blcd.online Open in urlscan Pro
149.3.170.106 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://disq.us/url?url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F%3AFeMEqxMh35vpOV-yXiwul...
Effective URL:
https://blcd.online/mcd/hyperventilation-bonus-part/
Submission: On June 29 via manual (June 29th 2023, 10:20:34 am UTC) from AR — Scanned from US

Summary HTTP 258 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 26 IPs in 2 countries across 16 domains to perform 258 HTTP transactions. The main IP is 149.3.170.106, located in Seychelles and belongs to IPCONNECT, SC. The main domain is blcd.online.
TLS certificate: Issued by R3 on June 4th 2023. Valid for: 3 months.

This is the only time blcd.online was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	151.101.64.64 151.101.64.64	54113 (FASTLY) (FASTLY)
81	149.3.170.106 149.3.170.106	213373 (IPCONNECT) (IPCONNECT)
5	2607:f8b0:400... 2607:f8b0:4006:80b::200a	15169 (GOOGLE) (GOOGLE)
7	192.0.77.37 192.0.77.37	2635 (AUTOMATTIC) (AUTOMATTIC)
9	2607:f8b0:400... 2607:f8b0:4006:81f::2002	15169 (GOOGLE) (GOOGLE)
4	2606:4700::68... 2606:4700::6812:d73b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
4	2607:f8b0:400... 2607:f8b0:4006:80c::2003	15169 (GOOGLE) (GOOGLE)
13	2607:f8b0:400... 2607:f8b0:4006:816::2002	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f012:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
4	2607:f8b0:400... 2607:f8b0:4006:816::200e	15169 (GOOGLE) (GOOGLE)
5	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC)
6	2607:f8b0:400... 2607:f8b0:4006:820::2002	15169 (GOOGLE) (GOOGLE)
13	2607:f8b0:400... 2607:f8b0:4006:81c::2001	15169 (GOOGLE) (GOOGLE)
3	2620:100:a001::3 2620:100:a001::3	19750 (AS-CRITEO) (AS-CRITEO)
5	2620:100:a001... 2620:100:a001::24	19750 (AS-CRITEO) (AS-CRITEO)
57	2620:100:a001::4 2620:100:a001::4	19750 (AS-CRITEO) (AS-CRITEO)
5	74.119.119.147 74.119.119.147	19750 (AS-CRITEO) (AS-CRITEO)
4 8	142.251.40.230 142.251.40.230	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:809::2011	15169 (GOOGLE) (GOOGLE)
5	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	2620:100:a001::9 2620:100:a001::9	19750 (AS-CRITEO) (AS-CRITEO)
7	2620:100:a001... 2620:100:a001::16	19750 (AS-CRITEO) (AS-CRITEO)
1	2607:f8b0:400... 2607:f8b0:4006:81f::2004	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:d63b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
258	26

1 151.101.64.64 (United States)

ASN54113 (FASTLY, US)

disq.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

81 149.3.170.106 (Seychelles)

ASN213373 (IPCONNECT, SC)

blcd.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:80b::200a (Flushing, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
content.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 192.0.77.37 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

c0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2607:f8b0:4006:81f::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6812:d73b (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:80c::2003 (Flushing, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2607:f8b0:4006:816::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:8:face:b00c:0:1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:816::200e (Flushing, United States)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i1.wp.com

i0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:4006:820::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2607:f8b0:4006:81c::2001 (Flushing, United States)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:100:a001::3 (United States)

ASN19750 (AS-CRITEO, US)

rtb.va.us.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:100:a001::24 (United States)

ASN19750 (AS-CRITEO, US)

ads.us.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

57 2620:100:a001::4 (United States)

ASN19750 (AS-CRITEO, US)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 74.119.119.147 (United States)

ASN19750 (AS-CRITEO, US)

cat.va.us.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.251.40.230 (United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s39-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:809::2011 (Flushing, United States)

ASN15169 (GOOGLE, US)

csp.withgoogle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2620:100:a001::9 (United States)

ASN19750 (AS-CRITEO, US)

imageproxy.us.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2620:100:a001::16 (United States)

ASN19750 (AS-CRITEO, US)

csm.us.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81f::2004 (Flushing, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:d63b (United States)

ASN13335 (CLOUDFLARENET, US)

onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
81	blcd.online blcd.online	1 MB
77	criteo.net static.criteo.net — Cisco Umbrella Rank: 568 imageproxy.us.criteo.net — Cisco Umbrella Rank: 3134 csm.us.criteo.net — Cisco Umbrella Rank: 3113	941 KB
22	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 135 tpc.googlesyndication.com — Cisco Umbrella Rank: 160	304 KB
19	doubleclick.net 4 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 57 ad.doubleclick.net — Cisco Umbrella Rank: 184	69 KB
14	wp.com c0.wp.com — Cisco Umbrella Rank: 7806 stats.wp.com — Cisco Umbrella Rank: 2759 pixel.wp.com — Cisco Umbrella Rank: 2584 i0.wp.com — Cisco Umbrella Rank: 3650	100 KB
13	criteo.com rtb.va.us.criteo.com — Cisco Umbrella Rank: 7430 ads.us.criteo.com — Cisco Umbrella Rank: 2980 cat.va.us.criteo.com — Cisco Umbrella Rank: 2912	263 KB
7	google.com apis.google.com — Cisco Umbrella Rank: 195 adservice.google.com — Cisco Umbrella Rank: 113 www.google.com — Cisco Umbrella Rank: 10	152 KB
5	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 274	23 KB
5	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 205	281 KB
5	onesignal.com cdn.onesignal.com — Cisco Umbrella Rank: 3605 onesignal.com — Cisco Umbrella Rank: 1284	83 KB
5	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 88 content.googleapis.com — Cisco Umbrella Rank: 3954	12 KB
4	gstatic.com fonts.gstatic.com	57 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 173	88 KB
1	withgoogle.com csp.withgoogle.com — Cisco Umbrella Rank: 1307
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 1129	602 B
1	disq.us disq.us — Cisco Umbrella Rank: 21876	703 B
258	16

	Domain	Requested by
81	blcd.online	disq.us blcd.online c0.wp.com
57	static.criteo.net	ads.us.criteo.com cdnjs.cloudflare.com static.criteo.net blcd.online
13	imageproxy.us.criteo.net	ads.us.criteo.com
13	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
11	googleads.g.doubleclick.net	pagead2.googlesyndication.com c0.wp.com googleads.g.doubleclick.net disq.us
9	pagead2.googlesyndication.com	blcd.online pagead2.googlesyndication.com www.googletagservices.com tpc.googlesyndication.com
8	ad.doubleclick.net	4 redirects ads.us.criteo.com
7	csm.us.criteo.net	ads.us.criteo.com
7	c0.wp.com	blcd.online
5	cdnjs.cloudflare.com	ads.us.criteo.com
5	cat.va.us.criteo.com	ads.us.criteo.com
5	ads.us.criteo.com	googleads.g.doubleclick.net
5	www.googletagservices.com	googleads.g.doubleclick.net
5	i0.wp.com	blcd.online
4	apis.google.com	blcd.online apis.google.com content.googleapis.com
4	fonts.gstatic.com	fonts.googleapis.com
3	rtb.va.us.criteo.com	googleads.g.doubleclick.net disq.us
3	onesignal.com	cdn.onesignal.com
3	fonts.googleapis.com	blcd.online
2	content.googleapis.com	apis.google.com
2	adservice.google.com	pagead2.googlesyndication.com
2	connect.facebook.net	blcd.online connect.facebook.net
2	cdn.onesignal.com	blcd.online cdn.onesignal.com
1	www.google.com	tpc.googlesyndication.com
1	csp.withgoogle.com	disq.us
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	pixel.wp.com	blcd.online
1	stats.wp.com	blcd.online
1	disq.us
258	29

