modified: Sat, 15 Feb 2020 03:29:40 GMT
server: LiteSpeed
content-type: font/ttf
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 2684
expires: Wed, 01 Sep 2021 12:28:52 GMT

GET
H2 200 AlograndSmall3-150x150.jpg
three-back.work/wp-content/uploads/2021/04/ 2 KB
2 KB 276ms
273ms Image
image/jpeg 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://three-back.work/wp-content/uploads/2021/04/AlograndSmall3-150x150.jpg
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: d6cd52651fa64dd75f14c75dbe13d695dae01d05b0eaac3522f160c20273520d

Request headers

:path: /wp-content/uploads/2021/04/AlograndSmall3-150x150.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:54 GMT
last-modified: Fri, 23 Apr 2021 05:31:15 GMT
server: LiteSpeed
content-type: image/jpeg
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 1788
expires: Wed, 01 Sep 2021 12:28:54 GMT

GET
H2 200 rectangle_large_type_2_a47975da6e0e02f08493072442102797-150x150.jpg
three-back.work/wp-content/uploads/2020/08/ 5 KB
5 KB 277ms
273ms Image
image/jpeg 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://three-back.work/wp-content/uploads/2020/08/rectangle_large_type_2_a47975da6e0e02f08493072442102797-150x150.jpg
Requested by: Host: three-back.work
URL: https://three-back.work/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: 29d96496ccfa8ad61ca499fb465ac1fa66ccca13be0919c6a16bcbc0ba2ca7d2

Request headers

:path: /wp-content/uploads/2020/08/rectangle_large_type_2_a47975da6e0e02f08493072442102797-150x150.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:54 GMT
last-modified: Sun, 23 Aug 2020 03:32:33 GMT
server: LiteSpeed
content-type: image/jpeg
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 4923
expires: Wed, 01 Sep 2021 12:28:54 GMT

GET
H3-29 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108240101/ 252 KB
93 KB 42ms
39ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1581705282178552&plah=three-back.work

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6a026094455ed434cd948b4fa17a485da650b5ada5b1b30ed6aa13d025df6004

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95644
x-xss-protection: 0
server: cafe
etag: 14968054363321910491
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 25 Aug 2021 12:28:52 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210819/r20190131/ Frame BF5D 10 KB
5 KB 8ms
6ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210819/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bf5230ffb8745d28c11ae8b743868364f9be8379300bd59d235f402a53ea96ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210819/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://three-back.work/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://three-back.work/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 25 Aug 2021 04:52:14 GMT
expires: Wed, 08 Sep 2021 04:52:14 GMT
content-type: text/html; charset=UTF-8
etag: 13836150016441684253
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4591
x-xss-protection: 0
age: 27398
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 /
b.hatena.ne.jp/entry/button/ 43 B
372 B 138ms
52ms Image
image/gif 13.224.96.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.hatena.ne.jp/entry/button/?url=https%3A%2F%2Fthree-back.work%2F&layout=simple&format=image

Requested by

Host: three-back.work
URL: https://three-back.work/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-96-14.zrh50.r.cloudfront.net

Software

nginx /

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:46 GMT
via: 1.1 eb7b239aed47669f8a7b6ac95bc8aff1.cloudfront.net (CloudFront)
server: nginx
age: 6
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache: Hit from cloudfront
content-type: image/gif
cache-control: public, max-age=3600, s-maxage=3600
x-amz-cf-pop: ZRH50-C1
content-length: 43
x-amz-cf-id: kHAvy8iEUYUy2uqhzonIaKNXTc5rLKydRLkL3TUvnyiEzAI3Qjo8TA==

GET
H2 200 ca-pub-1581705282178552 Show response
fundingchoicesmessages.google.com/i/ 96 KB
35 KB 95ms
52ms Script
application/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/ca-pub-1581705282178552?ers=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1581705282178552&plah=three-back.work

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1eb37c60a87a21881381e6808366cdc61a30221c4a7e2aa2b2fce6838cb09dec

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-y+w+KsvEVO5/XFmAaB0fbw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'nonce-y+w+KsvEVO5/XFmAaB0fbw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-security-policy: script-src 'report-sample' 'nonce-y+w+KsvEVO5/XFmAaB0fbw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'nonce-y+w+KsvEVO5/XFmAaB0fbw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 rum_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210816/r20110914/ 52 KB
20 KB 28ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210816/r20110914/rum_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

40a311226491ed1c94eb46a02aef4dc815b6c47c9e6b4ea8449bf516e69cc25a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 20:15:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58374
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20359
x-xss-protection: 0
server: cafe
etag: 10644762671935044055
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 07 Sep 2021 20:15:58 GMT

POST
H3-29 204 AGSKWxWhjd-WufiltFSmYcwERR3209nnGzVu05csgbu7yprQlHzzWEfNEhCE_bgZ3OdC8FaD4nrqxQlOq63AYxfiqkE= Show response
fundingchoicesmessages.google.com/el/ 0
27 B 34ms
20ms XHR
text/html 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWhjd-WufiltFSmYcwERR3209nnGzVu05csgbu7yprQlHzzWEfNEhCE_bgZ3OdC8FaD4nrqxQlOq63AYxfiqkE=?pvid=1526FE32-8939-4D3C-80F0-48570E43E8E3&anonid=BBEDE7D1-C939-47DF-9262-E5B8BE4CD4F4

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingLoaderClientJs.en_US.LXWGhRLIAo8.es5.O/d=1/rs=AJlcJMwz-6wqsyAiIE7Em3tTI4ufOMlSgA/m=loader_js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-CESp+ZmzdKvibfISCXhCTw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-CESp+ZmzdKvibfISCXhCTw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
access-control-max-age: 86400
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorLoggingHttp"
x-frame-options: SAMEORIGIN
report-to: {"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
content-type: text/html; charset=utf-8
access-control-allow-origin: https://three-back.work
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: script-src 'report-sample' 'nonce-CESp+ZmzdKvibfISCXhCTw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-CESp+ZmzdKvibfISCXhCTw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 AGSKWxUZ7wDk1PQvauXMLDTdCoRx98HTEJfCLI-eC0IElM28ks_ibosaYbPA7tL5aKwaXa8mJhf8GQRFaKoI8H6S57k= Show response
fundingchoicesmessages.google.com/f/ 72 KB
27 KB 58ms
44ms Script
application/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUZ7wDk1PQvauXMLDTdCoRx98HTEJfCLI-eC0IElM28ks_ibosaYbPA7tL5aKwaXa8mJhf8GQRFaKoI8H6S57k=?fccs=W251bGwsW1tdLFtdXSxudWxsLG51bGwsbnVsbCwyLFsxNjI5ODk0NTMyLDgxODAwMDAwMF0sIjE1MjZGRTMyLTg5MzktNEQzQy04MEYwLTQ4NTcwRTQzRThFMyIsIkJCRURFN0QxLUM5MzktNDdERi05MjYyLUU1QjhCRTRDRDRGNCIsbnVsbCxbbnVsbCxbN11dLCJodHRwczovL3RocmVlLWJhY2sud29yay8iXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingLoaderClientJs.en_US.LXWGhRLIAo8.es5.O/d=1/rs=AJlcJMwz-6wqsyAiIE7Em3tTI4ufOMlSgA/m=loader_js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5bd4c83bc24ba0a2e682ef5eb37362c7f0827e849cb319befcea36337f52574f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-y09jpaqKCWX26pz69TRoUw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-y09jpaqKCWX26pz69TRoUw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'report-sample' 'nonce-y09jpaqKCWX26pz69TRoUw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-y09jpaqKCWX26pz69TRoUw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 205 B
409 B 33ms
29ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=three-back.work&callback=_gfp_s_&client=ca-pub-1581705282178552

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

dd95d9168d1c1144f948f79c48a269e7270aaaca6b42ddd36d7133e3a3cf26ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 193
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 17ms
15ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=three-back.work

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 25 Aug 2021 12:28:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 15ms
14ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=three-back.work

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 25 Aug 2021 12:28:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E245 19 KB
5 KB 197ms
195ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&adk=1812271804&adf=3025194257&lmt=1629894532&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fthree-back.work%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=126&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2488773060453&rume=1&frm=20&pv=2&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=361

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4c37fd55eb6fd92897e00f010b8ba5cfd8714ab64c428b57422fac2bccc3a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&adk=1812271804&adf=3025194257&lmt=1629894532&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fthree-back.work%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=126&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2488773060453&rume=1&frm=20&pv=2&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=361
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://three-back.work/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://three-back.work/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 25 Aug 2021 12:28:53 GMT
server: cafe
content-length: 5242
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 25-Aug-2021 12:43:52 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 25 Aug 2021 12:28:53 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A309 94 KB
30 KB 507ms
507ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=5723592&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=218&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=moewzZI2iC&p=https%3A//three-back.work&dtd=368

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7e6ab35642971168713ec28f5c60578d6fb564a85fa7caba758bd00d455bfda4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=5723592&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=218&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=moewzZI2iC&p=https%3A//three-back.work&dtd=368
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://three-back.work/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://three-back.work/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 25 Aug 2021 12:28:53 GMT
server: cafe
content-length: 30872
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 25-Aug-2021 12:43:52 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 25 Aug 2021 12:28:53 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 56A3 82 KB
28 KB 487ms
487ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=4251178241&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=225&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2335&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=uODy3iUpDI&p=https%3A//three-back.work&dtd=371

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2b015b1ca9ab677caa494021e0aeb53674254e6dc8e98df5d85bdd45c4b7ebcd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=4251178241&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=225&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2335&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=uODy3iUpDI&p=https%3A//three-back.work&dtd=371
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://three-back.work/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://three-back.work/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 25 Aug 2021 12:28:53 GMT
server: cafe
content-length: 28662
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 25-Aug-2021 12:43:52 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 25 Aug 2021 12:28:53 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 10F8 85 KB
29 KB 470ms
470ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=169&slotname=8212816143&adk=730500670&adf=3217087521&pi=t.ma~as.8212816143&w=300&lmt=1629894532&rafmt=11&psa=0&format=300x169&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=226&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=4811&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=FgfLg2sH4U&p=https%3A//three-back.work&dtd=374

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

31f5ce66030c6175da15b8931c623ce0629048b2a88b0f90d44dda235eb01bf3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=169&slotname=8212816143&adk=730500670&adf=3217087521&pi=t.ma~as.8212816143&w=300&lmt=1629894532&rafmt=11&psa=0&format=300x169&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=226&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=4811&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=FgfLg2sH4U&p=https%3A//three-back.work&dtd=374
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://three-back.work/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://three-back.work/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 25 Aug 2021 12:28:53 GMT
server: cafe
content-length: 29246
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 25-Aug-2021 12:43:52 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 25 Aug 2021 12:28:53 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

99f6048e026a358bcd25087b08a35840836764c0c3a97cd18569a0dab3263b7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629718286636491"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27620
x-xss-protection: 0
expires: Wed, 25 Aug 2021 12:28:52 GMT

POST
H3-29 204 AGSKWxX_JJMFOuvXOs2ZoTF3mhjHShzk5ylumQiUwVlFdzWLdcgbuickJYRfy-iRGa0Y8JLK4CONDHJrG6NhgM3vc_eAQexyb2Wx8KmSohTeiIsw3ibSyNKcHhXyZMDKoA5kEKuRauyu1FHZGN52-WUl8zumnxjedqFKCHPfKa0bipKuYRx5inXbCDHdj3va Show response
fundingchoicesmessages.google.com/el/ 0
26 B 20ms
20ms XHR
text/html 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX_JJMFOuvXOs2ZoTF3mhjHShzk5ylumQiUwVlFdzWLdcgbuickJYRfy-iRGa0Y8JLK4CONDHJrG6NhgM3vc_eAQexyb2Wx8KmSohTeiIsw3ibSyNKcHhXyZMDKoA5kEKuRauyu1FHZGN52-WUl8zumnxjedqFKCHPfKa0bipKuYRx5inXbCDHdj3va

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorIabCcpaWebSignalJs.en_US.2n_kXiWh6VM.es5.O/d=1/rs=AJlcJMwMQiBlPCXlJ4_HHCJK1FQ_xO_fFA/m=iabccpawebsignalscript

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-YnIjQianVfxJTei8ClY4ng' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-YnIjQianVfxJTei8ClY4ng' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
access-control-max-age: 86400
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://three-back.work
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: script-src 'report-sample' 'nonce-YnIjQianVfxJTei8ClY4ng' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-YnIjQianVfxJTei8ClY4ng' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3-29 204 AGSKWxX_JJMFOuvXOs2ZoTF3mhjHShzk5ylumQiUwVlFdzWLdcgbuickJYRfy-iRGa0Y8JLK4CONDHJrG6NhgM3vc_eAQexyb2Wx8KmSohTeiIsw3ibSyNKcHhXyZMDKoA5kEKuRauyu1FHZGN52-WUl8zumnxjedqFKCHPfKa0bipKuYRx5inXbCDHdj3va Show response
fundingchoicesmessages.google.com/el/ 0
27 B 19ms
19ms XHR
text/html 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-s6GQvbAtlZYZAdrhfpAwZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-s6GQvbAtlZYZAdrhfpAwZw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
access-control-max-age: 86400
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorLoggingHttp"
x-frame-options: SAMEORIGIN
report-to: {"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
content-type: text/html; charset=utf-8
access-control-allow-origin: https://three-back.work
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: script-src 'report-sample' 'nonce-s6GQvbAtlZYZAdrhfpAwZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-s6GQvbAtlZYZAdrhfpAwZw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 AGSKWxVbyjDIP-rxQF_BrDLKGRDsfnVsGoDAJBeCoMqt4LK8DtMvxwUdwnwdrCE9oczloINXubShV5Ekku7uyG1vA7oNZYxITMFMb8CxxSSfwi6INuAO3_iXitvtr5bQ33o9g90c0vc6vbsgqhj3mM41TIkAkV7vylmnCE_IURaa6HWofDIkZekiZZgqeXLp Show response
fundingchoicesmessages.google.com/f/ 70 KB
25 KB 56ms
55ms Script
application/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVbyjDIP-rxQF_BrDLKGRDsfnVsGoDAJBeCoMqt4LK8DtMvxwUdwnwdrCE9oczloINXubShV5Ekku7uyG1vA7oNZYxITMFMb8CxxSSfwi6INuAO3_iXitvtr5bQ33o9g90c0vc6vbsgqhj3mM41TIkAkV7vylmnCE_IURaa6HWofDIkZekiZZgqeXLp?fccs=W251bGwsW1tdLFtdXSxudWxsLG51bGwsbnVsbCwyLFsxNjI5ODk0NTMyLDkxNzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsMTBdXSwiaHR0cHM6Ly90aHJlZS1iYWNrLndvcmsvIl0

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

43a3c93628ceb446ac885205e52a0fd649de65259362cda4c6da348399df5fa3

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-xIxPWI2MGgidLYNi316DDg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-xIxPWI2MGgidLYNi316DDg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorGlobalRouterHttp"
x-frame-options: SAMEORIGIN
report-to: {"group":"ContributorGlobalRouterHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorGlobalRouterHttp/external"}]}
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-security-policy: script-src 'report-sample' 'nonce-xIxPWI2MGgidLYNi316DDg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-xIxPWI2MGgidLYNi316DDg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 29ms
28ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=three-back.work