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
www.twitter.com
pinterest.com
discord.com
facebook.com

Subject Issuer	Validity	Valid
disq.us GlobalSign Atlas R3 DV TLS CA 2022 Q4	`2022-11-01` - `2023-12-03`	a year	crt.sh
blcd.online R3	`2023-06-04` - `2023-09-02`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-14` - `2023-12-15`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-03` - `2024-05-02`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-04-07` - `2023-07-06`	3 months	crt.sh
*.apis.google.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.va.us.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-01` - `2023-08-02`	3 months	crt.sh
*.us.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-27` - `2023-09-23`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-27` - `2023-08-27`	3 months	crt.sh
*.appspot.com GTS CA 1C3	`2023-06-19` - `2023-09-11`	3 months	crt.sh
*.us.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-04` - `2023-08-31`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh

This page contains 17 frames:

Primary Page: https://blcd.online/mcd/hyperventilation-bonus-part/
Frame ID: 1428E759751B2716EF9079CC2C6B0B60
Requests: 130 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230626/r20190131/zrt_lookup.html
Frame ID: 03F33E03680F537CA0A6C6338BE97AF6
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230626/r20190131/zrt_lookup.html
Frame ID: 64B27386BDAFF5B80D1A29BC3DE1EE47
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6685813834444181&output=html&h=280&slotname=1338356656&adk=1817563164&adf=1156528132&pi=t.ma~as.1338356656&w=350&fwrn=4&fwrnh=100&lmt=1687308604&rafmt=1&format=350x280&url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688034026382&bpp=7&bdt=696&idt=450&shv=r20230626&mjsv=m202306200101&ptt=9&saldr=aa&abxe=1&correlator=6844923129764&frm=20&pv=2&ga_vid=1490640896.1688034027&ga_sid=1688034027&ga_hid=525232461&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1020&ady=126&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31075534%2C42532264%2C44788442%2C44795921%2C44769661&oid=2&pvsid=2230865784680428&tmod=1842262037&uas=0&nvt=1&ref=https%3A%2F%2Fdisq.us%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=AEqw6RsLqk&p=https%3A//blcd.online&dtd=483
Frame ID: CE95CBC54F4D1C68B505AF989E4D716F
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6685813834444181&output=html&h=280&slotname=1338356656&adk=1817563164&adf=1975471561&pi=t.ma~as.1338356656&w=350&fwrn=4&fwrnh=100&lmt=1687308604&rafmt=1&format=350x280&url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688034026389&bpp=2&bdt=704&idt=523&shv=r20230626&mjsv=m202306200101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280&correlator=6844923129764&frm=20&pv=1&ga_vid=1490640896.1688034027&ga_sid=1688034027&ga_hid=525232461&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1020&ady=1172&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31075534%2C42532264%2C44788442%2C44795921%2C44769661&oid=2&pvsid=2230865784680428&tmod=1842262037&uas=0&nvt=1&ref=https%3A%2F%2Fdisq.us%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=34suEQOwjq&p=https%3A//blcd.online&dtd=544
Frame ID: 3829D5669860E4DCA0DA6EACE468C3B7
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6685813834444181&output=html&adk=1812271804&adf=3025194257&lmt=1687308604&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=212x945_l%7C212x945_r&format=0x0&url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688034026412&bpp=4&bdt=727&idt=562&shv=r20230626&mjsv=m202306200101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280%2C350x280&nras=1&correlator=6844923129764&frm=20&pv=1&ga_vid=1490640896.1688034027&ga_sid=1688034027&ga_hid=525232461&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31075534%2C42532264%2C44788442%2C44795921%2C44769661&oid=2&pvsid=2230865784680428&tmod=1842262037&uas=0&nvt=1&fsapi=1&ref=https%3A%2F%2Fdisq.us%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=3&uci=a!3&fsb=1&dtd=598
Frame ID: D7D2C6C52852FA2ADCAD42D88A09F71A
Requests: 1 HTTP requests in this frame

Frame: https://ads.us.criteo.com/delivery/r/afr.php?z=ZJ1a6gAN4VoE0Y-4AAVcGJ-cRpxL5QfEraVkKQ&u=%7CneHBKftYU6zVANl2dmx5sOTxR8b6hJDY9U2ZV54GuBA%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-dbHERHVj9MQgFtTN83TUdVFZz6mvMC78INU6e6727c9TpoF6_Hy_3OA2J3vCm6mYUX1NAdc9l2Sv3kQRyjeS7yaQwRqR7subRek4WsbAF4HzHdhw_QzreC81lxWLXFi_A7kJF6P6Q_tEu2A4C_N1Kneqj1oiWFtxyM3C-qFemum_06o7sFRvaU4xSXPQF-1BBHzm2LVLZPwFFHMxiJiWm1szKwriTPLzAurjGxygExNWxkHa1Z957I_2pQJo-ArvAIlUduLZsgBZofnYacIHgTB64wwc1HfGSjiLXvz28nDITOrIMuE7dTlk-H5CjbA25ucqZbq5y2mNvpA6FuNowqWqWBtvIc2pu7EAjwFanoWBXW9nrNWSDNHiqPCZtkxpRKp5CvqrU6zg9N5eBAbtQzp85I9bO7fTjwRpTTHGhPZaCRDTZVSWjTCgYO1ZqWIIvipRKQcVraGisTki-B8v1xVEDiVvWew9-Tjh5lxCxbznYFZ2RjQOR8-FyZ1ftAQHjFWW7-THZvYL2AIxDgbJ5jvM3HpBNgUXMjaFR0qTOGLfCZJ2TVkyxrKmGcWPmlZN-W3aWRMbE9zb7n9PcAa3jPHEAV1Vipoh&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCDjNh6lqdZNrCN7ifxtYPmLiV2A6cge-wXKqbqap0wI23ARABIABgye6Oi8CkjBCCARdjYS1wdWItNjY4NTgxMzgzNDQ0NDE4McgBCagDAcgDAqoE_gFP0G2XDxedrq4koeK__HSDPGR1fwU07-_1dsRttxNIvmnApQsHUB9sCevEZxuzqFiSweHfVWllgEBIMwcBwyz9aLJKap3C7wlpehq5Y8SdjfvvivGIMwHpR3tmhyPBuJdfXCmtVdNQU_j_8t1VCydMNTb2Lw21Rvz8PfIvS3nYRbOjverBb5bIfdW8kLhYz3SIIEG__i7-p9fk4d1AmB6olgfkCEIlItDHsDi5NMSq2jRMCyQF0maJXi1JqZkEqAKVEXhtNvbnYYAIxBfytLGBoetZWqnmbANdRBXCPUwjkdvF0lqECqg51L6W8sUJabko3Ux9F-lOU4OWxkGMiIAGiKHur8vVqKuEAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1juHiseRGaSvhA2biOiKQlNKxz3w%26client%3Dca-pub-6685813834444181%26adurl%3D
Frame ID: 48E1277E4F25C1BC47F84963EFE57419
Requests: 23 HTTP requests in this frame

Frame: https://ads.us.criteo.com/delivery/r/afr.php?z=ZJ1a6gAO-AkITzauAAKkpD-yY15SSctqNIbczw&u=%7CneHBKftYU6z2kKbWpVkkxmeEU5cOr2E4PDNQWFqsXJs%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-dbHERHVj9MQgFtTN83TUdVFZz6mvMC78INU6e6727c9TpoF6_Hy_3OA2J3vCm6mYUX1NAdc9l2Qce0rLSvi7hLeNul4KJjn91GHNzPvrNNIITJ6oiRCCkM7rY313mzKvm0QYnwpRtnf0yLz4uNUG7lr_vY7SrV7HeJJ9VI14GHi_IxTkJ4EMqNcjAj2Bs9FXMADQAZ1XW4ypvB6S7N66WMhi7ItKuTnd1XoSrZQu-iOPDhxxoIiTTSmj5UYkKMDqO7ZRZ2djGcTfiNrQCcbz8aIStumX7mLrNnH6tU8GxE1RuG9LgWimBbiXV97RrL73EOSvVFLCSNiaCA0HwiK8_CdwwKvOoKaoy2tYsRk8ZnLvonIwjahihYZxZMgPPB2KQNdULB1APRaebBWAbDm4Zb0Vc7Y7Kn859HfPoUDiZcu87KQDCkDHyE5Dvn5YxGAHz-yOaox6vooRXKcVWuZHie9O1HTMOltAM6Z-h7S5-lQ3N8oumxl_VCadrbYMoyxqJovvaSXEQNRWOc5HnP9Ca0QCZtnMPkZJbA3sVKIsZTcieD78-vTKk11Cm4A-6MnwVRUDE_wU_qHHpjx1oJCc4mfivGmYCOzj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCndKT6lqdZInwO67tvPIPpMmKqA-cge-wXLKaqap0wI23ARABIABgye6Oi8CkjBCCARdjYS1wdWItNjY4NTgxMzgzNDQ0NDE4McgBCagDAcgDAqoEhAJP0J1RUFC1RFm1pKKFEgwAPSNJ9J3SI8JWIZPGb9ox7Sqbq4504wb-0WlLP5ARlBw3WjvxGi1W8Wu4XZaBNsLFAw0agpmHCy1_0DZDDkDo1LKb62emb7Gld_YDwjFWXrbn4j6eh5tWUkWLJFfazXZ2Hur27I2dy3AR3Wju9YS83t7FSYX-rFmL3WJD65uWQgZh2vC-V56coSq4lMed1UO6Kv4uClTyuNONtUS9ioJSUQICOhXQzr5prpwVAPg8yUXwLwvcK8Y68zIeaWyoSzmCoBWY06cWy3uvZjB9cmqkVu99pHgZKRbpw7xK5-_2RKykjKV2RKxL5kvZzOY-AV6JkhMK4YAGiKHur8vVqKuEAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0o7mLbPPEdBjjMVE407yXQcmlA9Q%26client%3Dca-pub-6685813834444181%26adurl%3D
Frame ID: 624A2EAAFBABDDB6B7E8F9522BF8FB5B
Requests: 21 HTTP requests in this frame

Frame: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.5o5-TAFr18s.O%2Fd%3D1%2Frs%3DAHpOoo_qgszOsFrBH7bZ1Rmfwa9Mc03wLQ%2Fm%3D__features__
Frame ID: 01C374D1D6EDBA98B8FF4F19F2B2B868
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/zrt_lookup.html?fsb=1
Frame ID: 558E9CF86C2725F788FE7C9D76F70AE1
Requests: 4 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/zrt_lookup.html?fsb=1
Frame ID: E1CC74AD7174E67CE1FC08876CF62909
Requests: 4 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/zrt_lookup.html?fsb=1
Frame ID: A37D4520191F60B680DB752ADEFF308B
Requests: 8 HTTP requests in this frame

Frame: https://ads.us.criteo.com/delivery/r/afr.php?z=ZJ1a6wAA_SsE0bJhAAUICV6jvlDp5kO8-OUe4A&u=%7CneHBKftYU6xNDoPitsho4GLvVlwuDxBZ6DUCS8gMIfU%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-pdBd4Yn-iAyg0RfPc5NXLXF37ShTWqW3dXReprTZdqqDdxKZ6LPg3fC_n0cZ1rmV5e7VlaC3Amu5uqCRlBmif_WneQ4Jwe5tSdd22mubUn5RRL-HiNYHj2QsPhJoe3ilaN3y9d_SpHaAJZQLCBE2HTxXOwTIxg3e3Dd9bv8rGnKM4g2fNxzUEkEXcOC4pXOtxRuRbz5V3uT4PNzuslVgBcbAjTltPltbpPU7eq3ho_5Q6PhOwIXnndGhKsM7oKNy_arHuUXx9NB-sgT68KP2Svv58pppFxIQNCPUBa_8AD-Nqf6tbN7x5UGiNVnyjjl6yUTT89R6nB7zjR9uOlMGfOWLbfKqR_4ztrOlcA-h8nsy3zllI14L_0OAKwesBPiQYFCRC958HUjyGP45X9KmoeDsqIJbOoe8rtII5DavgrH8lVaoWgUEDY-T5t0qWdcrnkwi-EbEV_2sS6AEWqx6L7JucMy5YvVkU8xfrbkYiMzycMEF3zzxTE7-XOxzszQbKkuXOCZ4eY-s8AonvLIb5Ln3RdsKtTj2fMy8SBKMUj6VvPYSG5mSD-t5YwlLMcNacj8Fy_xWFQKodgdM3LXNbYUj_x3VAOON&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCNRtx61qdZKv6A-HkxtYPiZCU-Aqcge-wXNqkqap0wI23ARABIABgoQKCARdjYS1wdWItNjY4NTgxMzgzNDQ0NDE4McgBCagDAcgDAqoE_gFP0En6qIK5wWk9UEfqczTKhyJ6eQ1sMPc6ulSBfCPDK7AkiScBIfP4XWW5i4p8vuBY09ALODhCAAC4vPJfvcZuohHAicYZnz1REicDWRHDMgIcojT2dEHVPsZwiTinNOUYCUaO9IKqkFX0OqlCan5F5nGRCOIeBMtyVdidyfsao_i0rjSrBVKA2zguRBuAL4SkXmn72rTGT6_3KnqosURmGc9yQrmy7m88SeCYM4eTHMr_4PfMywHHbUznMlN1RQEsp84eODaq19e1SCVLGepDkf5ivv2BK_hmV2C76UIp3-wKH-HLaDNIrbtxXsGu4Eq5HWiD-EAF6Y-FDy1NJoAGiKHur8vVqKuEAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_3a0JvHxdvFkQ_QjOydGId5cTjksA%26client%3Dca-pub-6685813834444181%26adurl%3D
Frame ID: B79C89EDD9AD12569BF2E55D27F06364
Requests: 16 HTTP requests in this frame