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 25 Aug 2021 12:28:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 30ms
25ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=three-back.work

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 25 Aug 2021 12:28:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 1910 108 KB
38 KB 617ms
614ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=3174676765&adf=240109791&pi=t.aa~a.4062378494~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169&nras=2&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=1322&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=yCkwOZdJsl&p=https%3A//three-back.work&dtd=15

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a383fb58f9a920d58931189b0d7d213672f91bd89f1bcd6bf3f4968ece986bee

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7154416178616298156/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7154416178616298156/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJf1qqWWzPICFQ3vdwodY18F3w&gqi=hTcmYfDgBd7b7_UP9JaFsAk&layout=/sadbundle/%24csp%253Der3%24/7154416178616298156/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=3174676765&adf=240109791&pi=t.aa~a.4062378494~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169&nras=2&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=1322&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=yCkwOZdJsl&p=https%3A//three-back.work&dtd=15
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://three-back.work/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://three-back.work/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7154416178616298156/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7154416178616298156/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJf1qqWWzPICFQ3vdwodY18F3w&gqi=hTcmYfDgBd7b7_UP9JaFsAk&layout=/sadbundle/%24csp%253Der3%24/7154416178616298156/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 25 Aug 2021 12:28:53 GMT
server: cafe
content-length: 39017
x-xss-protection: 0
set-cookie: IDE=AHWqTUkMvaFIXKjV21SC0OhnyhyROpESwFY6WtFuu01gaO8ptqmq0_LQYJBV3UnRCWY; expires=Mon, 19-Sep-2022 12:28:53 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 25 Aug 2021 12:28:53 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 52B5 78 KB
29 KB 373ms
369ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a2d5bcefecd12807ee56f09c0429a8d07ca013c39c629911919ef0d357797731

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://three-back.work/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://three-back.work/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 25 Aug 2021 12:28:53 GMT
server: cafe
content-length: 29408
x-xss-protection: 0
set-cookie: IDE=AHWqTUkVf2ai9FHW36wulJFcyTPde3K5dpouXBPiUbx5KAJDG1_7sY1pMbK5FEDyeZs; expires=Mon, 19-Sep-2022 12:28:53 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 25 Aug 2021 12:28:53 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 1FF4 128 KB
40 KB 340ms
336ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=240&adk=2162206099&adf=832817466&pi=t.aa~a.3867071496~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x240&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2047&idt=1&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600%2C300x600&nras=4&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=3741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=L0WjF9hXaz&p=https%3A//three-back.work&dtd=52

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dab8c30c945c53088874d42448b308eef304404d62c89b5534b5eb2a92c1f709

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17232005278383265105/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17232005278383265105/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJnZraWWzPICFQH5dwodNpoLyg&gqi=hTcmYdiyCKeK7_UP95y6IA&layout=/sadbundle/%24csp%253Der3%24/17232005278383265105/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=240&adk=2162206099&adf=832817466&pi=t.aa~a.3867071496~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x240&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2047&idt=1&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600%2C300x600&nras=4&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=3741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=L0WjF9hXaz&p=https%3A//three-back.work&dtd=52
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://three-back.work/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://three-back.work/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17232005278383265105/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17232005278383265105/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJnZraWWzPICFQH5dwodNpoLyg&gqi=hTcmYdiyCKeK7_UP95y6IA&layout=/sadbundle/%24csp%253Der3%24/17232005278383265105/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 25 Aug 2021 12:28:53 GMT
server: cafe
content-length: 40730
x-xss-protection: 0
set-cookie: IDE=AHWqTUknEBREAzw_aNY9hEuN8JKGEMomWXIdz33fLFC53wxXiozeg4iqELKpBFYt0bA; expires=Mon, 19-Sep-2022 12:28:53 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 25 Aug 2021 12:28:53 GMT
cache-control: private

GET
H2 200 5286763676304281139
tpc.googlesyndication.com/simgad/ Frame 10F8 32 KB
32 KB 8ms
8ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5286763676304281139?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qm_1Ws0SPRHJs3ASHqqU-Ya2AaZAA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=169&slotname=8212816143&adk=730500670&adf=3217087521&pi=t.ma~as.8212816143&w=300&lmt=1629894532&rafmt=11&psa=0&format=300x169&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=226&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=4811&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=FgfLg2sH4U&p=https%3A//three-back.work&dtd=374

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c17defd12a8dbf98aeea4043b34398f7ab77beb8291a32265097a1e601189fcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:51:06 GMT
x-content-type-options: nosniff
last-modified: Thu, 09 Aug 2018 16:18:04 GMT
server: sffe
age: 70667
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32770
x-xss-protection: 0
expires: Wed, 24 Aug 2022 16:51:06 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/ Frame 10F8 18 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38cae7aa633433ce04ad15167696536fa0dfc233ea2f68d39cacfb288f5316c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:18:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 635
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7637
x-xss-protection: 0
server: cafe
etag: 2853818853078434854
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 12:18:18 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 10F8 0
0 21ms
21ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CjddlhDcmYe_-NL6KjuwP-6WWmA7kireUZPLUwZ6PCPK1jPG-ARABIMfk-HlglQKgAf-wpKMDyAECqQKaCAdWAwa3PqgDAcgDyQSqBLEBT9DloWmwaDZmp2VN1481GuMK07XDp3J76C-mv2eascc1DKp8Iso3gn76cdEiwmy5Pl6GlpGFehTYtdinGiaNf0PQlgU_g5_SGblc_bIsHIkS2z-AF3WEtW6YydQfYWQCrePH2WCkTidMS9R-5U_91Fp7yBA3DSalbYZfU5jQGu9m5XzyL-_wyR311cdFg8qYpLdkOAAiavvIn4uvlzBzlWgPGuJZiX2MSSadx0OsnqdcwATqpfq13wGSBQQIBBgBkgUECAUYBKAGAoAHvdeELKgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBBCb4wXSCAkIgOGAEBABGB-ACgHICwHYEwzQFQGAFwGyFxwKGggAEhRwdWItMTU4MTcwNTI4MjE3ODU1MhgA&sigh=XlWi_4_YacE

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=169&slotname=8212816143&adk=730500670&adf=3217087521&pi=t.ma~as.8212816143&w=300&lmt=1629894532&rafmt=11&psa=0&format=300x169&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=226&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=4811&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=FgfLg2sH4U&p=https%3A//three-back.work&dtd=374
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 25 Aug 2021 12:28:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 25 Aug 2021 12:28:53 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/ Frame 10F8 2 KB
1 KB 23ms
13ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:24:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 242
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 12:24:51 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 10F8 124 KB
37 KB 78ms
70ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2dc00e6c10812518e5f101fdeef7624851e0431b4931d80e64470b576800f041

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:53 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629718280506303"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38186
x-xss-protection: 0
expires: Wed, 25 Aug 2021 12:28:53 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/ Frame 10F8 14 KB
6 KB 88ms
79ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:22:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 358
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 12:22:55 GMT

GET
H3-29 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/ Frame 10F8 26 KB
11 KB 88ms
79ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e70daf1f8bcfd0ed744b5f86ac162bda58f2d2db0e5b4ba93c3adec87ad09fe3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 08:24:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 14671
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10771
x-xss-protection: 0
server: cafe
etag: 12253238251956766473
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 08:24:22 GMT

GET
H3-29 200 11455320262328853069
tpc.googlesyndication.com/simgad/ Frame 56A3 34 KB
34 KB 26ms
17ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11455320262328853069?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qmb4qTLqbTZymonR337jg4EGedtDQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=4251178241&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=225&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2335&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=uODy3iUpDI&p=https%3A//three-back.work&dtd=371

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d3e33bd3eeb6d3e82825ca5990e311ada69b68575d9c5d5d205719adaf3a1618

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 16:09:20 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jun 2020 16:03:32 GMT
server: sffe
age: 73173
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35280
x-xss-protection: 0
expires: Wed, 24 Aug 2022 16:09:20 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/ Frame 56A3 18 KB
7 KB 22ms
13ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=4251178241&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=225&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2335&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=uODy3iUpDI&p=https%3A//three-back.work&dtd=371

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38cae7aa633433ce04ad15167696536fa0dfc233ea2f68d39cacfb288f5316c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7637
x-xss-protection: 0
server: cafe
etag: 2853818853078434854
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 12:28:14 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 56A3 0
0 20ms
20ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=ChxOChDcmYfnlNLyLjuwP_JGEqA3_56jFZMq_z5b9DL_hHhABIMfk-HlglQKgAZ3NpfsCyAECqQIoBIlxJ7CzPqgDAcgDyQSqBLMBT9BmGWtSusDlOnsXh_AKDntB0UwYTn2c8DX9NeIeuZFjXUltV8QCN6K72kpyAylaB1ItEtFyBypnl-_3EegB0KeofXaiGy_a686RyzgQUMau7gRP7thCLYtvvayIhOgt1TX6VKSEvgGuC4ty9vACeuyuUcZdcFwSMSBJKTQH83mdiUG9uS9ND_n379lX3zieoNj5wPU-r3ZitHmVLaQAr9ejKb409Jsr_MLEoqhbygLJHGrABPCVxbGmA5IFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYCgAfLstqEAagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBBDuigvSCAkIgOGAEBABGB-ACgHICwHYEwzQFQGYFgGAFwGyFxwKGggAEhRwdWItMTU4MTcwNTI4MjE3ODU1MhgA&sigh=NYJDv1EDkqM

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=4251178241&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=225&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2335&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=uODy3iUpDI&p=https%3A//three-back.work&dtd=371

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=4251178241&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=225&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2335&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=uODy3iUpDI&p=https%3A//three-back.work&dtd=371
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 25 Aug 2021 12:28:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 25 Aug 2021 12:28:53 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/ Frame 56A3 2 KB
1 KB 83ms
80ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=4251178241&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=225&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2335&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=uODy3iUpDI&p=https%3A//three-back.work&dtd=371

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:24:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 242
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 12:24:51 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 56A3 124 KB
37 KB 73ms
72ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=4251178241&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=225&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2335&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=uODy3iUpDI&p=https%3A//three-back.work&dtd=371

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2dc00e6c10812518e5f101fdeef7624851e0431b4931d80e64470b576800f041

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:53 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629718280506303"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38186
x-xss-protection: 0
expires: Wed, 25 Aug 2021 12:28:53 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/ Frame 56A3 14 KB
6 KB 80ms
78ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=4251178241&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=225&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2335&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=uODy3iUpDI&p=https%3A//three-back.work&dtd=371

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:22:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 358
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 12:22:55 GMT

GET
H3-29 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/ Frame 56A3 26 KB
11 KB 81ms
80ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=4251178241&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=225&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2335&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=uODy3iUpDI&p=https%3A//three-back.work&dtd=371

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e70daf1f8bcfd0ed744b5f86ac162bda58f2d2db0e5b4ba93c3adec87ad09fe3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 08:24:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 14671
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10771
x-xss-protection: 0
server: cafe
etag: 12253238251956766473
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 08:24:22 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame A309 6 KB
668 B 68ms
66ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300,400,500&lang=de

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=5723592&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=218&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=moewzZI2iC&p=https%3A//three-back.work&dtd=368

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d4876c12b071f74470f52c0404d10730ab271ae769c2c407fe131dae8b33e236

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 25 Aug 2021 11:57:55 GMT
server: ESF
date: Wed, 25 Aug 2021 12:28:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 25 Aug 2021 12:28:53 GMT

GET
H3-29 200 m_js_controller_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/ Frame A309 31 KB
12 KB 62ms
60ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/m_js_controller_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=5723592&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=218&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=moewzZI2iC&p=https%3A//three-back.work&dtd=368

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0c409343627d969cd57e3be028d8847ef4ce5d33623b8fd6b4902dde21a63aa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 11:37:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3100
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12663
x-xss-protection: 0
server: cafe
etag: 2903709895979727877
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 11:37:13 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A309 124 KB
37 KB 74ms
73ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=5723592&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=218&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=moewzZI2iC&p=https%3A//three-back.work&dtd=368

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2dc00e6c10812518e5f101fdeef7624851e0431b4931d80e64470b576800f041

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:53 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629718280506303"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38186
x-xss-protection: 0
expires: Wed, 25 Aug 2021 12:28:53 GMT

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/11042433545565097477/ Frame A309 8 KB
8 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11042433545565097477/downsize_200k_v1?w=400&h=209

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=5723592&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=218&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=moewzZI2iC&p=https%3A//three-back.work&dtd=368

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ca015f8fa77f470c15f9eb0395a59182744585e02f2b7bed1e734309684b250

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 01:04:00 GMT
x-content-type-options: nosniff
age: 127493
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7728
x-xss-protection: 0
last-modified: Thu, 22 Apr 2021 07:36:38 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 Aug 2022 01:04:00 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/ Frame A309 18 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=5723592&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=218&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=moewzZI2iC&p=https%3A//three-back.work&dtd=368

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38cae7aa633433ce04ad15167696536fa0dfc233ea2f68d39cacfb288f5316c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7637
x-xss-protection: 0
server: cafe
etag: 2853818853078434854
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 12:28:14 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/ Frame A309 2 KB
1 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=5723592&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=218&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=moewzZI2iC&p=https%3A//three-back.work&dtd=368

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:27:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 103
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 12:27:10 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/ Frame A309 14 KB
6 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=5723592&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=218&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=moewzZI2iC&p=https%3A//three-back.work&dtd=368

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:22:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 358
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 12:22:55 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4BF2 143 B
163 B 20ms
6ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=169&slotname=8212816143&adk=730500670&adf=3217087521&pi=t.ma~as.8212816143&w=300&lmt=1629894532&rafmt=11&psa=0&format=300x169&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=226&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=4811&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=FgfLg2sH4U&p=https%3A//three-back.work&dtd=374
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnOxTPXhWeTujgTzvM9TWkyJr8ri34F9gXg2WJ8keGjEbWcKhhARO7R6q0X3aE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=169&slotname=8212816143&adk=730500670&adf=3217087521&pi=t.ma~as.8212816143&w=300&lmt=1629894532&rafmt=11&psa=0&format=300x169&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=226&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=4811&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=FgfLg2sH4U&p=https%3A//three-back.work&dtd=374

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 25 Aug 2021 11:42:58 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 2755
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 616C 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=4251178241&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=225&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2335&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=uODy3iUpDI&p=https%3A//three-back.work&dtd=371

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=4251178241&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=225&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2335&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=uODy3iUpDI&p=https%3A//three-back.work&dtd=371
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUknEBREAzw_aNY9hEuN8JKGEMomWXIdz33fLFC53wxXiozeg4iqELKpBFYt0bA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=4251178241&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=225&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2335&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=uODy3iUpDI&p=https%3A//three-back.work&dtd=371

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 25 Aug 2021 11:42:58 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 2755
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 10F8 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cc444721c7c9745d64fe28f90fe2c8012f2e7fac471d1accd2fe5ca166abc68a