Frame: https://ads.us.criteo.com/delivery/r/afr.php?z=ZJ1a6wAA_SwE0bJhAAUICTqIH6sXhi2A1OAxAA&u=%7CneHBKftYU6wXIZh8DmWMO676jZummJ7XF%2BqW1bgpbJM%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-pdBd4Yn-iAyg0RfPc5NXLXF37ShTWqW3dXReprTZdqqDdxKZ6LPg3fC_n0cZ1rmV5e7VlaC3AmtiRxcvx7B1QNv8IFUIEbw6vEo1ODCm0Lpwaxh3U0JQBd-DkMTrHlxEZsRCISG_3S3jyv-Z9g9-1UP_neoJPMlsvOw4e8gAMeDOIArW3uN-QS6yN09wwfSu3cBDb8KE4SeYcjKyIPXv5MCfm48gX79duRiqv3m4anNb93A3SPs1hzSjwu3IX4OciD7oto02A3NpL8BLoAwnTZAcYXx0OmbXGvRo0Jl2zYQYRBgvbNhcW44FQwGsNhihqm2tD4ipeYeSkNRgFaDdRBASIK43NWeO9QWgNNRzG4vyHlD5rQtmK047V17AvOQl6EZtFmo5WrjzRza6pXYYe5CBT7BgAyenhBC9q_ApXnJpwfuHdzJ3Hvl5lNYozbDUqRfyYZz3sHrJV4YY5O6c8vorsCP5ZX-AoVc3gpanTtFFbkophamx3QCrq9SaCMUPZdyT6EWCaqzFSn7BCrgxAl9Ja1o6J1aLGH3z6ZnrfzV9f7r2MuEPNgI0n7W-Gj7QkYHwh17d-YP2tSJLplQYFi7xrQVymnaH&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCvTsC61qdZKz6A-HkxtYPiZCU-Aqcge-wXNqkqap0wI23ARABIABgoQKCARdjYS1wdWItNjY4NTgxMzgzNDQ0NDE4McgBCagDAcgDAqoE_gFP0A28PS2zDY6rPdyugfqJV_sWB8qDvF71FPAn2DY1D4rRU21vBwvQ1NTyBoVVh3uPVrbE3g1ds0ye3JG9jajt1xmjNJjGk_iwpzEksX_KzjwxXs9nqZTCeGMedEa_2eX93V946u-JstUOCd9iSJ8AE6_GkodlUH7Wt0TxDUWMx1qcAr-8bDpIf3yE-MkHboM1G4d0P_xMkFXmKT-324XGOMTJOM3QXzrsjsFcIljOTsBq3T0xxQX18GZeHLImYnTYSgXzwQ3u8hKluUi6_Zg_W0hSre96-r_8pKQF4DF_SdGpLMaAp_kSEzn1HiXWsup29xw5NaILzhNwC-iocYAGiKHur8vVqKuEAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0DJExMoK_xHYPXbQPIxU-Joe7BbA%26client%3Dca-pub-6685813834444181%26adurl%3D
Frame ID: 37D5BE3970758E7EEBBBE583826296DB
Requests: 16 HTTP requests in this frame

Frame: https://ads.us.criteo.com/delivery/r/afr.php?z=ZJ1a6wAA_S0E0bJhAAUICb_v0kBKAlZRDjFSSw&u=%7CneHBKftYU6yYXxwbpRmMUOYlHErn0W9N%2Fryrf0cGycs%3D%7C&c1=m7oIQCLYgBslArNoBtbzWGPvj6heTG_nq948FPMQexFgSXZ5qfLYlz1Dr0C5Jfeybmk8T_2vGR7Ob23Zd9U92InMkPzyF6xgoT0mEX5pszB9v38b_sGpYyJgeZ9x3rOhLXTvGvej4KNiD-cnToJF88IXCF6x8CBoThc2YScrLiLm1qPoF1lzyn8ds86KYKwLVcCem_-RgTHiIVkG-Zu38i5FRt8MsnNjwkd8eQaPvcV8AVe-r3LQZpOeUNzhPTEk-XwhxqTynGyuo2nKlCc8t9qndDSc0nizij0SQI0g_To9lM8vtgf7nSJ7RdyPAAtPYkDdNLpF56_wYdgctcy4VootL3kVHg_BCbkVvvSE_2iWqag64627MXEKyQLGfAGv2LO1Rri9wEy-o13cKR8hz7QF44VFRctQ2i0PWJdMovngMRsSqAnzgUJk4b_W5LXiZ5-ELgZ6zFeqHHKmP15ac7lq65_o1s7Y75GTn0gRLuwei_uJ3-72xTqS6CqtEsUj53MBkt22KzJZb_qbO8o9ZcNKwt6lV0csdiWO8LJBk6Xda90FhQureU5iMKKCEKmcw9JqeTX2uKbOMz-uKzSfY_91NMC9C-ir25uUYvm75jvcej2l0Do1Agvr30yttMzX5YqQDy0q4-o&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCsUHQ61qdZK36A-HkxtYPiZCU-Aqcge-wXNqkqap0wI23ARABIABgoQKCARdjYS1wdWItNjY4NTgxMzgzNDQ0NDE4McgBCagDAcgDAqoE_wFP0MXLBKKuZLuDWIepFBkcTmHTRrpJs3eR68QtH6pFfiHc8OrT5R5nJXVgppl_STk3vd_0v15twtkC7MAbDf-paU8ZiuhI0oQ3pED7aSeFIu97NSZnSsKBzXSTQ7aUELvgm0Hu7vplf0ZWxpr6YNhBFeEXsi5yaXigD2weXIq7pJng9xfwR0HVV_eAYyDrY6a63f6IacldQsAzAfCXLDSWambekuaNx40dm5EpUZTH7adkDOUzii3o-ss9-G9_bovqvmjH-_TESAlZvWmBQKZVShSx1ZyVWawY5Xrnq_suV9naUQNzQzWpJXV6OfXoHfLOAzSTfLggvDnOLuvcCyOABsbUhOPe0aXlxgGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggSCIBhEAEyAooCOgKAQEi9_cE6-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2M-HZEgajTw3X7PQ-IDPHUpd70Vg%26client%3Dca-pub-6685813834444181%26adurl%3D
Frame ID: 8FD7FBADE1D079B5EF2B6D2A6837A433
Requests: 20 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: ACDBC17C1190EB5B4EB54A69B82381F7
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 0F11A669F150DCF79873D42A7D1A83F0
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Hyperventilation Bonus Part - BLCD.online

Page URL History Show full URLs

https://disq.us/url?url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F%3AF... Page URL
https://blcd.online/mcd/hyperventilation-bonus-part/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
<link[^>]+s\d+\.wp\.com
/wp-(?:content|includes)/

Elementor (Landing Page Builders) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*href=(?:"|')[^"']*elementor/assets
<link [^>]*href=(?:"|')[^"']*uploads/elementor/css

KineticJS (JavaScript Graphics) Expand

Overall confidence: 100%
Detected patterns

kinetic(?:-v?([\d.]+))?(?:\.min)?\.js

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

GSAP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

TweenMax(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
googleapis\.com/.+webfont

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/[a-z]*\.js

OneSignal (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

cdn\.onesignal\.com

Slick (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

(?:/([\d.]+))?/slick(?:\.min)?\.js

Swiper Slider (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

swiper(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

258
Requests

98 %
HTTPS

72 %
IPv6

16
Domains

29
Subdomains

26
IPs

2
Countries

3540 kB
Transfer

10470 kB
Size

6
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/sharer.php?u=https://blcd.online/mcd/hyperventilation-bonus-part/

Search URL Search Domain Scan URL

URL: http://www.twitter.com/share?url=https://blcd.online/mcd/hyperventilation-bonus-part/

Search URL Search Domain Scan URL

URL: http://pinterest.com/pin/create/button/?url=https://blcd.online/mcd/hyperventilation-bonus-part/