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 56A3 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2444aa425d8b7339b4e3dc5a46237459a491d793cfc71a6c13540f1774588ac4

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame A309 16 KB
16 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500&lang=de

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 17:17:27 GMT
x-content-type-options: nosniff
age: 69086
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:39 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 Aug 2022 17:17:27 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame A309 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500&lang=de

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 01:45:21 GMT
x-content-type-options: nosniff
age: 125012
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15732
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:39 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 Aug 2022 01:45:21 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ Frame A309 15 KB
15 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500&lang=de

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 18:26:24 GMT
x-content-type-options: nosniff
age: 151349
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 23 Aug 2022 18:26:24 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame A309 0
0 18ms
17ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CEWXhhDcmYf_xNJLx3wOJjbmADMmTvNhksvaSg_YMwI23ARABIMfk-HlglQKgAe-Q2_kCyAEGqQLfliIoq7azPqgDAcgDywSqBLYBT9CyKoTpc4iD-8RGm7NHhncwkopDXiil5GErXAuzpT3FRmQuY61KmmlBe0newT10ZHBJZ76B_Jd7JFlWRsuQlfVX2_kcdkkpDgX9btsmVgw8swMRSNNaB-DTbBiU6Igk2iR_lvqNLdB7FjW3KASmDxDU_jXE4gTRWn6RtVGC0n17A0PhggEDw0BTgNh3xnSVM4dTHEeJ4mwVVRiCGG2Mhrk7zmwow5TByUrVaNx_YGbPlX9K1UvABOfzlJ-yApIFBAgEGAGSBQQIBRgEoAY3gAf57qSGAagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBBDvnRXSCAkIgOGAEBABGB-ACgHICwHYEwyIFAnQFQGYFgGAFwGyFxwKGggAEhRwdWItMTU4MTcwNTI4MjE3ODU1MhgA&sigh=kRq4mYbbfNQ&template_id=492

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=5723592&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=218&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=moewzZI2iC&p=https%3A//three-back.work&dtd=368

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=5723592&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=218&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=moewzZI2iC&p=https%3A//three-back.work&dtd=368
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 25 Aug 2021 12:28:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17232005278383265105/ Frame 912E 2 KB
1 KB 6ms
6ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17232005278383265105/index.html

Requested by

Host: three-back.work
URL: https://three-back.work/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

499894c6fe72135a0944b9e732f3ebb3734534af89c8953934de2715647ddb5f

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/17232005278383265105/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 1163
date: Tue, 24 Aug 2021 17:59:55 GMT
expires: Wed, 24 Aug 2022 17:59:55 GMT
last-modified: Thu, 15 Apr 2021 13:48:04 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 66538
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 4A13 0
0 36ms
36ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C6EcdhTcmYdmCCYHy3wO2tK7QDPzTisJjw4DTzt0NpqDA4ngQASDH5Ph5YJUCoAH_hK3tA8gBCagDAcgDSKoEsgFP0BFgV48PVAKqJL82cScpSylEk_tzOXEs7d08NONQqTiwVjNqLfBHRkr2t0lY1dcNWWyarF9G6gH0HaI87TbnefhIFuIHN3M36E6EXAe7dewFnOksWBHbSLVh1lDs7vc2Sq-Mztmahy-5R7TGQ8ebPkJh6_eZ5NphJRPbBXqDq9Ek03V3Wxnxt0HkiLNcdBIFjr5RYwtW7g9DT8C9H8DikE4rQ3s40JNW3kD6I8CgkNRqwASsgMfC-AKSBQQIBBgBkgUECAUYBKAGLoAHkvuaHagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAPIHBBCSswfSCAkIgOGAEBABGB-ACgHICwHYEwzQFQGAFwGyFxwKGggAEhRwdWItMTU4MTcwNTI4MjE3ODU1MhgA&sigh=MDIQ1-0Z6Cc&template_id=419

Requested by

Host: three-back.work
URL: https://three-back.work/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=240&adk=2162206099&adf=832817466&pi=t.aa~a.3867071496~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x240&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2047&idt=1&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600%2C300x600&nras=4&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=3741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=L0WjF9hXaz&p=https%3A//three-back.work&dtd=52
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 25 Aug 2021 12:28:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/ Frame 4A13 18 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=240&adk=2162206099&adf=832817466&pi=t.aa~a.3867071496~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x240&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2047&idt=1&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600%2C300x600&nras=4&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=3741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=L0WjF9hXaz&p=https%3A//three-back.work&dtd=52

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38cae7aa633433ce04ad15167696536fa0dfc233ea2f68d39cacfb288f5316c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7637
x-xss-protection: 0
server: cafe
etag: 2853818853078434854
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 12:28:14 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/ Frame 4A13 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=240&adk=2162206099&adf=832817466&pi=t.aa~a.3867071496~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x240&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2047&idt=1&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600%2C300x600&nras=4&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=3741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=L0WjF9hXaz&p=https%3A//three-back.work&dtd=52

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:24:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 242
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 12:24:51 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4A13 124 KB
37 KB 34ms
33ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=240&adk=2162206099&adf=832817466&pi=t.aa~a.3867071496~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x240&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2047&idt=1&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600%2C300x600&nras=4&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=3741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=L0WjF9hXaz&p=https%3A//three-back.work&dtd=52

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2dc00e6c10812518e5f101fdeef7624851e0431b4931d80e64470b576800f041

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:53 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629718280506303"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38186
x-xss-protection: 0
expires: Wed, 25 Aug 2021 12:28:53 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/ Frame 4A13 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=240&adk=2162206099&adf=832817466&pi=t.aa~a.3867071496~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x240&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2047&idt=1&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600%2C300x600&nras=4&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=3741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=L0WjF9hXaz&p=https%3A//three-back.work&dtd=52

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:22:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 358
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 12:22:55 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 61B4 143 B
163 B 8ms
6ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=5723592&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=218&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=moewzZI2iC&p=https%3A//three-back.work&dtd=368

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=5723592&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=218&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=moewzZI2iC&p=https%3A//three-back.work&dtd=368
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkMvaFIXKjV21SC0OhnyhyROpESwFY6WtFuu01gaO8ptqmq0_LQYJBV3UnRCWY; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=5723592&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=218&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=moewzZI2iC&p=https%3A//three-back.work&dtd=368

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 25 Aug 2021 11:42:58 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 2755
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame A309 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a596a2f3efa8cc557c4b15545040f7ed4921d30200649beb4d8ff8690deef2c4

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 9986559321500995068
tpc.googlesyndication.com/simgad/ Frame 52B5 102 KB
102 KB 7ms
7ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9986559321500995068?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qlsRhvzDVU7Ab_AIcgBZAdsoZCOnA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

864d06c6d995c32cad27aaa1abfd10c691414f0666a1783c0ed1fffa5aadbbb2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 09:25:41 GMT
x-content-type-options: nosniff
last-modified: Mon, 12 Jul 2021 08:52:48 GMT
server: sffe
age: 97392
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 104255
x-xss-protection: 0
expires: Wed, 24 Aug 2022 09:25:41 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/ Frame 52B5 18 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38cae7aa633433ce04ad15167696536fa0dfc233ea2f68d39cacfb288f5316c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7637
x-xss-protection: 0
server: cafe
etag: 2853818853078434854
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 12:28:14 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/ Frame 52B5 2 KB
1 KB 11ms
9ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:24:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 242
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 12:24:51 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 52B5 124 KB
37 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2dc00e6c10812518e5f101fdeef7624851e0431b4931d80e64470b576800f041

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:53 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629718280506303"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38186
x-xss-protection: 0
expires: Wed, 25 Aug 2021 12:28:53 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/ Frame 52B5 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:22:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 358
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 12:22:55 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 52B5 0
0 16ms
14ms Image
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRMyLM-Ww7mhoL8W4oH4I7cpC14GMXGUtuuno_9o5sRNbNi3-oPogLB-2TmDVI6Ax2yUvKBfzIThyyTGyI0-o365XXa-A
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H3-29 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/ Frame 52B5 26 KB
11 KB 11ms
9ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e70daf1f8bcfd0ed744b5f86ac162bda58f2d2db0e5b4ba93c3adec87ad09fe3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 08:24:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 14671
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10771
x-xss-protection: 0
server: cafe
etag: 12253238251956766473
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 08:24:22 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 52B5 0
0 19ms
18ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=ClME-hTcmYbybCJWOrASS0qyIDaz62sFkx4L_xY8OmJL4h7MCEAEgx-T4eWCVAqAB0YGZvgPIAQKoAwHIA8kEqgS0AU_QdJjw9dNOW6Q9nb9kxdKpIGrVD0FixpC_JoBZb4E7fq_g9XSQ_HdLu_TTjC2Cdr8OqplgqaQmaKHhkon3UYlZVDLGxiDW1oILO_QecUtfG9NSeLvCCSWWR7bzSGGc5NSn_2YAcayQaCXxFXgukpU7v4kWiNgKtDwh3nB8mqrUlSj0q3TZjnHrhu_YupLilKCRwg_Qe9j9pR8VNbPNUwvnAoLgKBaRvN1k__0QpUFCeoZxZsAE-b6mx8gDkgUECAQYAZIFBAgFGASgBgKAB-W_yM4BqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcEEMD6INIICQiA4YAQEAEYH4AKAcgLAdgTDdAVAYAXAbIXHAoaCAASFHB1Yi0xNTgxNzA1MjgyMTc4NTUyGAA&sigh=5xa9bBlkPG0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 25 Aug 2021 12:28:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame D8B4 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkMvaFIXKjV21SC0OhnyhyROpESwFY6WtFuu01gaO8ptqmq0_LQYJBV3UnRCWY; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 25 Aug 2021 11:42:58 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 2755
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C464 1 KB
787 B 7ms
7ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 25 Aug 2021 11:56:19 GMT
expires: Thu, 26 Aug 2021 11:56:19 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 1954
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4BF2
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

15ms
14ms

Document
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkMvaFIXKjV21SC0OhnyhyROpESwFY6WtFuu01gaO8ptqmq0_LQYJBV3UnRCWY; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 25 Aug 2021 12:28:53 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Wed, 25-Aug-2021 13:28:53 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 25 Aug 2021 12:28:53 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 25 Aug 2021 12:28:53 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame BA60 143 B
163 B 7ms
6ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=240&adk=2162206099&adf=832817466&pi=t.aa~a.3867071496~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x240&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2047&idt=1&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600%2C300x600&nras=4&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=3741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=L0WjF9hXaz&p=https%3A//three-back.work&dtd=52

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=240&adk=2162206099&adf=832817466&pi=t.aa~a.3867071496~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x240&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2047&idt=1&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600%2C300x600&nras=4&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=3741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=L0WjF9hXaz&p=https%3A//three-back.work&dtd=52
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkMvaFIXKjV21SC0OhnyhyROpESwFY6WtFuu01gaO8ptqmq0_LQYJBV3UnRCWY; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=240&adk=2162206099&adf=832817466&pi=t.aa~a.3867071496~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x240&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2047&idt=1&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600%2C300x600&nras=4&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=3741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=L0WjF9hXaz&p=https%3A//three-back.work&dtd=52

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 25 Aug 2021 11:42:58 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 2755
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 4A13 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 32884f3d9d0c3b97d6554d090763de630f3dde1e1f5a059b88a0cc37cce6ac0b

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 10F8 56 KB
21 KB 18ms
8ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

4b5bff9984f72badd18aadc3b57f4c0198e3d8c2b80454c3155a005ddb6185d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 11:50:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2296
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21542
x-xss-protection: 0
server: cafe
etag: 13566247180148098686
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Wed, 25 Aug 2021 12:50:37 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 616C
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

16ms
16ms

Document
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=4251178241&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=225&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2335&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=uODy3iUpDI&p=https%3A//three-back.work&dtd=371

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkMvaFIXKjV21SC0OhnyhyROpESwFY6WtFuu01gaO8ptqmq0_LQYJBV3UnRCWY; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 25 Aug 2021 12:28:54 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Wed, 25-Aug-2021 13:28:54 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 25 Aug 2021 12:28:54 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 25 Aug 2021 12:28:54 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 D3lOyaz33AOyGTIEqdOSEmJb5cnEgELXkEp-WZBOrR0.js Show response
pagead2.googlesyndication.com/bg/ Frame 754A 35 KB
13 KB 12ms
8ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/D3lOyaz33AOyGTIEqdOSEmJb5cnEgELXkEp-WZBOrR0.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f794ec9acf7dc03b2193204a9d39212625be5c9c48042d7904a7e59904ead1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 08:55:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 12818
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13489
x-xss-protection: 0
last-modified: Mon, 16 Aug 2021 15:08:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Aug 2022 08:55:15 GMT

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 56A3 56 KB
21 KB 13ms
9ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=4251178241&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=225&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2335&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=uODy3iUpDI&p=https%3A//three-back.work&dtd=371

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

4b5bff9984f72badd18aadc3b57f4c0198e3d8c2b80454c3155a005ddb6185d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 11:50:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2296
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21542
x-xss-protection: 0
server: cafe
etag: 13566247180148098686
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Wed, 25 Aug 2021 12:50:37 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/ Frame 1910 18 KB
7 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=3174676765&adf=240109791&pi=t.aa~a.4062378494~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169&nras=2&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=1322&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=yCkwOZdJsl&p=https%3A//three-back.work&dtd=15

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38cae7aa633433ce04ad15167696536fa0dfc233ea2f68d39cacfb288f5316c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7637
x-xss-protection: 0
server: cafe
etag: 2853818853078434854
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 12:28:14 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/ Frame 1910 2 KB
1 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=3174676765&adf=240109791&pi=t.aa~a.4062378494~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169&nras=2&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=1322&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=yCkwOZdJsl&p=https%3A//three-back.work&dtd=15

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:24:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 242
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 12:24:51 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1910 124 KB
37 KB 21ms
19ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=3174676765&adf=240109791&pi=t.aa~a.4062378494~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169&nras=2&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=1322&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=yCkwOZdJsl&p=https%3A//three-back.work&dtd=15

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2dc00e6c10812518e5f101fdeef7624851e0431b4931d80e64470b576800f041

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:53 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629718280506303"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38186
x-xss-protection: 0
expires: Wed, 25 Aug 2021 12:28:53 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/ Frame 1910 14 KB
6 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=3174676765&adf=240109791&pi=t.aa~a.4062378494~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169&nras=2&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=1322&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=yCkwOZdJsl&p=https%3A//three-back.work&dtd=15

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:22:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 358
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 12:22:55 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 1910 0
0 19ms
13ms Image
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSYWy-fkLTCjvKcIFfsaQo_qpsRMLWBP_2KEJ_Ilxw48_vBOipkIoVN_u6savxiFx8YBx2hDASG9jQ4ItHlsmaVnuTKiQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=3174676765&adf=240109791&pi=t.aa~a.4062378494~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169&nras=2&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=1322&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=yCkwOZdJsl&p=https%3A//three-back.work&dtd=15
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H3-29 200 D3lOyaz33AOyGTIEqdOSEmJb5cnEgELXkEp-WZBOrR0.js Show response
pagead2.googlesyndication.com/bg/ Frame 58D2 35 KB
13 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/D3lOyaz33AOyGTIEqdOSEmJb5cnEgELXkEp-WZBOrR0.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=4251178241&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=2&bdt=1455&idt=225&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x201&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2335&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=uODy3iUpDI&p=https%3A//three-back.work&dtd=371

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f794ec9acf7dc03b2193204a9d39212625be5c9c48042d7904a7e59904ead1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 08:55:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 12818
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13489
x-xss-protection: 0
last-modified: Mon, 16 Aug 2021 15:08:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Aug 2022 08:55:15 GMT

POST
H3-29 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame 4A13 0
20 B 44ms
30ms Other
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJnZraWWzPICFQH5dwodNpoLyg&gqi=hTcmYdiyCKeK7_UP95y6IA&layout=/sadbundle/%24csp%253Der3%24/17232005278383265105/index.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=240&adk=2162206099&adf=832817466&pi=t.aa~a.3867071496~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x240&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2047&idt=1&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600%2C300x600&nras=4&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=3741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=L0WjF9hXaz&p=https%3A//three-back.work&dtd=52

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 52B5 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 82d11f76e8da395a5dfee85f631c5ab82eecb0e4711c247ccd99bd679bfc8322

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 204 csi
csi.gstatic.com/ 0
54 B 463ms
71ms Ping
image/gif 142.250.200.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=1~ksrh4eay&c=3074654501443797&e=44747621%2C21066430%2C31061691%2C31061693%2C31062297&ctx=1&met.3=779.2d6_1~164.2dt_1~165.2dq_3~164.2dw_1~165.2du_3~164.2dy~165.2dx_2~166.2cy_1a~779.2ea_1~166.2e9_5~779.2el_1~166.2el_4~164.2es~165.2er_2~779.2gc_1~166.2g8_f~326.2j8_1~216.2i9_10~215.2i9_10~843.2i8_11~161.2j9_f~326.2kt~216.2ks_1~215.2ks_1~161.2kt~326.2kz~216.2kz~215.2kz~161.2kz~326.2l1~216.2l1~215.2l1~161.2l1~112.2lb_2~868.2oa~868.2oa~868.2oa~868.2oa~889.2op~889.2ow~889.2p0_1~889.2p3_1~639.2p8~160.2p8~914.2p8~639.2p8~160.2p8~914.2p8~639.2p8~160.2p8~914.2p8~639.2p8~160.2p8~914.2p8~189.2pd~189.2pd~189.2pd~189.2pd~629.2ph_1~298.2q7~298.2q8~298.2qd~298.2qe~155.2pw_l~143.2t9_2~429.2up~132.2up~453.2uu_1~754.2uw~453.2uw_1~754.2ux_1~247.2v1~248.2v1~326.2v2~164.2v1_1~165.2v0_2~453.2v2~754.2v3_1~247.2v4~248.2v4~326.2v5~164.2v4~165.2v4_1~453.2v5~754.2v6_1~247.2v7~248.2v7~326.2v8~164.2v8~165.2v7_1~453.2v8_1~754.2v9~247.2va~453.2vb_1~754.2vc_1~453.2ve_1~453.2vf_1~453.2vf~454.2vg~454.2vg~454.2vg_1~453.2vh~753.2vj~353.2uq_t~161.2vj~161.2vj~161.2vj~868.2vj~868.2vj~868.2vj~889.2vl~889.2wg~889.2wl~298.2wq~298.2wt~298.2wv~639.2ww~160.2ww~914.2ww~639.2ww~160.2ww~914.2ww~639.2ww~160.2ww~914.2ww~132.2wx~143.2xm_2~189.2xo~189.2xo~189.2xo~129.2xp~143.30g_2~143.33f_2~168.33z~168.33z~168.33z~168.33z~168.340~168.340~168.340~168.340~168.340~168.340~168.340~168.340~168.340~168.340~168.340_5~168.340_6~168.345~168.345~168.345~132.345~168.345~168.345~168.345~168.345~168.345~168.345~168.345~168.345~168.345~168.345~168.345~168.345~168.345~168.346~168.346~168.346~168.346~168.346~168.34c~168.34c~168.34c~168.34c~168.34c~168.34c~168.34c~168.34c~168.34c_3~168.34c_3~168.34f~168.34f~168.34f~168.34f~168.34f~168.34f~168.34f~168.34f~168.34f~132.34f~168.34f~168.34f~168.34f~168.34f~168.34f~168.34f~168.34f~168.34f~168.34f~168.34f~168.34f~168.34f~168.34f~168.34f~168.34f~168.34f~168.34f~168.34f~129.34n~143.369_3~132.3bw~132.3bx~143.3bx_3~132.3c6~168.3c7_1~168.3c7_1~168.3c7~168.3c7~168.3c7~168.3c7~168.3c7~168.3c7~168.3c7~168.3c7~168.3c7~168.3c7~168.3c7~168.3c7~168.3c7~168.3c8~168.3c8~168.3c8~168.3c8~168.3c8~132.3c8~168.3c8~168.3c8~168.3c8~168.3c8~168.3c8~168.3c8~168.3c8~168.3c8~168.3c8~168.3c8~168.3c8~168.3c8~168.3c8~168.3c8~168.3c8~168.3c8~168.3c8~168.3c8~132.3c8~132.3cl_1~132.3co~129.3cp~132.3cs~168.3cs~168.3cs~168.3cs~168.3cs~168.3cs~168.3cs~168.3cs~168.3cs~168.3cs~168.3cs~168.3cs~168.3cs~168.3cs~168.3cs~168.3cs~168.3cs~168.3cs~168.3cs~168.3cs~168.3cs~132.3ct~168.3ct~168.3ct~168.3ct~168.3ct~168.3ct~168.3ct~168.3ct~168.3ct~168.3ct~168.3ct~168.3ct~168.3ct~168.3ct~168.3ct~168.3ct~168.3ct~168.3ct~168.3ct~132.3ct~168.3f1~168.3f1~168.3f1_2~168.3f1_2~168.3f3~168.3f3~168.3f3~168.3f3~168.3f3~168.3f3~168.3f3~168.3f3~168.3f3~168.3f3~168.3f3~168.3f3~168.3f3~168.3f3~168.3f3~132.3f3~168.3f4~168.3f4~168.3f4~168.3f4~168.3f4~168.3f4~168.3f4~168.3f4~168.3f4~168.3f4~168.3f4~168.3f4~168.3f4~168.3f4~168.3f4~168.3f4~168.3f4~168.3f4~132.3fc~143.3fg_3~132.3i0~168.3i0~168.3i0~168.3i0~168.3i0~168.3i0~168.3i0~168.3i0~168.3i0~168.3i0~168.3i0~168.3i0~168.3i0~168.3i0~168.3i0~168.3i0~168.3i0~168.3i0~168.3i0~168.3i0~168.3i0~132.3i1~168.3i1~168.3i1~168.3i1~168.3i1~168.3i1~168.3i1~168.3i1~168.3i1~168.3i1~168.3i1~168.3i1~168.3i1~168.3i1~168.3i1~168.3i1~168.3i1~168.3i1~168.3i1~132.3i1~132.3i5~132.3i6~143.3iv_5~132.3li_1~132.3lj~168.3lk~168.3lk~168.3lk~168.3lk~168.3lk~168.3lk~168.3lk~168.3lk~168.3lk~168.3lk~168.3lk~168.3lk~168.3lk~168.3lk~168.3lk~168.3lk~168.3lk~168.3lk~168.3lk~168.3lk~132.3lk~168.3lk~168.3lk~168.3lk~168.3lk~168.3lk~168.3lk~168.3ll~168.3ll~168.3ll~168.3ll~168.3ll~168.3ll~168.3ll&met.7=CBsQCMABkZ68oQ0~CBsQByCFDziZAsABsqz1igk~CBsQByCFDzidAsAB5fLrgAM~CBsQByCFDziZAsAB_uHlxgQ~CBsQByCFDziZAsABjeqmhAY~CBsQByCFDziZAsABoL2m8Qg~CBsQByCGDziaAsABvJui6wc~CBsQByCGDziaAsAB-pDN2Qo~CBsQByCGDziaAsABmuj2gQI~CBsQByCGDziaAsABuuHaqQs~CBsQByCGDziaAsABkfeBqQ4~CBsQByCGDzibAsABjZ_BjQ4~CBsQByCGDzibAsAB8_T1jg8~CBsQByCHDzjEBMABztj-iQY~CBsQByCHDzidBMABrb_X5Qo~CBsQByCHDzieBMABn8jxsgQ~CBsQByCHDzidBMABzdG-0ws~CBsQByCHDzigBMABnL2g7wU~CBsQByCHDzidBMABhbudrgU~CBsQChgBIIgPKIgPMJcPOBBoiw9wkw94gu8FgAH47QWIAfjtBbABAbgBA8ABvICCtgc~CBsQCiCIDzjEBMABl8j4gw0~CBsQCiCIDzjEBMABsMP2sQQ~CAEQChgBIIgPKIgPMIcUOP8EaOATcIUUeNKHA4ABtYYDiAGA2QiwAQG4AQPAAd6Ov5sB~CBsQBiCJDzjuCMABy--Zhgo~CBsQCiCKDzi_BcABjqmliAQ~CBsQBiCKDziqBcAB5ZnNjgI~CBsQBiCKDzi6BcABnIfnTg~CBsQCiCfDzjDBsABwamssQE~CBsQCiCfDzjEBsAByrSRhgI~CBsQCiCfDzjMBsABrsmuiA8~CBsQCiCfDzjMBsABu5ODjQ0~CBsQCiCfDzjMBsAB_Za_oQw~CBsQCiCgDzjNBsABw5SCpAk~CBsQCiCgDzjcCMABu5uWtwk~CBsQCiCgDzjdCMAB-6bOiQM~CBsQAiDhEziWBMABks_axwQ~CBsQAiDkEziTBMABvKG4xAE~CBsQAiD0FTiSAsABucPawQI~CAMQChgBIJAYKJAYMO4YOF9AkBhIkRhQkRhYnxhgkRhokxhwuhh4yusFgAGc6wWIAfHfD7ABAbgBA8ABz6SwvwU~CAwQBRgBIKAYKKAYMKsYOAtopBhwqRh4rySAAe8jiAHbT7ABAbgBA8ABmeb-ugM~CBsQBiCyGDiLAcAB7azzrAI~CBwQChgBINQZKNQZMJkaOEVokRpwmBp4o58BgAGHnwGIAcadA7ABAbgBA8ABpL7gogM~CEAQChgBINMZKNMZMMgaOHXAAeT27JoF~CBsQBiCKDziBDMAB5P-i_wM~CD8QDRgBIPgaKPgaMJsbOCPAAf6KrZYP~CBsQChgBIIwbKIwbMK4bOCJokBtwrht4mQOAAcEBiAHNAbABAbgBA8AB5Krg8AI~CC8QBxgBIJUbKJUbMKcbOBJolxtwpht4pQGAAWSIAWuwAQG4AQPAAe21srAK~CC8QBxgBIJYbKJYbMKYbOBBolxtwpht4pQGAAWSIAWuwAQG4AQPAAZv_iccH~CCoQChgBIKsbKKsbML4bOBPAAab7gJMH~CD8QChgBIIkbKIkbMMobOEHAAbuV0e8H~CD8QDRgBIOAbKOAbMPYbOBbAAe23i68L~CD8QDRgBIOEbKOEbMPYbOBXAAe23i68L~CD8QChgBIOsbKOsbMKocOD_AAcip17kK~CAUQBRgBIJ0bKJ0bMOQcOMgBQJ8bSKAbUKAbWK8bYKAbaKEbcOMceJEpgAH6KIgBmZoBsAEBuAEDwAGQx7LwCA~CC8QBxgBIJAdKJAdMK8dOB9QkB1Ynx1gkB1okR1wrR14eoABZIgBa7ABAbgBA8AB7bWysAo~CC8QBxgBIJAdKJAdMLAdOCBAkR1Ikx1Qkx1YoB1gkx1olR1wrx14eoABZIgBa7ABAbgBA8ABm_-Jxwc~CBsQBiDTFTiZCMAB4JTWqwU~CBsQBiDSFTijCMAB7q6nsw0~CBsQBiDTFTijCMAB7_iA7Qw~CAUQBRgBIKcbKKcbMJ8fOPkDaKgbcI8feJDgAYAB9t8BiAGqkAWwAQG4AQPAAZDHsvAI~CAUQBRgBIKobKKobMIQfONsDaKsbcIEfeNjkAYABvuQBiAGupQWwAQG4AQPAAZDHsvAI~CAUQBRgBIKQbKKQbMKEfOP4DaKUbcKAfeLLxAYABmPEBiAHV8wWwAQG4AQPAAZDHsvAI~CBsQAiDiEzj3DsABnL2g7wU~CAUQBRgBILgdKLgdMJ4gOOYCaMEdcJEgeLu-AoABmr4CiAGZ_QewAQG4AQPAAZDHsvAI~CAUQBRgBILIdKLIdMKogOPgCaLcdcKggePvlAYAB4OUBiAHg7wSwAQG4AQPAAZDHsvAI
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210816/r20110914/rum_fy2019.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.200.67 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: mad07s24-in-f3.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:54 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7154416178616298156/ Frame 5844 3 KB
1 KB 12ms
11ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7154416178616298156/index.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=3174676765&adf=240109791&pi=t.aa~a.4062378494~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169&nras=2&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=1322&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=yCkwOZdJsl&p=https%3A//three-back.work&dtd=15

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

300be0a8e0957b12037199387e887fb840214b6bb80939316c6a02f3535a7b69

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/7154416178616298156/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 1330
date: Tue, 24 Aug 2021 12:23:19 GMT
expires: Wed, 24 Aug 2022 12:23:19 GMT
last-modified: Thu, 15 Apr 2021 13:43:43 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
age: 86735
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 1910 0
0 22ms
21ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CqR8whTcmYdeeBo3e3wPjvpX4DfzTisJjs47Uzt0N_u2-4HYQASDH5Ph5YJUCoAH_hK3tA8gBCagDAcgDSKoEuAFP0IUNuv0jiSuTwCBVa9whnZHJ_uO4EURS2dBuN_YWz2u8AQnW_qP6RLMI2GoEqAL5-13wukDXmw2MFT9JOwr01mVBWXsrPwlMTjArYDXgKpJ_kAu7LNtY89I9FfmKlfh-bcbtQid6TP8_InLmNTmXps-EBwVI1wdFm3eyV4rJbW6q-T4JzNx6RWnDnUCMfyIE_ypMXRRBlniorAqW1-xVmifGRGD3sbVAIykQvQHBVd46j7hTUmSXwAT0gcfC-AKSBQQIBBgBkgUECAUYBKAGLoAHkvuaHagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAPIHBBDC0yPSCAkIgOGAEBABGB-ACgHICwHYEwzQFQGAFwGyFxwKGggAEhRwdWItMTU4MTcwNTI4MjE3ODU1MhgA&sigh=d2YaeGo0GJI&template_id=419