Search URL Search Domain Scan URL

URL: https://discord.com/invite/U9dy5vnHRf
Title: Discord

Search URL Search Domain Scan URL

URL: http://facebook.com/blcdonline
Title: Facebook-f

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://disq.us/url?url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F%3AFeMEqxMh35vpOV-yXiwulTHY9lk&cuid=5728715 Page URL
https://blcd.online/mcd/hyperventilation-bonus-part/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 146

https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aea2de3e821ce2feab9aba8faa8;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua= HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_pre=CPjY1eSg6P8CFYUtDAodGKsEyg;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aea2de3e821ce2feab9aba8faa8;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=

Request Chain 154

https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aea87e303af637b7917f08095b7;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua= HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_pre=CLnb1eSg6P8CFVjxswodAT8GzA;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aea87e303af637b7917f08095b7;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=

Request Chain 209

https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aeb1af35110a3892365a7e1493b;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua= HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_pre=CMH--uSg6P8CFa1FcgodAJoFcQ;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aeb1af35110a3892365a7e1493b;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=

Request Chain 215

https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aeba34cc838c2be3551924b4f98;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua= HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_pre=CMCb_eSg6P8CFcYLcQodbOMNpw;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aeba34cc838c2be3551924b4f98;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=

258 HTTP transactions
12 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK url
disq.us/ 241 B
703 B 123ms
54ms Document
text/html 151.101.64.64
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disq.us/url?url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F%3AFeMEqxMh35vpOV-yXiwulTHY9lk&cuid=5728715

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.64.64 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Age: 0
Cache-Control: no-cache
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 183
Content-Type: text/html; charset=utf-8
Cross-Origin-Resource-Policy: cross-origin
Date: Thu, 29 Jun 2023 10:20:25 GMT
Disqus-Cachetype: PRIVATE
Disqus-NoCache: 1
Expires: Thu, 29 Jun 2023 10:20:24 GMT
Server: nginx
Vary: Accept-Encoding
X-Backend: shortener
X-Content-Type-Options: nosniff
X-Location: https://blcd.online/mcd/hyperventilation-bonus-part/
X-XSS-Protection: 1; mode=block

GET
H2 200 Primary Request / Show response
blcd.online/mcd/hyperventilation-bonus-part/ 73 KB
17 KB 349ms
106ms Document
text/html 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL

https://blcd.online/mcd/hyperventilation-bonus-part/

Requested by

Host: disq.us
URL: https://disq.us/url?url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F%3AFeMEqxMh35vpOV-yXiwulTHY9lk&cuid=5728715

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),

Reverse DNS

Software

Nginx / DLEMP

Resource Hash

bf48379c4fd77b07208b445fd205200bab0f05a55cf2c51a69c7a047eb056fb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disq.us/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 29 Jun 2023 10:20:25 GMT
last-modified: Wed, 21 Jun 2023 00:50:04 GMT
server: Nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: DLEMP
x-xss-protection: 1; mode=block

GET
H2 200 style.min.css
blcd.online/wp-content/cache/min/1/c/6.0.5/wp-includes/css/dist/block-library/ 87 KB
12 KB 106ms
103ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/c/6.0.5/wp-includes/css/dist/block-library/style.min.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: a663ab80d62dfef74d113892bc1e77e22090026b5f8b606fa8f9722889a6ccdc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-2d9d"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 11677
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 mediaelementplayer-legacy.min.css
blcd.online/wp-content/cache/min/1/c/6.0.5/wp-includes/js/mediaelement/ 11 KB
3 KB 191ms
188ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/c/6.0.5/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 76ebf95990798f63b000b33a99b03b42c535991887eff93976266c793ab51684

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-a47"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 2631
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 wp-mediaelement.min.css
blcd.online/wp-content/cache/min/1/c/6.0.5/wp-includes/js/mediaelement/ 4 KB
1 KB 192ms
190ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/c/6.0.5/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-484"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 1156
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 jquery.fancybox.css
blcd.online/wp-content/cache/min/1/wp-content/plugins/amy-user/assets/css/vendor/ 12 KB
3 KB 194ms
192ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/wp-content/plugins/amy-user/assets/css/vendor/jquery.fancybox.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-c18"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 3096
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 style.css
blcd.online/wp-content/cache/min/1/wp-content/plugins/amy-user/assets/css/ 3 KB
1 KB 195ms
193ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/wp-content/plugins/amy-user/assets/css/style.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: c39fb23da7c825a0a843d07f441fc5d7f93f43c118681032515f38d42d296ee1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-307"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 775
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 styles.css
blcd.online/wp-content/cache/min/1/wp-content/plugins/contact-form-7/includes/css/ 2 KB
1 KB 196ms
194ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 88f21490128244f54a38864c301f0c9be49f323f6da36c5f5a6bd02175647ada

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-373"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 883
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 elementor-icons.min.css
blcd.online/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/eicons/css/ 19 KB
4 KB 198ms
196ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 52e8e2f11fab8c5f43f66daea5b6f3eb1dda5b602c5d848ed7524bf61f591721

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-f80"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 3968
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 frontend-legacy.min.css
blcd.online/wp-content/plugins/elementor/assets/css/ 13 KB
1 KB 201ms
199ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor/assets/css/frontend-legacy.min.css?ver=3.6.8
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 077bfe0738b737a566cf1dd70834894d972a0918667939e7261f1e5984f31ccd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Sat, 06 Aug 2022 06:15:49 GMT
server: Nginx
etag: W/"62ee0715-35ed"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 frontend.min.css
blcd.online/wp-content/plugins/elementor/assets/css/ 160 KB
20 KB 202ms
200ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.6.8
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: b0b4118c0e1ae2a813aa461b6040e664d39ae42d5dd1e9db809e302235d2d94c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Sat, 06 Aug 2022 06:15:49 GMT
server: Nginx
etag: W/"62ee0715-27ed5"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 post-4908.css
blcd.online/wp-content/uploads/elementor/css/ 1 KB
604 B 214ms
213ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/uploads/elementor/css/post-4908.css?ver=1655193448
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: cbc7a6942ab7353e031c2487f985f98cbe6adbc9472db853608af633e37433c6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 14 Jun 2022 07:57:28 GMT
server: Nginx
etag: W/"62a83f68-400"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 frontend.min.css
blcd.online/wp-content/plugins/elementor-pro/assets/css/ 206 KB
23 KB 215ms
214ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor-pro/assets/css/frontend.min.css?ver=3.0.9
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: c30108a682ca0caa68d01b74ec64963ff715840b90444ec56d4ced5c028d2852

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 14 Jun 2022 07:57:12 GMT
server: Nginx
etag: W/"62a83f58-33811"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 wp-emoji-release.min.js Show response
blcd.online/wp-includes/js/ 18 KB
5 KB 114ms
101ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-includes/js/wp-emoji-release.min.js?ver=6.0.5
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Sun, 05 Jun 2022 10:56:51 GMT
server: Nginx
etag: W/"629c8bf3-48b9"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 all.min.css
blcd.online/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 59 KB
13 KB 201ms
190ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 69ddbbb1de9c425c5f594dffcc57bcd00b6aabeb75a3818541733d0a02568ee0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-326d"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 12909
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 v4-shims.min.css
blcd.online/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 26 KB
4 KB 205ms
193ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor/assets/lib/font-awesome/css/v4-shims.min.css?ver=3.6.8
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: c55902832fb84522d02ea1a60a30747403a140d8651fa748f13ba398b0c0df3a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Sat, 06 Aug 2022 06:15:49 GMT
server: Nginx
etag: W/"62ee0715-684e"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 global.css
blcd.online/wp-content/uploads/elementor/css/ 33 KB
3 KB 206ms
194ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/uploads/elementor/css/global.css?ver=1655193448
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 1b7c12e052b481373bb9c700a7f224e542693974274712a2c3af82c5ae85acca