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=3174676765&adf=240109791&pi=t.aa~a.4062378494~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169&nras=2&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=1322&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=yCkwOZdJsl&p=https%3A//three-back.work&dtd=15

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=3174676765&adf=240109791&pi=t.aa~a.4062378494~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169&nras=2&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=1322&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=yCkwOZdJsl&p=https%3A//three-back.work&dtd=15
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 25 Aug 2021 12:28:54 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 912E 9 KB
3 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17232005278383265105/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 19:35:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 60784
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Wed, 25 Aug 2021 19:35:50 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 912E 26 KB
10 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17232005278383265105/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 12:37:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85881
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Wed, 25 Aug 2021 12:37:33 GMT

GET
H2 200 createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 912E 186 KB
48 KB 43ms
22ms Script
text/javascript 2a00:1450:4001:809::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17232005278383265105/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49100
x-xss-protection: 0
last-modified: Wed, 16 Mar 2016 13:51:35 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Aug 2021 12:28:54 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ Frame 912E 84 KB
84 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17232005278383265105/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 20:16:51 GMT
x-content-type-options: nosniff
age: 58323
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 85578
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 Aug 2022 20:16:51 GMT

GET
H3-29 200 index.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17232005278383265105/ Frame 912E 232 KB
52 KB 9ms
8ms Script
application/x-javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17232005278383265105/index.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17232005278383265105/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c500ded683ea548030aea3e0e890cb03b6b41012fa9abf994b81812f844342d4

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 142047
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53381
x-xss-protection: 0
last-modified: Thu, 15 Apr 2021 13:48:04 GMT
server: sffe
date: Mon, 23 Aug 2021 21:01:27 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 23 Aug 2022 21:01:27 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 3F2E 143 B
163 B 7ms
6ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=3174676765&adf=240109791&pi=t.aa~a.4062378494~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169&nras=2&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=1322&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=yCkwOZdJsl&p=https%3A//three-back.work&dtd=15

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=3174676765&adf=240109791&pi=t.aa~a.4062378494~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169&nras=2&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=1322&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=yCkwOZdJsl&p=https%3A//three-back.work&dtd=15
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkMvaFIXKjV21SC0OhnyhyROpESwFY6WtFuu01gaO8ptqmq0_LQYJBV3UnRCWY; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=3174676765&adf=240109791&pi=t.aa~a.4062378494~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169&nras=2&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=1322&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=yCkwOZdJsl&p=https%3A//three-back.work&dtd=15

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 25 Aug 2021 11:42:58 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 2756
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 1910 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 669084b86cebfe73ea2b7ee1382bb075d8de8546ad73fad77acb695a6c5765ce

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

POST
H3-29 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame 1910 0
20 B 29ms
28ms Other
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJf1qqWWzPICFQ3vdwodY18F3w&gqi=hTcmYfDgBd7b7_UP9JaFsAk&layout=/sadbundle/%24csp%253Der3%24/7154416178616298156/index.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=3174676765&adf=240109791&pi=t.aa~a.4062378494~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169&nras=2&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=1322&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=yCkwOZdJsl&p=https%3A//three-back.work&dtd=15

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 10F8 0
348 B 155ms
68ms Ping
image/gif 142.250.200.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~ksrh4fg9&chm=1&ctx=2&gqid=hDcmYee7NLShlQe-u6OIBQ&qqid=CO_QnKWWzPICFT6Fgwcd-5IF4w&met.4=fb.ef~lb.k7~ol.tg~bdt.-1eu~bpp.-ad~idt.-45~dtd.-1~dt.-af&met.3=422.fa~734.nj~735.nl_1~555.np~556.np_1~734.sl~113.11i_3~112.11g_5&met.1=1.ksrh4ees~6.0~7.0~8.0~9.0~10.0~12.1~13.d3~14.d6~15.d8~16.k8~17.k8~18.k8~19.t7~20.t7~21.tg&met.7=CAUQCBgBMNsDOKQIaAFw2AN42OQBgAG-5AGIAa6lBbABAbgBAw~CBcQBhgBIIYEKIYEMJEEOAtohwRwjwR4hoECgAGCgAKIAYKAArABAbgBAw~CAkQChgBIIYEKIYEMI4EOAhohwRwjQR4ljyAAdU7iAGmkgGwAQG4AQM~CCEQBBgBIIsEKIsEMKIEOBZojARwoQR4FbABAbgBAw~CB4QChgBII0EKI0EMOoEOF5AkwRImQRQmQRYpwRgmQRomwRwqAR41gqAAbsKiAHhE7ABAbgBAw~CCoQChgBII0EKI0EMPMEOGY~CBwQChgBII0EKI0EMO0EOGBomwRw6gR42DCAAb0wiAGWcLABAbgBAw~CBwQChgBII0EKI0EMO4EOGFomwRw6gR4rlSAAZNUiAHczgGwAQG4AQM~CCgQBRgBIKkEKKkEMPwEOFNo9QRw-wR4owGAAZEBiAGPAbABAbgBAw~CCgQChgBIN4IKN4IMPEIOBNo6Ahw8Qh4q6oBgAGmqAGIAai_A7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.200.67 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: mad07s24-in-f3.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:54 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 56A3 0
54 B 155ms
69ms Ping
image/gif 142.250.200.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~ksrh4fgd&chm=1&ctx=2&gqid=hDcmYdCmNM7G7_UPyrutiAQ&qqid=CPm3nKWWzPICFbyFgwcd_AgB1Q&met.4=fb.eq~lb.mr~ol.tn~bdt.-1er~bpp.-aa~idt.-43~dtd.-1~dt.-ac&met.3=422.fg~735.nm_1~555.q4~556.q4~113.11o_1~112.11o_1&met.1=1.ksrh4eep~6.1~7.1~8.1~9.1~10.1~12.2~13.dk~14.e1~15.e8~16.ms~17.ms~18.ms~19.tj~20.tj~21.tn~22.f5~23.f5&met.7=CAUQCBgBMPkDOKsIaAJw6AN4kOABgAH23wGIAaqQBbABAbgBAw~CBcQBhgBIJIEKJIEMPkEOGhongRwrwR47ZMCgAHQkwKIAdCTArABAbgBAw~CAkQChgBIJIEKJIEMOwEOFtongRwqwR48DuAAdU7iAGmkgGwAQG4AQM~CCEQBBgBIJcEKJcEMK0EOBdomQRwrQR4FbABAbgBAw~CB4QChgBIJcEKJcEMPEEOFpongRw7gR41gqAAbsKiAHhE7ABAbgBAw~CCoQChgBIJgEKJgEMPkEOGE~CBwQChgBIJgEKJgEMPAEOFhongRw7AR42DCAAb0wiAGWcLABAbgBAw~CBwQChgBIJgEKJgEMPEEOFlongRw7gR4rlSAAZNUiAHczgGwAQG4AQM~CCgQBRgBIP4EKP4EMIYFOAhogAVwhgV4owGAAZEBiAGPAbABAbgBAw~CCgQChgBIOIIKOIIMPUIOBNo6whw9Ah466gBgAGmqAGIAai_A7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.200.67 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: mad07s24-in-f3.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:54 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 61B4
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

16ms
16ms

Document
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=5723592&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=218&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=moewzZI2iC&p=https%3A//three-back.work&dtd=368

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkMvaFIXKjV21SC0OhnyhyROpESwFY6WtFuu01gaO8ptqmq0_LQYJBV3UnRCWY; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 25 Aug 2021 12:28:54 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Wed, 25-Aug-2021 13:28:54 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 25 Aug 2021 12:28:54 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 25 Aug 2021 12:28:54 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame A309 56 KB
21 KB 16ms
13ms Script
text/javascript 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=5723592&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=218&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=moewzZI2iC&p=https%3A//three-back.work&dtd=368

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

4b5bff9984f72badd18aadc3b57f4c0198e3d8c2b80454c3155a005ddb6185d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 11:50:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2297
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21542
x-xss-protection: 0
server: cafe
etag: 13566247180148098686
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Wed, 25 Aug 2021 12:50:37 GMT

GET
H3-29 200 D3lOyaz33AOyGTIEqdOSEmJb5cnEgELXkEp-WZBOrR0.js Show response
pagead2.googlesyndication.com/bg/ Frame 1ED7 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/D3lOyaz33AOyGTIEqdOSEmJb5cnEgELXkEp-WZBOrR0.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=201&slotname=8212816143&adk=3589416497&adf=5723592&pi=t.ma~as.8212816143&w=800&lmt=1629894532&rafmt=11&psa=0&format=800x201&url=https%3A%2F%2Fthree-back.work%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894532477&bpp=3&bdt=1455&idt=218&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&alvm=r20210819&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=moewzZI2iC&p=https%3A//three-back.work&dtd=368

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f794ec9acf7dc03b2193204a9d39212625be5c9c48042d7904a7e59904ead1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 08:55:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 12819
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13489
x-xss-protection: 0
last-modified: Mon, 16 Aug 2021 15:08:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Aug 2022 08:55:15 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame C464 35 B
464 B 40ms
17ms Image
image/gif 2620:116:800d:21:5a23:9c4e:e774:96c1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEEMPU1af6MN_AjFu5MVNHzo&google_cver=1&google_push=AYg5qPJnCsFH4adNykHqSDX1ou4ip_FVlu2T8Nd-lgVTj7IX4N7Or8bD9ywnFGcP_sYsOK3wMAizEETkmLGBsSAv1GQTLjQ0SE8B

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:54 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame C464
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJ5fakF...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJ5fakF...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA4MjUxMjI4NTQwMDAxMDM1OTEzNTc1MA%3D%3D&google_push=AYg5qPJ5fakFzDrTi4BU1ssqe8OYvs1gAFNJ8uWRt8fe6DEM78nu_covfuejQyIjWYPAij...

170 B
188 B

20ms
17ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA4MjUxMjI4NTQwMDAxMDM1OTEzNTc1MA%3D%3D&google_push=AYg5qPJ5fakFzDrTi4BU1ssqe8OYvs1gAFNJ8uWRt8fe6DEM78nu_covfuejQyIjWYPAijeHLHQ14Zjtn8YTi0tYFvc0xzx3rsCe

Requested by

Host: three-back.work
URL: https://three-back.work/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA4MjUxMjI4NTQwMDAxMDM1OTEzNTc1MA%3D%3D&google_push=AYg5qPJ5fakFzDrTi4BU1ssqe8OYvs1gAFNJ8uWRt8fe6DEM78nu_covfuejQyIjWYPAijeHLHQ14Zjtn8YTi0tYFvc0xzx3rsCe
pragma: no-cache
date: Wed, 25 Aug 2021 12:28:54 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Wed, 25 Aug 2021 12:28:54 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame C464
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEAtFo-J7VMM8x5rljmX_pfg&google_cver=1&google_push=AYg5qPIjmsYL0tsMRAUVUhkX_y7JWlhYZCfUzwH5moQCHhnp6pT3A_Im-cuTUFiiIF4lXU_yj4SFRCygAUspgwQdQneFtnGhylxK
https://rtb.openx.net/sync/dds?google_gid=CAESEAtFo-J7VMM8x5rljmX_pfg&google_cver=1&google_push=AYg5qPIjmsYL0tsMRAUVUhkX_y7JWlhYZCfUzwH5moQCHhnp6pT3A_Im-cuTUFiiIF4lXU_yj4SFRCygAUspgwQdQneFtnGhylxK&...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIjmsYL0tsMRAUVUhkX_y7JWlhYZCfUzwH5moQCHhnp6pT3A_Im-cuTUFiiIF4lXU_yj4SFRCygAUspgwQdQneFtnGhylxK&google_hm=nGLo7fmOyGwrynwWeCQVWw==

170 B
188 B

26ms
23ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIjmsYL0tsMRAUVUhkX_y7JWlhYZCfUzwH5moQCHhnp6pT3A_Im-cuTUFiiIF4lXU_yj4SFRCygAUspgwQdQneFtnGhylxK&google_hm=nGLo7fmOyGwrynwWeCQVWw==

Requested by

Host: three-back.work
URL: https://three-back.work/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:54 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIjmsYL0tsMRAUVUhkX_y7JWlhYZCfUzwH5moQCHhnp6pT3A_Im-cuTUFiiIF4lXU_yj4SFRCygAUspgwQdQneFtnGhylxK&google_hm=nGLo7fmOyGwrynwWeCQVWw==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: hsjqq6fgvqgdrr42m4mo59bsu31s281d

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame C464
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YTw17UR7TI2vb3TLEqDAFw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

27ms
24ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YTw17UR7TI2vb3TLEqDAFw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIEKdB2tcdl0AX_xruzMMJVYPZUNemlL6MpFdgUvh8qvxB8VPomQQf4cgcoy-rorgoQU4LvqkLeZ6f2uGp0ye_WuhnoG8EB

Requested by

Host: three-back.work
URL: https://three-back.work/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YTw17UR7TI2vb3TLEqDAFw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIEKdB2tcdl0AX_xruzMMJVYPZUNemlL6MpFdgUvh8qvxB8VPomQQf4cgcoy-rorgoQU4LvqkLeZ6f2uGp0ye_WuhnoG8EB
date: Wed, 25 Aug 2021 12:28:52 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame C464
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEFM4Pl-r7FDdLOwNQUeRlj0&google_cver=1&google_push=AYg5qPI5UUED-1yo90f2n9Td5oBZRXbkQK_liL94zv0snF8TYK8PG-RAjne90dY4X73zBGGnoSl...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NSSDRGT0ctWi0xR0Yx&google_push=AYg5qPI5UUED-1yo90f2n9Td5oBZRXbkQK_liL94zv0snF8TYK8PG-RAjne90dY4X73zBGGnoSl0moM_T2pgrjPhtINQmpImPVMI

170 B
188 B

27ms
23ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NSSDRGT0ctWi0xR0Yx&google_push=AYg5qPI5UUED-1yo90f2n9Td5oBZRXbkQK_liL94zv0snF8TYK8PG-RAjne90dY4X73zBGGnoSl0moM_T2pgrjPhtINQmpImPVMI

Requested by

Host: three-back.work
URL: https://three-back.work/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NSSDRGT0ctWi0xR0Yx&google_push=AYg5qPI5UUED-1yo90f2n9Td5oBZRXbkQK_liL94zv0snF8TYK8PG-RAjne90dY4X73zBGGnoSl0moM_T2pgrjPhtINQmpImPVMI
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame C464
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFw...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFw...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFw...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFw...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFw...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFw...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFw...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFw...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFw...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFw...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFw...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFw...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFw...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFw...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFw...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFw...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFw...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFw...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFw...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame C464 43 B
297 B 78ms
21ms Image
image/gif 2a05:d01c:1d8:8101:8678:af0d:fda8:5a84
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEJnqWEF3dlDLAYz8IBK0uTw&google_cver=1&google_push=AYg5qPJl45C7w_j-5DNS83zWwdJkf0_QxfSBpalKm-8t_JzQFlJtDBkDeUyrlqIsWbtTjy3FQNJm2qHuQtLcFg1fdzi3QdIxjCm6
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8101:8678:af0d:fda8:5a84 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:54 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame C464 0
253 B 44ms
15ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LCbnjs3vUoNOEkb_LjkjgdwIXNe0tG66cYEoV9xumNS3xMwHn9SJqU6aAqe81YZIuVJ_Ml