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 14 Jun 2022 07:57:28 GMT
server: Nginx
etag: W/"62a83f68-8425"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 post-4825.css
blcd.online/wp-content/uploads/elementor/css/ 11 KB
2 KB 208ms
197ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/uploads/elementor/css/post-4825.css?ver=1655193448
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: cbe0b475e48c1ea26068c7397cfe2c763a4c80c8f98a060604ed2c666f299f3e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 14 Jun 2022 07:57:28 GMT
server: Nginx
etag: W/"62a83f68-2a30"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 post-4911.css
blcd.online/wp-content/uploads/elementor/css/ 4 KB
1010 B 206ms
199ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/uploads/elementor/css/post-4911.css?ver=1655193448
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: cc6664449f9bbeea4614a76c1dffa2d5cb67f5f3cce40da0d47eb4baf96a0462

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 14 Jun 2022 07:57:28 GMT
server: Nginx
etag: W/"62a83f68-f17"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 video-js.min.css
blcd.online/wp-content/cache/min/1/wp-content/plugins/video-embed-thumbnail-generator/video-js/v5/ 39 KB
13 KB 206ms
200ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/wp-content/plugins/video-embed-thumbnail-generator/video-js/v5/video-js.min.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 1fbf195700bd0360474b57872e8c44c919d12fa198e18be34c73cda544273536

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-3432"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 13362
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 kg-video-js-skin.css
blcd.online/wp-content/cache/min/1/wp-content/plugins/video-embed-thumbnail-generator/video-js/v5/ 1 KB
692 B 209ms
203ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/wp-content/plugins/video-embed-thumbnail-generator/video-js/v5/kg-video-js-skin.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 8e4f3f90a14a1f9080af34ee84abeeb6d93272b21ccf21116653df124e2a42ea

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-1b8"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 440
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 videopack-styles.css
blcd.online/wp-content/cache/min/1/wp-content/plugins/video-embed-thumbnail-generator/src/public/css/ 15 KB
4 KB 210ms
204ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/wp-content/plugins/video-embed-thumbnail-generator/src/public/css/videopack-styles.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: d6dfc7b02a785912b4d8fc6ee690471ac4e4e2e040565d407ba9f004e7fb559c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-db5"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 3509
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
1004 B 121ms
40ms Stylesheet
text/css 2607:f8b0:4006:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Condensed&ver=1.0.0

Requested by

Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

366b852a67aeca6a82b972ff59d842387c2a000f984976700ee15fb1045d19fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 29 Jun 2023 09:05:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 29 Jun 2023 10:20:25 GMT

GET
H2 200 css
fonts.googleapis.com/ 6 KB
855 B 124ms
43ms Stylesheet
text/css 2607:f8b0:4006:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Poppins%3A400%7CRoboto+Condensed%3A700%2C400&ver=6.0.5

Requested by

Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32fbacbf3057baf4ea89f620cb234695cb891dde138582795dc23e6e07593b59

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 29 Jun 2023 10:20:25 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 29 Jun 2023 10:20:25 GMT

GET
H2 200 font-awesome.min.css
blcd.online/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 31 KB
7 KB 211ms
206ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/font-awesome.min.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 30a55f8debf61584a49dadf436538f66868a3980f6f1c25e96ee33c2b1831c9b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-1bb9"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 7097
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 slick.css
blcd.online/wp-content/cache/min/1/wp-content/themes/amy-movie/css/vendor/ 1 KB
731 B 212ms
207ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/wp-content/themes/amy-movie/css/vendor/slick.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 21b589bbc25d38fbf4c8168b0801ce4cf9d0aa1d372ae1ac773574aaeb10c08d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-1df"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 479
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 slick-theme.css
blcd.online/wp-content/cache/min/1/wp-content/themes/amy-movie/css/vendor/ 3 KB
1 KB 212ms
208ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/wp-content/themes/amy-movie/css/vendor/slick-theme.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: f277d7c8e1fee0ec06a296197af4474e9f8062b69425f217ffd0d880c90c9163

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-32b"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 811
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 tooltipster.bundle.css
blcd.online/wp-content/cache/min/1/wp-content/themes/amy-movie/css/vendor/ 7 KB
1 KB 213ms
209ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/wp-content/themes/amy-movie/css/vendor/tooltipster.bundle.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: bda61a9e4e59093c580e68c2b9b6817a2f0e5dc2b6feba9ff4dae433cc03a010

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-44f"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 1103
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 jquery.mCustomScrollbar.css
blcd.online/wp-content/cache/min/1/wp-content/themes/amy-movie/css/vendor/ 42 KB
4 KB 214ms
210ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/wp-content/themes/amy-movie/css/vendor/jquery.mCustomScrollbar.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 0786f4e261cf3e68cc9411a74e80e4c2d60d6fb21aa9ca8c4c9779fbb00d5b93

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-fd1"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 4049
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 plyr.css
blcd.online/wp-content/cache/min/1/wp-content/themes/amy-movie/css/vendor/ 24 KB
4 KB 215ms
211ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/wp-content/themes/amy-movie/css/vendor/plyr.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 3aebc591462e99894c150881155ac8cabdd775d30a5a5857b9c617d6a0c0c3cc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-fbf"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 4031
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 style.css
blcd.online/wp-content/cache/min/1/wp-content/themes/amy-movie/css/ 258 KB
35 KB 216ms
213ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/wp-content/themes/amy-movie/css/style.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 12ae632eec6299f6f0a956940407af2eba7a5e1634c127479ed4bdf248674b83

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-89d6"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 35286
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 css
fonts.googleapis.com/ 51 KB
2 KB 139ms
61ms Stylesheet
text/css 2607:f8b0:4006:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CArsenal%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.0.5

Requested by

Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3249f30a0968bf4850f7aa36f6dd0c3cdaa09a1d139ed1404c7c6b82038a6e11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 29 Jun 2023 10:20:25 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 29 Jun 2023 10:20:25 GMT

GET
H2 200 fontawesome.min.css
blcd.online/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 57 KB
13 KB 291ms
288ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css?ver=5.15.3
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: d01a2ba2805c78957e15a2958135de0f3cb88e95159dd0f6c0a032bd76b1b0e9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Sat, 06 Aug 2022 06:15:49 GMT
server: Nginx
etag: W/"62ee0715-e238"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 brands.min.css
blcd.online/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 1 KB
591 B 292ms
289ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.min.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: b8449a28a151415d580be1dfd69056906199f1dd6ceb2c1b5edf61950ada9d13

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-153"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 339
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 jetpack.css
blcd.online/wp-content/cache/min/1/p/jetpack/11.2.1/css/ 84 KB
16 KB 293ms
290ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/p/jetpack/11.2.1/css/jetpack.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: e59c3ab5a833e49b36ec5282439b66831e35a670ceb32b8028a102fbf4af47a0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:25 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-4044"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 16452
expires: Sat, 29 Jul 2023 10:20:25 GMT

GET
H2 200 related-posts.min.js Show response
c0.wp.com/p/jetpack/11.2.1/_inc/build/related-posts/ 6 KB
2 KB 100ms
24ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/11.2.1/_inc/build/related-posts/related-posts.min.js

Requested by

Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

fe66ac5df69c78be7dfcf75943079129dbf24a254e89febc5a7e916d40de43bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nc: HIT jfk 1
date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Tue, 07 Dec 2021 16:56:47 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Fri, 28 Jun 2024 10:20:26 GMT

GET
H2 200 jquery.min.js Show response
c0.wp.com/c/6.0.5/wp-includes/js/jquery/ 87 KB
30 KB 102ms
27ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.0.5/wp-includes/js/jquery/jquery.min.js

Requested by

Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nc: HIT jfk 1
date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Wed, 10 Mar 2021 15:07:24 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Fri, 28 Jun 2024 10:20:26 GMT

GET
H2 200 jquery-migrate.min.js Show response
c0.wp.com/c/6.0.5/wp-includes/js/jquery/ 11 KB
4 KB 102ms
27ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.0.5/wp-includes/js/jquery/jquery-migrate.min.js

Requested by

Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nc: HIT jfk 1
date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Wed, 18 Nov 2020 09:06:06 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Fri, 28 Jun 2024 10:20:26 GMT

GET
H2 200 wonderpluginaudioskins.js Show response
blcd.online/wp-content/plugins/wonderplugin-audio/engine/ 32 KB
2 KB 118ms
102ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/wonderplugin-audio/engine/wonderpluginaudioskins.js?ver=8.1
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 803249bc00e341d5efa127bc9da053669bc8edea743426f5eb011e6d434ee941

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Sat, 13 Feb 2021 15:59:16 GMT
server: Nginx
etag: W/"6027f754-7e70"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 wonderpluginaudio.js Show response
blcd.online/wp-content/plugins/wonderplugin-audio/engine/ 82 KB
19 KB 123ms
107ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/wonderplugin-audio/engine/wonderpluginaudio.js?ver=8.1
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: e04e18c0bd70418b6195895b170d05471f39553239d0409ec6ae80bb91678eab

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Sat, 13 Feb 2021 15:59:24 GMT
server: Nginx
etag: W/"6027f75c-1485b"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 v4-shims.min.js Show response
blcd.online/wp-content/plugins/elementor/assets/lib/font-awesome/js/ 15 KB
4 KB 125ms
110ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor/assets/lib/font-awesome/js/v4-shims.min.js?ver=3.6.8
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 97cf1307c16a437b77b5f7f5c9bc0b985d0745a14be5a279019aca5a3432e264

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Sat, 06 Aug 2022 06:15:49 GMT
server: Nginx
etag: W/"62ee0715-3acf"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 defaultthumb.jpg
blcd.online/wp-content/uploads/2019/06/ 87 KB
88 KB 126ms
112ms Image
image/jpeg 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blcd.online/wp-content/uploads/2019/06/defaultthumb.jpg
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: e786b109dbfadad391ba4df0f0e34e5a78db2da1d5afe27b805e6fe34e0c7f67

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
last-modified: Sat, 13 Feb 2021 20:50:30 GMT
server: Nginx
etag: "60283b96-15de0"
x-powered-by: DLEMP
content-type: image/jpeg
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 89568
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 141 KB
49 KB 150ms
72ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eac9c04698938dd3a9c7fe2be3237e0e21d08f3d0ff768bd0bc7a121251b914a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49312
x-xss-protection: 0
server: cafe
etag: 11497339343478709278
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 29 Jun 2023 10:20:26 GMT

GET
H2 200 solid.min.css
blcd.online/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 1 KB
592 B 104ms
103ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ver=1687291791
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: dc7e118b7e07217031d017282955569cb66891f527050135caadb2dd5779824f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:51 GMT
server: Nginx
etag: "6492078f-154"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
content-length: 340
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 animations.min.css
blcd.online/wp-content/plugins/elementor/assets/lib/animations/ 18 KB
3 KB 103ms
102ms Stylesheet
text/css 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=3.6.8
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: fe513ef974b767510d0a2b9f1b4d3afa53185b89ab617c869e5e3d6db960192c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Sat, 06 Aug 2022 06:15:49 GMT
server: Nginx
etag: W/"62ee0715-4824"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 photon.min.js Show response
c0.wp.com/p/jetpack/11.2.1/_inc/build/photon/ 685 B
348 B 101ms
28ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/11.2.1/_inc/build/photon/photon.min.js

Requested by

Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

5cfd3418ebf7c95f8f7a9024ebfa383ff5a267a8568c9a2708c26733824bdf07

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nc: HIT jfk 1
date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Tue, 07 Dec 2021 16:56:47 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Fri, 28 Jun 2024 10:20:26 GMT

GET
H2 200 jquery.fancybox.js Show response
blcd.online/wp-content/plugins/amy-user/assets/js/vendor/ 67 KB
22 KB 132ms
118ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/amy-user/assets/js/vendor/jquery.fancybox.js?ver=2.1.5
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 1c02caf2a0f16318965676fd4b265265728d64fba2794a20b07151a4e891fca6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Sat, 13 Feb 2021 16:06:14 GMT
server: Nginx
etag: W/"6027f8f6-10aa9"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 script.js Show response
blcd.online/wp-content/plugins/amy-user/assets/js/ 4 KB
2 KB 212ms
198ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/amy-user/assets/js/script.js?ver=1.0.0
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 908b9ccc0c00803145962480e1659e36554254685a4ebea4939257dda7a05aef

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Sat, 13 Feb 2021 16:06:12 GMT
server: Nginx
etag: W/"6027f8f4-10ab"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 index.js Show response
blcd.online/wp-content/plugins/contact-form-7/includes/swv/js/ 10 KB
3 KB 213ms
199ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=5.7.7
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 52db930f81d97113dde679cac624cb5435b56d4ac486e91a0b6692d2cb615a84

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:06:59 GMT
server: Nginx
etag: W/"649206e3-2801"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 index.js Show response
blcd.online/wp-content/plugins/contact-form-7/includes/js/ 13 KB
4 KB 214ms
200ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.7.7
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 1060091178cbd6c843b802f516f230f1a3a1e85f1afbd6ef84d80e5430ba457e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:06:59 GMT
server: Nginx
etag: W/"649206e3-328f"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 intersection-observer.js Show response
blcd.online/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-lazy-images/dist/ 9 KB
3 KB 215ms
201ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-lazy-images/dist/intersection-observer.js?minify=false&ver=83ec8aa758f883d6da14
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 9900b23f9f49af5f34387eb63a8673a563ab131c1e171cfaf14cf8b67a466b9d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Tue, 30 May 2023 20:46:50 GMT
server: Nginx
etag: W/"647660ba-2317"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 lazy-images.js Show response
blcd.online/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-lazy-images/dist/ 2 KB
1 KB 216ms
202ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-lazy-images/dist/lazy-images.js?minify=false&ver=54eb31dc971b63b49278
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 9e65fb5b0032593b7b8fb12b27a01c3c2cefe7e0e231816ee2c8dda3a4355dd8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Tue, 30 May 2023 20:46:50 GMT
server: Nginx
etag: W/"647660ba-939"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 widget.min.js Show response
blcd.online/wp-content/themes/amy-movie/js/vendor/ 7 KB
3 KB 216ms
203ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/themes/amy-movie/js/vendor/widget.min.js?ver=1.11.4
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 52d96b283621d0c4de3d56fc4ee1b4892a0aa3b4b33778b3758e10069ef038d5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Mon, 15 Feb 2021 10:02:00 GMT
server: Nginx
etag: W/"602a4698-1b0b"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 slick.min.js Show response
blcd.online/wp-content/themes/amy-movie/js/vendor/ 85 KB
15 KB 217ms
204ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/themes/amy-movie/js/vendor/slick.min.js?ver=1.6.0
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 0979b54eb3095f1320bc5c02f1c8b085932389e9f51aba42f20f5b9a580d0429