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:54 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 5844 9 KB
3 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7154416178616298156/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 19:35:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 60784
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Wed, 25 Aug 2021 19:35:50 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 5844 26 KB
10 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7154416178616298156/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 12:37:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85881
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Wed, 25 Aug 2021 12:37:33 GMT

GET
H3-29 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 5844 236 KB
63 KB 30ms
14ms Script
text/javascript 2a00:1450:4001:809::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7154416178616298156/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Aug 2021 12:28:54 GMT

GET
H3-29 200 index.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7154416178616298156/ Frame 5844 411 KB
66 KB 10ms
9ms Script
application/x-javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7154416178616298156/index.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7154416178616298156/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3ca3761ae139d73106834c7343990aa5606067f5f24b8d6f370b80db22b32803

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 83619
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67471
x-xss-protection: 0
last-modified: Thu, 15 Apr 2021 13:43:43 GMT
server: sffe
date: Tue, 24 Aug 2021 13:15:15 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 Aug 2022 13:15:15 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame D8B4
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

27ms
27ms

Document
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkMvaFIXKjV21SC0OhnyhyROpESwFY6WtFuu01gaO8ptqmq0_LQYJBV3UnRCWY; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 25 Aug 2021 12:28:54 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Wed, 25-Aug-2021 13:28:54 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 25 Aug 2021 12:28:54 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 25 Aug 2021 12:28:54 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 52B5 56 KB
21 KB 14ms
8ms Script
text/javascript 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

4b5bff9984f72badd18aadc3b57f4c0198e3d8c2b80454c3155a005ddb6185d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 11:50:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2297
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21542
x-xss-protection: 0
server: cafe
etag: 13566247180148098686
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Wed, 25 Aug 2021 12:50:37 GMT

GET
H3-29 200 D3lOyaz33AOyGTIEqdOSEmJb5cnEgELXkEp-WZBOrR0.js Show response
pagead2.googlesyndication.com/bg/ Frame ACD5 35 KB
13 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/D3lOyaz33AOyGTIEqdOSEmJb5cnEgELXkEp-WZBOrR0.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=1857935866&adf=3859188948&pi=t.aa~a.4090112390~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600&nras=3&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=2281&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=pdpl8MaHVB&p=https%3A//three-back.work&dtd=46

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f794ec9acf7dc03b2193204a9d39212625be5c9c48042d7904a7e59904ead1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 08:55:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 12819
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13489
x-xss-protection: 0
last-modified: Mon, 16 Aug 2021 15:08:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Aug 2022 08:55:15 GMT

GET
H2 200 1f308.svg
s.w.org/images/core/emoji/13.1.0/svg/ 733 B
568 B 26ms
6ms Image
image/svg+xml 192.0.77.48
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/13.1.0/svg/1f308.svg

Requested by

Host: three-back.work
URL: https://three-back.work/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

555858f907bda45e059201a8a3d8910876ef8d830b9b82cfc0ca9aa55c7b029a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Wed, 25 Aug 2021 12:28:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 07 Jun 2021 18:51:02 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1f4c8.svg
s.w.org/images/core/emoji/13.1.0/svg/ 993 B
549 B 26ms
7ms Image
image/svg+xml 192.0.77.48
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/13.1.0/svg/1f4c8.svg

Requested by

Host: three-back.work
URL: https://three-back.work/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

a8825c811f91f376b19ffcc0ddf9aab79c0009ce4cc4a680fe6e81c8eaf469a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Wed, 25 Aug 2021 12:28:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 07 Jun 2021 18:51:02 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1f530.svg
s.w.org/images/core/emoji/13.1.0/svg/ 461 B
523 B 38ms
20ms Image
image/svg+xml 192.0.77.48
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/13.1.0/svg/1f530.svg

Requested by

Host: three-back.work
URL: https://three-back.work/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

b9658459005738134ebf34fcb1882a79e05339193f0f2df065850966069f9c5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Wed, 25 Aug 2021 12:28:54 GMT
x-content-type-options: nosniff
last-modified: Mon, 07 Jun 2021 18:53:02 GMT
server: nginx
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 461
expires: Thu, 31 Dec 2037 23:55:55 GMT

POST
H2 204 matomo.php
three-back.work/miulabo/ 0
61 B 333ms
330ms Ping
text/html 150.95.54.210
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL: https://three-back.work/miulabo/matomo.php?action_name=FX%E8%87%AA%E5%8B%95%E5%A3%B2%E8%B2%B7blog%EF%BD%9C%E3%81%BF%E3%81%86%E3%83%A9%E3%83%9C&idsite=1&rec=1&r=275396&h=14&m=28&s=54&url=https%3A%2F%2Fthree-back.work%2F&_id=68d8d73025c2a455&_idn=1&_refts=0&send_image=0&cookie=1&res=1600x1200&pv_id=Xq0ELr&pf_net=0&pf_srv=573&pf_tfr=260&pf_dm1=3405
Requested by: Host: three-back.work
URL: https://three-back.work/miulabo/matomo.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.95.54.210 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS: jp37a.mixhost.jp
Software: LiteSpeed /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-fetch-mode: no-cors
origin: https://three-back.work
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: empty
cookie: _pk_id.1.ec7d=68d8d73025c2a455.1629894534.; _pk_ses.1.ec7d=1
content-length: 0
:path: /miulabo/matomo.php?action_name=FX%E8%87%AA%E5%8B%95%E5%A3%B2%E8%B2%B7blog%EF%BD%9C%E3%81%BF%E3%81%86%E3%83%A9%E3%83%9C&idsite=1&rec=1&r=275396&h=14&m=28&s=54&url=https%3A%2F%2Fthree-back.work%2F&_id=68d8d73025c2a455&_idn=1&_refts=0&send_image=0&cookie=1&res=1600x1200&pv_id=Xq0ELr&pf_net=0&pf_srv=573&pf_tfr=260&pf_dm1=3405
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
content-type: application/x-www-form-urlencoded; charset=utf-8
accept: */*
cache-control: no-cache
:authority: three-back.work
referer: https://three-back.work/
:scheme: https
sec-fetch-site: same-origin
:method: POST
Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

access-control-allow-origin: https://three-back.work
date: Wed, 25 Aug 2021 12:28:54 GMT
access-control-allow-credentials: true
server: LiteSpeed
content-type: text/html; charset=UTF-8

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame BA60
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

15ms
15ms

Document
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=240&adk=2162206099&adf=832817466&pi=t.aa~a.3867071496~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x240&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2047&idt=1&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600%2C300x600&nras=4&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=3741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=L0WjF9hXaz&p=https%3A//three-back.work&dtd=52

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkMvaFIXKjV21SC0OhnyhyROpESwFY6WtFuu01gaO8ptqmq0_LQYJBV3UnRCWY; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 25 Aug 2021 12:28:54 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Wed, 25-Aug-2021 13:28:54 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 25 Aug 2021 12:28:54 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 25 Aug 2021 12:28:54 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 4A13 56 KB
21 KB 21ms
20ms Script
text/javascript 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=240&adk=2162206099&adf=832817466&pi=t.aa~a.3867071496~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x240&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2047&idt=1&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169%2C300x600%2C300x600&nras=4&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=3741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=L0WjF9hXaz&p=https%3A//three-back.work&dtd=52

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

4b5bff9984f72badd18aadc3b57f4c0198e3d8c2b80454c3155a005ddb6185d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 11:50:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2297
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21542
x-xss-protection: 0
server: cafe
etag: 13566247180148098686
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Wed, 25 Aug 2021 12:50:37 GMT

GET
H3-29 200 rum.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/ Frame 912E 55 KB
21 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/rum.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f8946ea8ae77038a759d93c20ecf4b9b2a773089fa1795c1f9c0974219bea558

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 09:54:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9248
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21410
x-xss-protection: 0
server: cafe
etag: 16462725772792206040
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 09:54:46 GMT

GET
H3-29 200 D3lOyaz33AOyGTIEqdOSEmJb5cnEgELXkEp-WZBOrR0.js Show response
pagead2.googlesyndication.com/bg/ Frame 912E 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/D3lOyaz33AOyGTIEqdOSEmJb5cnEgELXkEp-WZBOrR0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f794ec9acf7dc03b2193204a9d39212625be5c9c48042d7904a7e59904ead1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 08:55:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 12819
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13489
x-xss-protection: 0
last-modified: Mon, 16 Aug 2021 15:08:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Aug 2022 08:55:15 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame A309 0
54 B 369ms
68ms Ping
image/gif 142.250.200.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~ksrh4frm&chm=1&ctx=2&gqid=hDcmYcOmNOa17_UP2Muw8A0&qqid=CP_DnKWWzPICFZL4dwodiUYOwA&met.4=fb.f9~lb.s1~ol.14u~bdt.-1eo~bpp.-a6~idt.-47~dtd.-1~dt.-a9&met.3=422.qj~749.si~735.t8_1~113.1d1_2~112.1d0_2&met.1=1.ksrh4eem~6.0~7.0~8.0~9.0~10.0~12.1~13.e4~14.e6~15.ed~16.s2~17.s2~18.sl~19.14r~20.14r~21.14u&met.7=CAUQCBgBMP4DOL4LaAFw_AN4svEBgAGY8QGIAdXzBbABAbgBAw~CBIQBxgBIKUEKKUEMPIEOE1oqARw6gR4nAWAAYEFiAH-LqoBFAoSUm9ib3RvOjMwMCw0MDAsNTAwsAEBuAED~CAoQChgBIKUEKKUEMO8EOEpoqQRw5QR4kmOAAfdiiAGH-AGwAQG4AQM~CCoQChgBIKUEKKUEMPsEOFY~CBcQBhgBIKUEKKUEMMgGOKMCaMEGcMgGeME9gAGwPIgBsDywAQG4AQM~CAkQChgBIKYEKKYEMOMFOL0BaNwFcOIFePA7gAHVO4gBppIBsAEBuAED~CB4QChgBIKYEKKYEMMcGOKECaMEGcMcGeJILgAG7CogB4ROwAQG4AQM~CBwQChgBIKYEKKYEMMcGOKECaMEGcMYGeP4wgAG9MIgBlnCwAQG4AQM~CBMQAhgBII0HKI0HMJQHOAdojgdwkwd4_nyAAbB8iAGwfKoBDAoGcm9ib3RvEBsYArABAbgBAw~CBMQAhgBII0HKI0HMJUHOAhojgdwlAd43HuAAfR6iAH0eqoBDAoGcm9ib3RvEBsYArABAbgBAw~CBMQAhgBII0HKI0HMJUHOAhojgdwlQd4l3uAAch6iAHIeqoBDAoGcm9ib3RvEBsYArABAbgBAw~CCEQBBgBILIHKLIHMMUHOBNoswdwxAd4EbABAbgBAw~CCgQBRgBIO8HKO8HMP0HOA1o9gdw_Ad4owGAAZEBiAGPAbABAbgBAw~CCgQChgBIPYLKPYLMI4MOBhQ9wtYhgxg9wto-Qtwhwx4wqgBgAGmqAGIAai_A7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.200.67 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: mad07s24-in-f3.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:55 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 index_atlas_.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7154416178616298156/ Frame 5844 10 KB
10 KB 7ms
7ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7154416178616298156/index_atlas_.png?1577627635088

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=3174676765&adf=240109791&pi=t.aa~a.4062378494~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169&nras=2&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=1322&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=yCkwOZdJsl&p=https%3A//three-back.work&dtd=15

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a74e1572efaa465ebabbf5c9a62e261596fbba00041e61254c1b10aa26d1d74

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 75082
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10565
x-xss-protection: 0
last-modified: Thu, 15 Apr 2021 13:43:43 GMT
server: sffe
date: Tue, 24 Aug 2021 15:37:32 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 Aug 2022 15:37:32 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 3F2E
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

15ms
15ms

Document
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=3174676765&adf=240109791&pi=t.aa~a.4062378494~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169&nras=2&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=1322&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=yCkwOZdJsl&p=https%3A//three-back.work&dtd=15

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkMvaFIXKjV21SC0OhnyhyROpESwFY6WtFuu01gaO8ptqmq0_LQYJBV3UnRCWY; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 25 Aug 2021 12:28:54 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Wed, 25-Aug-2021 13:28:54 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 25 Aug 2021 12:28:54 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 25 Aug 2021 12:28:54 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 1910 56 KB
21 KB 6ms
6ms Script
text/javascript 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1581705282178552&output=html&h=600&adk=3174676765&adf=240109791&pi=t.aa~a.4062378494~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1629894533&rafmt=1&to=qs&pwprc=1466749975&psa=0&format=300x600&url=https%3A%2F%2Fthree-back.work%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629894533069&bpp=1&bdt=2046&idt=-M&shv=r20210816&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9ce33a21236479a2-223f2ff8b4c9000a%3AT%3D1629894532%3ART%3D1629894532%3AS%3DALNI_Ma7au0UAke4_6L5me2Y-cRg2Dkukw&prev_fmts=0x0%2C800x201%2C800x201%2C300x169&nras=2&correlator=2488773060453&rume=1&frm=20&pv=1&ga_vid=1462415444.1629894533&ga_sid=1629894533&ga_hid=357994913&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1080&ady=1322&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C21066430%2C31061691%2C31061693%2C31062297&oid=3&pvsid=3074654501443797&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=r20210819&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=yCkwOZdJsl&p=https%3A//three-back.work&dtd=15

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

4b5bff9984f72badd18aadc3b57f4c0198e3d8c2b80454c3155a005ddb6185d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 11:50:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2297
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21542
x-xss-protection: 0
server: cafe
etag: 13566247180148098686
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Wed, 25 Aug 2021 12:50:37 GMT

POST
H3-29 204 csi
csi.gstatic.com/ Frame 52B5 0
17 B 550ms
334ms Ping
image/gif 2404:6800:4001:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~ksrh4fwd&chm=1&ctx=2&gqid=hTcmYZXcB6mxlQfW8o_gDA&qqid=CPzxrKWWzPICFRUHiwodEikL0Q&met.4=fb.l4~lb.ou~cmrload.109~ol.10c~bdt.-1m5~bpp.-1a~dtd.-1~dt.-1b&met.3=555.q2~556.q2~735.q9_1~113.1a9_1~112.1a9_1&met.1=1.ksrh4em4~6.1~7.1~8.1~9.1~10.1~12.5~13.ae~14.ag~15.cz~16.ov~17.ov~18.ov~19.109~20.109~21.10d&met.7=CAUQCBgBMPgCOJwKaAVw9gJ4--UBgAHg5QGIAeDvBLABAbgBAw~CBcQBhgBIPcFKPcFMIsGOBRo-AVw_wV45q4GgAG_rgaIAb-uBrABAbgBAw~CAkQChgBIPgFKPgFMP8FOAdo-AVw_gV48DuAAdU7iAGmkgGwAQG4AQM~CB4QChgBIPgFKPgFMIYGOA9o_AVwhgZ41gqAAbsKiAHhE7ABAbgBAw~CCoQChgBIPgFKPgFMIwGOBU~CBwQChgBIPgFKPgFMIIGOAto_AVwggZ42DCAAb0wiAGWcLABAbgBAw~CBsQBhgBIPgFKPgFMIsGOBM~CBwQChgBIPgFKPgFMIYGOA5o_AVwhgZ4rlSAAZNUiAHczgGwAQG4AQM~CCEQBBgBIPsFKPsFMI4GOBNo_AVwjgZ4EbABAbgBAw~CCgQBRgBIKQGKKQGMKsGOAhopQZwqwZ4owGAAZEBiAGPAbABAbgBAw~CBwQBRgBIKQGKKQGMK0GOAlopgZwrQZ4kwaAAdQFiAGWCbABAbgBAw~CCgQChgBIL8KKL8KMNAKOBFoyApw0Ap4wqgBgAGmqAGIAai_A7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4001:80c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:55 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-29 204 csi
csi.gstatic.com/ Frame 912E 0
17 B 357ms
343ms Ping
image/gif 2404:6800:4001:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~ksrh4fwo&ctx=3&gqid=hTcmYdiyCKeK7_UP95y6IA&qqid=CJnZraWWzPICFQH5dwodNpoLyg&met.7=CB8QCBgBKAowEjjZBGgLcBF4pwmAAYsJiAHWE7ABAbgBAw~CBwQChgBIO8BKO8BMPkBOAto8QFw-AF45RmAAccZiAGPRLABAbgBAw~CBwQChgBIO8BKO8BMPcBOAho8QFw9gF4qlGAAY5RiAGZ0AGwAQG4AQM~CCkQChgBIO8BKO8BMKcCODdA8QFI8gFQ8gFYhgJg9wFohgJwmwJ4-oIDgAHM_wKIAabRC7ABAbgBAw~CBsQChgBIO8BKO8BMP0BOA5o8QFw-AF4uJ0FgAHKnAWIAcqcBbABAbgBAw~CB8QChgBIO8BKO8BMP0BOA1o8QFw-gF4q6EDgAGFoQOIAey8DrABAbgBAw~CBgQChgBILEFKLEFMMIFOBFouwVwwQV4x6cBgAGipwGIAYu4A7ABAbgBAw~CCcQChgBIKEGKKEGMMQGOCM
Requested by: Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/rum.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4001:80c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:55 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-29 204 csi
csi.gstatic.com/ Frame 4A13 0
17 B 357ms
342ms Ping
image/gif 2404:6800:4001:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~ksrh4fwq&chm=1&ctx=2&gqid=hTcmYdiyCKeK7_UP95y6IA&qqid=CJnZraWWzPICFQH5dwodNpoLyg&met.4=fb.j~lb.51~cmrload.5g~ol.ih~bdt.-24u~bpp.-jy~idt.-jy~dtd.-ij~dt.-jz&met.3=735.6i_1~113.rz_1~112.rz_1&met.1=1.ksrh4f4s~14.0~15.0~16.0~17.0~18.0~19.0~20.0~21.0&met.7=CB8QBRgBIB0oHTAvOBJoKXAueKcJgAGLCYgB1hOwAQG4AQM~CCEQBBgBIB8oHzBDOCVoH3BDeBGwAQG4AQM~CAkQChgBICAoIDAmOAdoIHAmePA7gAHVO4gBppIBsAEBuAED~CB4QChgBICAoIDAoOAhoIXAneNYKgAG7CogB4ROwAQG4AQM~CCoQChgBICAoIDBIOCg~CBwQChgBICAoIDAoOAhoIXAneNgwgAG9MIgBlnCwAQG4AQM~CCgQBRgBIIwBKIwBMJUBOAlojwFwlQF4owGAAZEBiAGPAbABAbgBAw~CBwQBRgBII0BKI0BMMMBODY~CBwYASDCASjCATDyATgvUMYBWNMBYMYBaNMBcPEBeBSwAQG4AQM~CCgQChgBIMAFKMAFMNcFOBdowQVw1gV4wqgBgAGmqAGIAai_A7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4001:80c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:55 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 rum.js Show response
tpc.googlesyndication.com/pagead/js/r20210819/r20110914/ Frame 5844 55 KB
21 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/rum.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f8946ea8ae77038a759d93c20ecf4b9b2a773089fa1795c1f9c0974219bea558

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 09:54:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9248
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21410
x-xss-protection: 0
server: cafe
etag: 16462725772792206040
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Sep 2021 09:54:46 GMT

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 21ms
20ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210816&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

76e613b06da4d65f52509320e44b1a400c2b5a8934691d08349802079f8d5511

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 25 Aug 2021 12:28:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8630
x-xss-protection: 0

GET
H3-29 200 D3lOyaz33AOyGTIEqdOSEmJb5cnEgELXkEp-WZBOrR0.js Show response
pagead2.googlesyndication.com/bg/ Frame 5844 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/D3lOyaz33AOyGTIEqdOSEmJb5cnEgELXkEp-WZBOrR0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f794ec9acf7dc03b2193204a9d39212625be5c9c48042d7904a7e59904ead1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 08:55:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 12820
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13489
x-xss-protection: 0
last-modified: Mon, 16 Aug 2021 15:08:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Aug 2022 08:55:15 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1910 0
0 29ms
29ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=reportingobserver&qqid=CJf1qqWWzPICFQ3vdwodY18F3w&c=0&t=csp-violation&ln=1&cn=0&src=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-29 204 csi
csi.gstatic.com/ Frame 1910 0
17 B 327ms
327ms Ping
image/gif 2404:6800:4001:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~ksrh4g3d&chm=1&ctx=2&gqid=hTcmYfDgBd7b7_UP9JaFsAk&qqid=CJf1qqWWzPICFQ3vdwodY18F3w&met.4=fb.oo~lb.sa~cmrload.xr~ol.184~bdt.-1l9~bpp.-e~dtd.0~dt.-f&met.3=735.ya_1~734.yh~734.12b~113.1i4_1~112.1i4_1&met.1=1.ksrh4el8~6.1~7.1~8.1~9.1~10.1~12.5~13.h7~14.h9~15.m6~16.sb~17.sb~18.sb~19.185~20.185~21.185&met.7=CAUQCBgBMO0EOLQMaARw6wR4irECgAHpsAKIAfTfBrABAbgBAw~CAkQChgBIPwGKPwGMIcHOAtogAdwhgd48DuAAdU7iAGmkgGwAQG4AQM~CB4QChgBIPwGKPwGMIoHOA5ogAdwhwd41gqAAbsKiAHhE7ABAbgBAw~CCoQChgBIPwGKPwGMJcHOBs~CBwQChgBIP0GKP0GMIcHOAtogAdwhgd42DCAAb0wiAGWcLABAbgBAw~CBsQBhgBIP0GKP0GMJcHOBs~CB8QBRgBILAHKLAHML8HOA9oswdwvgd4zgqAAbIKiAHaF7ABAbgBAw~CCEQBBgBILIHKLIHMMgHOBdoswdwyAd4EbABAbgBAw~CCgQBRgBINwHKNwHMOUHOAho3gdw5Ad4owGAAZEBiAGPAbABAbgBAw~CBwQBRgBIN4HKN4HML8JOOEB~CBwYASC-CSi-CTDdCTgfaMAJcN0JeBSwAQG4AQM~CCgQChgBIKgNKKgNMLANOAdoqQ1wrw14wqgBgAGmqAGIAai_A7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4001:80c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:55 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-29 204 csi
csi.gstatic.com/ Frame 5844 0
17 B 327ms
326ms Ping
image/gif 2404:6800:4001:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~ksrh4g3g&ctx=3&gqid=hTcmYfDgBd7b7_UP9JaFsAk&qqid=CJf1qqWWzPICFQ3vdwodY18F3w&met.7=CB8QCBgBKAEwDziEBWgDcA54zgqAAbIKiAHaF7ABAbgBAw~CBwQChgBIKcDKKcDMLIDOAtoqQNwrwN45RmAAccZiAGPRLABAbgBAw~CBwQChgBIKcDKKcDMLIDOAxoqQNwsAN4qlGAAY5RiAGZ0AGwAQG4AQM~CCkQChgBIKcDKKcDMNMDOCxQqQNYuANgqQNouANwxwN4tPYDgAGT9gOIAYrjDrABAbgBAw~CB8QChgBIKcDKKcDMLkDOBJoqgNwswN4uY8EgAGPjwSIAf_UGbABAbgBAw~CB8QBhgBIIQFKIQFMJMFOBBojAVwkwV44lKAAcVSiAHFUrABAbgBAw~CBgQChgBIMUHKMUHMMwHOAdoxQdwywd4x6cBgAGipwGIAYu4A7ABAbgBAw~CCcQChgBIOUHKOUHMO0HOAc
Requested by: Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/js/r20210819/r20110914/rum.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4001:80c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:55 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 12:28:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Wed, 25 Aug 2021 12:28:55 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame BADE 12 KB
5 KB 7ms
7ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://three-back.work/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://three-back.work/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Wed, 25 Aug 2021 12:24:02 GMT
expires: Thu, 25 Aug 2022 12:24:02 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 293
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame CF81 783 B
532 B 18ms
18ms Document
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

966d07809a389eff27b3b3f6f963b4b2747dc316de56dab96e6eb38bf9bd0232

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Qzzjuy2oqP7xmFH6tvTNgQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://three-back.work/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://three-back.work/

Response headers

expires: Wed, 25 Aug 2021 12:28:55 GMT
date: Wed, 25 Aug 2021 12:28:55 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-Qzzjuy2oqP7xmFH6tvTNgQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 1uDPM70x-solQtk3bMKouXIpBOJMxNO_wSEEjkbCROo.js Show response
pagead2.googlesyndication.com/bg/ Frame BADE 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1uDPM70x-solQtk3bMKouXIpBOJMxNO_wSEEjkbCROo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d6e0cf33bd31faca2542d9376cc2a8b9722904e24cc4d3bfc121048e46c244ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 07:03:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19555
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13303
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Aug 2022 07:03:00 GMT

GET
H3-29 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 65ms
63ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&t=2&li=gda_r20210816&jk=3074654501443797&bg=!MzClMHTNAAZvV8FTb1c7ACkAdvg8WhSVqfgw8J18REx7wRyTkBVS9sTI_FthkxerrdCn3IjnVWbsfQIAAABCUgAAAApoAQcKAGJcMzgeceKrdRLKpzD4RiouUXMgT3MZ9ygxb7gUKyy-E3h5NYzdVcDgnxxKwvhgARIh0KdxVkgEIHL6szGd2YNG8vsyUbllGA4YISjqs7utmrEQHXPu7Dm5cQffUzbfezxZd5kCdAMYbGPTY3itD4Lb8byNEPLRns1eOeTOle3WSR9ydik6PkOlA20S9fKO4NR11SjFkJXGmZSlgcpjFSMChNdofXrrjEKrwTH4PV_7VKHOffK-aOMFZQVxnC7h49cTP_EMHNV_N6N_LZxLO4y2bJ8NOKzRm63BQ-Wi4SiL-GZ-PLgoAON7OE6jnsJwciuxiDbn-nqeDYH7zDaS4EX400v-zpKjdYjYkMVkxrmmQqf7qGzW3imEyM__QtgocA_BrChWMgSeC2Pq6bKVddz52_2CBDpCEasNeJQW_QzsCIhnAr0L-ePrYqY6NdtoKOvQpKmSZtDvr5rLGup_6EiCBP1-n6f9XRx6WIiJPdsnOUALRhyX6KCPsspdCuV4tmKVqq8TpAensByWp860pzv-2SP4ZtOG1O2FU2Y-eB22PqN71RQXVc7zmJNVXGJdPji7DSSyArygNi0cLAKGrCFke7Vu6Mrd5VQ0xCfv4SOVDRPOnRV_1yzaS5e6E2KUbsspAJ37mFtWQY6cYvcRaeu-UqEiNr6TvPPv-z18oQh31Jwj_KEcOs8LQhDrTM5T3kaNMJvxwHCGhBpKNocDhonESk83Ra4qSkU5Qi75zD1eXn_qrFdhvhOilC5YzDwo-R15mcTDdsLnhDRTX50Zq5enNo3hRXRDStq1j6o9UMbbHXdLVVLegcVw-SMOPBzJcg6oPGABLyhauRvOcJNbT_6rlOaZC8y8cLvGQb50mXxaE3V_ZcjAGxmnbbcMwiMj7eYRtpl9q7RofLxZun8dcvBCnGf7FyNOhSFNvT7UouwBQL5uxBQH_Ug_0qH8N36GZQmjN_1L7dXpYns
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

POST
H3-29 204 csi
csi.gstatic.com/ 0
17 B 328ms
327ms Ping
image/gif 2404:6800:4001:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=2~ksrh4fb8&c=3074654501443797&e=44747621%2C21066430%2C31061691%2C31061693%2C31062297&ctx=1&met.3=168.3lm~168.3lm~168.3lm~168.3lm~168.3lm~132.3lm~129.3lm~132.3m8_1~132.3m9~132.3m9~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~132.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mi~168.3mj~168.3mj~168.3mj~168.3mj~168.3mj~168.3mj~168.3mj~168.3mj~168.3mj~132.3mj~143.3mo_3~132.3tn_1~132.3to~132.3to~168.3to~168.3to~168.3to~168.3to~168.3to~168.3to~168.3to~168.3to~168.3to~168.3to~168.3to~168.3to~168.3to~168.3to~168.3to~168.3to~168.3to~168.3to~168.3to~168.3to~132.3to~168.3to~168.3to~168.3to~168.3to~168.3to~168.3to~168.3tp~168.3tp~168.3tp~168.3tp~168.3tp~168.3tp~168.3tp~168.3tp~168.3tp~168.3tp~168.3tp~168.3tp~132.3tp~143.3u1_2~129.3u5_1~132.3ww~143.3xv_2~143.43k_3~129.43n~143.46y_2~143.4d3_3~129.4d6~154.4di~113.4do_2~143.4g4_2~153.4ga~132.4h9~143.4iz_2~129.4k5~143.4lt_2~143.4on_2~143.4rh_2~143.4ud_2~143.4x7_2~143.502_2~143.52w_2~143.55s_2&met.7=CBsQBiDSFTi3DsABmoezvgk~CAUQBRgBIJIdKJIdMP8hOO0EaJYdcP0heIqxAoAB6bACiAH03wawAQG4AQPAAZDHsvAI~CBsgig84gBXAAZDdu-gD~CBsQCiCgDzjrFMABjeLptAY~CBsQCiCgDzjsFMABmfm28gE~CBsQCiCgDzjtFMABmorlsQs~CBsQCiCgDzjxFMAB-eGftQU~CBsQCiCeDziGF8ABsPGAsQQ~CBsQCiCgDziCF8ABgJbswAo~CBsQBiDOFjjWD8ABj77vtQc~CBsQBiDOFjjXD8ABuKSv2w8~CBsQCiDbEzjKEsAB19eTiQk~CBsQARgBILkkKLkkMIooONADwAGkoPylBw~CBsQBiD-JzgbwAGLmPPpCw~CBsQBiD-JzgbwAHP4LHCAw~CBsQBiD_JzgowAGc3-bxDw~CBsQCDinLMABkZ68oQ0~CCcQDRgBIKYsKKYsMLwsOBZopyxwuyx4zUOAAbZDiAHRWLABAbgBA8AB8_LLrgs~CCcQChgBIOgsKOgsMPwsOBTAAeLBm9oF~CCcQBRgBIIItKIItMI0tOAzAAdT_u6UH~CBsQBRgBIIMtKIMtMJgtOBXAAc_G2uIB~CBwQBhgBIPotKPotMLwuOELAAaHZ1rIJ&met.1=1.ksrh4bpm~6.ua~7.ua~8.ua~9.ua~10.ua~12.uc~13.1a9~14.1hh~15.1ac~16.3wx~17.3wx~18.3xh~19.4df~20.4df~21.4dj~22.26a~23.26a
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210816/r20110914/rum_fy2019.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4001:80c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://three-back.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:28:56 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 912E 0
56 B 39ms
39ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=html5-mon&a0=layout&f0=layout&s0=0&d0=693.0000&a1=https&f1=layout_html&s1=0&d1=18.0000&i=514790624293&t=419&c=p&gqi=hTcmYdiyCKeK7_UP95y6IA&qqi=CJnZraWWzPICFQH5dwodNpoLyg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:29:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5844 0
20 B 28ms
27ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=html5-mon&a0=layout&f0=layout&s0=0&d0=1017.0000&a1=https&f1=layout_html&s1=0&d1=15.0000&i=514790625571&t=419&c=p&lp=%2Fsadbundle%2F%24csp%253Der3%24%2F7154416178616298156%2Findex.html&gqi=hTcmYfDgBd7b7_UP9JaFsAk&qqi=CJf1qqWWzPICFQ3vdwodY18F3w

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Aug 2021 12:29:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YSY3hv39PquIdMIdJVwohwAABLUAAAIB&google_cver=1&google_gid=CAESEG-nW8Rb0brrZFHCrnrP244&google_push=AYg5qPIDEsZiU7ID4qWP6I_3GUmbsKg-FmPFwp-isomgM154AE1Hi0R82Xej0Epe2hYr9Xsj7H6BSl2N_C4mRB1TPGg8lVzDl_IC

Verdicts & Comments Add Verdict or Comment

154 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-19 20:44:58	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-19 20:44:55	Name: test_cookie Value: CheckForPermission
.doubleclick.net/	1970-01-20 06:06:30	Name: IDE Value: AHWqTUkMvaFIXKjV21SC0OhnyhyROpESwFY6WtFuu01gaO8ptqmq0_LQYJBV3UnRCWY
three-back.work/	1970-01-19 20:44:56	Name: _pk_ses.1.ec7d Value: 1
three-back.work/	1970-01-20 06:10:49	Name: _pk_id.1.ec7d Value: 68d8d73025c2a455.1629894534.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
ag.innovid.com
ajax.googleapis.com
b.hatena.ne.jp
b.st-hatena.com
cdn.pixabay.com
cm.g.doubleclick.net
cms.quantserve.com
csi.gstatic.com
e.dlx.addthis.com
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
googleads.g.doubleclick.net
image6.pubmatic.com
mail.three-back.work
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.rubiconproject.com
qr-official.line.me
rtb.openx.net
s.w.org
s0.2mdn.net
scdn.line-apps.com
securepubads.g.doubleclick.net
three-back.work
tpc.googlesyndication.com
www.google.com
www.googletagservices.com
cm.g.doubleclick.net
104.111.215.191
13.224.96.14
13.224.96.45
142.250.185.66
142.250.186.130
142.250.200.67
147.92.146.123
150.95.54.210
172.217.18.98
185.64.189.115
192.0.77.48
2.18.232.182
2404:6800:4001:80c::2003
2606:4700::6812:15b7
2620:116:800d:21:5a23:9c4e:e774:96c1
2a00:1450:4001:801::2002
2a00:1450:4001:809::2002
2a00:1450:4001:809::2006
2a00:1450:4001:80e::200a
2a00:1450:4001:80f::200a
2a00:1450:4001:812::2001
2a00:1450:4001:812::2002
2a00:1450:4001:813::2002
2a00:1450:4001:827::2002
2a00:1450:4001:829::2002
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2003
2a00:1450:4001:82f::2004
2a00:1450:4001:831::200e
2a05:d01c:1d8:8101:8678:af0d:fda8:5a84
35.186.253.211
69.173.144.139
023cd7e2d58f71286cca9d16a22508396798a90df55452def220aaccb03648ac
03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0
03d741330bbcf02d10b49ae22496c2dca57d21ed1d5a49ac303ef12869680d49
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
070edfef42e0980783d0acf8fa9ca6a9833b994eca13ffaa94e9a2deb47c92cf
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c409343627d969cd57e3be028d8847ef4ce5d33623b8fd6b4902dde21a63aa3
0d421ab8abaa2d4b88ecc19902a04d9b5ac812bbb4be158dd1a72437ab32926b
0ec98adf593ebcc01bec60b1f494dacd47522abfef9038a714101d83f45e165d
0f794ec9acf7dc03b2193204a9d39212625be5c9c48042d7904a7e59904ead1d
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1eb37c60a87a21881381e6808366cdc61a30221c4a7e2aa2b2fce6838cb09dec
1f88721b914f3ea902885d622d6d7d8327b47e3714d0b6b3a8cf39604ee8b67c
2444aa425d8b7339b4e3dc5a46237459a491d793cfc71a6c13540f1774588ac4
293913879d30bab7499013e935009f5183facbddd63bfc9656a859622590b80b
29d96496ccfa8ad61ca499fb465ac1fa66ccca13be0919c6a16bcbc0ba2ca7d2
2a4524121bf19007ba74de48ee59ab4226c29928282ef0534f07b499b3ca1c0d
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2b015b1ca9ab677caa494021e0aeb53674254e6dc8e98df5d85bdd45c4b7ebcd
2dc00e6c10812518e5f101fdeef7624851e0431b4931d80e64470b576800f041
2e36bd3bdbb929f427e79a6c84b7922b4375589386981eba29eb0cff57b02b1b
300be0a8e0957b12037199387e887fb840214b6bb80939316c6a02f3535a7b69
31f5ce66030c6175da15b8931c623ce0629048b2a88b0f90d44dda235eb01bf3
32884f3d9d0c3b97d6554d090763de630f3dde1e1f5a059b88a0cc37cce6ac0b
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
33a707e8755868f0d81e6d05162dd0239ed27ace94378585c2e82f306fa69f2e
340cebbd102b7e2229ef3e3d11779474717b3c1dd3446bf696deea24fab1df55
382843b96a3a0f2c2b38c583563caad12733ae44b4b5f1b97abe948fc461596f
38cae7aa633433ce04ad15167696536fa0dfc233ea2f68d39cacfb288f5316c4
398b6670ad0185a0996862a28b55e1bebac53a1cc7f8ed8e26e89b65eabf965d
3a4b03a6c128b46647ca81421d1b1db2577751a66b09c13677c8d753cac18c7a
3ca3761ae139d73106834c7343990aa5606067f5f24b8d6f370b80db22b32803
3e65bc436e35cb24f4020abe8a71906ea53ca284df84095d6824e27f55883f90
40a311226491ed1c94eb46a02aef4dc815b6c47c9e6b4ea8449bf516e69cc25a
43a3c93628ceb446ac885205e52a0fd649de65259362cda4c6da348399df5fa3
499894c6fe72135a0944b9e732f3ebb3734534af89c8953934de2715647ddb5f
4b179562b883c1257aabbad3a5641f965dd7331faa31fe06382a5d8c62d5ee19
4b5bff9984f72badd18aadc3b57f4c0198e3d8c2b80454c3155a005ddb6185d5
4c8391b3547e1287b47be67fdf25bc781345919f26cbaff911863a3463f10d59
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
555858f907bda45e059201a8a3d8910876ef8d830b9b82cfc0ca9aa55c7b029a
56bf2dfb9f1735d0ec217531e6a064b01a5056e7b9f78246c93427299572421a
575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e
58629af3bd5fba642a9d794dc638478c29cb9daba582a7267fb608d6b3d36eb7
5bd4c83bc24ba0a2e682ef5eb37362c7f0827e849cb319befcea36337f52574f
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5ca015f8fa77f470c15f9eb0395a59182744585e02f2b7bed1e734309684b250
615ad880102b508eabed46867224661b5142ad5bd9a0d87cff05712ea373035b
669084b86cebfe73ea2b7ee1382bb075d8de8546ad73fad77acb695a6c5765ce
6a026094455ed434cd948b4fa17a485da650b5ada5b1b30ed6aa13d025df6004
6a74e1572efaa465ebabbf5c9a62e261596fbba00041e61254c1b10aa26d1d74
72e5e3fcd775fb75052cfa8980a8664b47e978d986fc7ab4ccd5f5c70c2ce9fb
7361ed8e531bf4dcdd1fc63a49f0dff0f1c88a960f689dbbef8322081a2c39bc
7437a5077982ed799fe7c545a0524124c2b620c79a27ac7662b61199b775c567
745d8f58c6d5bf0e360b3665c7ea60fddfb2820d4d62e904a4043c4f145ba38f
758415fd3b5867003c3649969039694ee59b4774bb58246f3ec644e1dc577885
76e613b06da4d65f52509320e44b1a400c2b5a8934691d08349802079f8d5511
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7adaf08052c6a6a0f8a0d0055b4f191fd07389fe41c972b69573472b2ecb406a
7e6ab35642971168713ec28f5c60578d6fb564a85fa7caba758bd00d455bfda4
8255707b639b721c4c5a4329de6574331aadb575cedc7f032aa4858a0db73ae6
82d11f76e8da395a5dfee85f631c5ab82eecb0e4711c247ccd99bd679bfc8322
864d06c6d995c32cad27aaa1abfd10c691414f0666a1783c0ed1fffa5aadbbb2
8f35757970e1ff0371dd3b3e16bf38f582072bf88cd9bdb7fccd25af04458dc7
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
948f0c154ad97428bc1d1dee456f2e20ec4e0e302b0d3189e08a4573cb63cdb3
966d07809a389eff27b3b3f6f963b4b2747dc316de56dab96e6eb38bf9bd0232
96e3246024b7d036175aef66849fdd5890c4d8f863bf827e5a57838b703b3d3b
99f6048e026a358bcd25087b08a35840836764c0c3a97cd18569a0dab3263b7b
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a2d5bcefecd12807ee56f09c0429a8d07ca013c39c629911919ef0d357797731
a383fb58f9a920d58931189b0d7d213672f91bd89f1bcd6bf3f4968ece986bee
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a596a2f3efa8cc557c4b15545040f7ed4921d30200649beb4d8ff8690deef2c4
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a8825c811f91f376b19ffcc0ddf9aab79c0009ce4cc4a680fe6e81c8eaf469a5
a986c1b3b11a193434bcbd30c93a88bb86f08c2bd43f442ccdb1fc0eae9f7df4
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
af55f0c6a549d286354966d0e237909396d3c0af5a5a7b8ee750e147d6a9da85
b03f8824c87fa1c322b227aeddb87d0bffb142815c18699c6fba59a59901a748
b4c37fd55eb6fd92897e00f010b8ba5cfd8714ab64c428b57422fac2bccc3a38
b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11
b9658459005738134ebf34fcb1882a79e05339193f0f2df065850966069f9c5d
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27
bf5230ffb8745d28c11ae8b743868364f9be8379300bd59d235f402a53ea96ee
c17defd12a8dbf98aeea4043b34398f7ab77beb8291a32265097a1e601189fcc
c500ded683ea548030aea3e0e890cb03b6b41012fa9abf994b81812f844342d4
cc444721c7c9745d64fe28f90fe2c8012f2e7fac471d1accd2fe5ca166abc68a
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
d3e33bd3eeb6d3e82825ca5990e311ada69b68575d9c5d5d205719adaf3a1618
d4876c12b071f74470f52c0404d10730ab271ae769c2c407fe131dae8b33e236
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
d6cd52651fa64dd75f14c75dbe13d695dae01d05b0eaac3522f160c20273520d
d6e0cf33bd31faca2542d9376cc2a8b9722904e24cc4d3bfc121048e46c244ea
dab8c30c945c53088874d42448b308eef304404d62c89b5534b5eb2a92c1f709
dd95d9168d1c1144f948f79c48a269e7270aaaca6b42ddd36d7133e3a3cf26ae
dd9bfe5f04d4e393463f42b4f503763c36693306dffef16d481e0c071b61ae64
de1e399b07289f3b0a8d35142e363e128124a1185770e214e25e58030dad48e5
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
df7082849e38de724a9e44f1169768edf49b462f04d295927960d588a735bb5c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e70daf1f8bcfd0ed744b5f86ac162bda58f2d2db0e5b4ba93c3adec87ad09fe3
e7363a2cbc6f57fe286b6fbdb6f13c57be00b8ef05e9afe1b82ac88d6026d7d3
e87a1c5e24f9a7c7dcb437417f0b05b0a3c12947ce32d65c990c988a8b5ed4d7
ea8082a6abf62fbbf414a90dee70cf79916101737ca24079413708515a1e1a99
eea0b9621509f98be77c5af1e9b5c952a675bda2b27c419876364017069e0c19
eeccf8db2f38aff197eb60e56e0957b2035e3e4e51b6f2117d32e139ee711eff
f15837157125dd8537e5c8691e10932f3c55f1a0cdadbf0d05dd6fabc7be8291
f34bb7d9c8f2db0e78e5d7b226bc169182f8c22e7cd1a3e7b5767519b709c1bc
f8946ea8ae77038a759d93c20ecf4b9b2a773089fa1795c1f9c0974219bea558
faf3a5b0232e4515f5c4b91225ab985faa6813ee78d0123a560def12ebe56597
fbb12ac6c339e865da5258237ebae68e2314f9afa18e1494f49c357d9cd8a9c1

three-back.work Open in urlscan Pro 150.95.54.210 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

193 Requests

99 %HTTPS

58 %IPv6

22 Domains

30 Subdomains

30 IPs

5 Countries

2595 kBTransfer

6153 kBSize

5 Cookies

7 Outgoing links

Page URL History

Redirected requests

193 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

three-back.work Open in urlscan Pro
150.95.54.210 Public Scan

Screenshot
Live screenshot

Full Image

193
Requests

99 %
HTTPS

58 %
IPv6

22
Domains

30
Subdomains

30
IPs

5
Countries

2595 kB
Transfer

6153 kB
Size

5
Cookies

193 HTTP transactions
6 data transactions