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Mon, 15 Feb 2021 10:01:58 GMT
server: Nginx
etag: W/"602a4696-1558b"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 isotope.pkgd.js Show response
blcd.online/wp-content/themes/amy-movie/js/vendor/ 90 KB
22 KB 221ms
208ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/themes/amy-movie/js/vendor/isotope.pkgd.js?ver=3.0.1
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 593a08b1d11451eabc7edbd4d304e31be5872d0ff4bdfac501b66138201c09d5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Mon, 15 Feb 2021 10:01:55 GMT
server: Nginx
etag: W/"602a4693-16617"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 masonry-horizontal.js Show response
blcd.online/wp-content/themes/amy-movie/js/vendor/ 4 KB
2 KB 224ms
211ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/themes/amy-movie/js/vendor/masonry-horizontal.js?ver=2.0.0
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 107041c54b5502c730d03411a892ab7acd32bbb00ba27086ec6f7b156db64924

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Mon, 15 Feb 2021 10:01:57 GMT
server: Nginx
etag: W/"602a4695-1119"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 kinetic.js Show response
blcd.online/wp-content/themes/amy-movie/js/vendor/ 14 KB
4 KB 225ms
212ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/themes/amy-movie/js/vendor/kinetic.js?ver=2.0.1
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 90a71e9b70381e4e0d8c14ea50207cfe37b5e464bb67d673a7d0d9cad4ca8923

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Mon, 15 Feb 2021 10:01:56 GMT
server: Nginx
etag: W/"602a4694-374c"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 smoothdivscroll.js Show response
blcd.online/wp-content/themes/amy-movie/js/vendor/ 50 KB
10 KB 226ms
213ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/themes/amy-movie/js/vendor/smoothdivscroll.js?ver=1.3
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: b0d02937dbf6d8e91653a55e9b529645c6549f53b14172cf27678cea7751062a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Mon, 15 Feb 2021 10:01:59 GMT
server: Nginx
etag: W/"602a4697-c6c3"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 jquery.mousewheel.min.js Show response
blcd.online/wp-content/themes/amy-movie/js/vendor/ 3 KB
1 KB 226ms
214ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/themes/amy-movie/js/vendor/jquery.mousewheel.min.js?ver=3.1.11
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 1eec19b60e4d841838a41ff32165cc5a78c37886435b51e7f896ac33e3a7b20d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Mon, 15 Feb 2021 10:01:56 GMT
server: Nginx
etag: W/"602a4694-ab8"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 core.min.js Show response
c0.wp.com/c/6.0.5/wp-includes/js/jquery/ui/ 20 KB
7 KB 99ms
28ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.0.5/wp-includes/js/jquery/ui/core.min.js

Requested by

Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

240b702419d6c39ecc4896f0132ccfc9bc517e9aef0c782d99580e0c678b47d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nc: HIT jfk 1
date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Fri, 08 Apr 2022 20:07:18 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Fri, 28 Jun 2024 10:20:26 GMT

GET
H2 200 datepicker.min.js Show response
c0.wp.com/c/6.0.5/wp-includes/js/jquery/ui/ 36 KB
10 KB 99ms
28ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.0.5/wp-includes/js/jquery/ui/datepicker.min.js

Requested by

Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

2e65f5c3b3b4c402074c19dee3d24d6bc02a8a86b19c8c992a4a6e78b254b2cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nc: HIT jfk 1
date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Fri, 08 Apr 2022 20:07:18 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Fri, 28 Jun 2024 10:20:26 GMT

GET
H2 200 bootstrap-tab.js Show response
blcd.online/wp-content/themes/amy-movie/js/vendor/ 4 KB
2 KB 227ms
215ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/themes/amy-movie/js/vendor/bootstrap-tab.js?ver=3.3.6
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: faa0b0e2ee39402fa2bf6942ef83eb1bc4f92cefc7726c0668a46024938a3f0d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Mon, 15 Feb 2021 10:01:54 GMT
server: Nginx
etag: W/"602a4692-fdc"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 imagesloaded.min.js Show response
c0.wp.com/c/6.0.5/wp-includes/js/ 5 KB
2 KB 66ms
64ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.0.5/wp-includes/js/imagesloaded.min.js

Requested by

Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nc: HIT jfk 1
date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Sat, 13 Jun 2020 18:53:27 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Fri, 28 Jun 2024 10:20:26 GMT

GET
H2 200 tooltipster.bundle.js Show response
blcd.online/wp-content/themes/amy-movie/js/vendor/ 121 KB
31 KB 227ms
215ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/themes/amy-movie/js/vendor/tooltipster.bundle.js?ver=1.0.0
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 3be7cad858cdef4952d0ddf9d6986fdbab6c736251dda1fb4e4c6a67fbff28f7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Mon, 15 Feb 2021 10:01:59 GMT
server: Nginx
etag: W/"602a4697-1e48a"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 jquery.waterwheelCarousel.js Show response
blcd.online/wp-content/themes/amy-movie/js/vendor/ 25 KB
7 KB 229ms
217ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/themes/amy-movie/js/vendor/jquery.waterwheelCarousel.js?ver=2.3.0
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 7ba3de98b3a77ffce73c1d8190326add72270614f199dbf11be749fbd61f42c8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Mon, 15 Feb 2021 10:01:56 GMT
server: Nginx
etag: W/"602a4694-65d0"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 TweenMax.min.js Show response
blcd.online/wp-content/themes/amy-movie/js/vendor/ 100 KB
34 KB 229ms
218ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/themes/amy-movie/js/vendor/TweenMax.min.js?ver=1.15.1
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 411419f8049366d9a4ca8a028c5c692e7204b0f7b6d0e0b6bdec2f072d4938e5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Mon, 15 Feb 2021 10:02:00 GMT
server: Nginx
etag: W/"602a4698-18e9c"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 jquery.mCustomScrollbar.js Show response
blcd.online/wp-content/themes/amy-movie/js/vendor/ 93 KB
22 KB 231ms
220ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/themes/amy-movie/js/vendor/jquery.mCustomScrollbar.js?ver=3.1.5
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 72f572c5dd07fac37e4163060402399196415573f52a70526f0e8a848bf1cff3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Mon, 15 Feb 2021 10:01:56 GMT
server: Nginx
etag: W/"602a4694-174ae"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 plyr.js Show response
blcd.online/wp-content/themes/amy-movie/js/vendor/ 262 KB
54 KB 232ms
221ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/themes/amy-movie/js/vendor/plyr.js?ver=1.0.0
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: c71333522736bbe9bc7aaf59b478a3afe1723fd709fa28954f121531f17ee984

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Mon, 15 Feb 2021 10:01:57 GMT
server: Nginx
etag: W/"602a4695-419e4"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 reflection.js Show response
blcd.online/wp-content/themes/amy-movie/js/vendor/ 2 KB
1 KB 235ms
224ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/themes/amy-movie/js/vendor/reflection.js?ver=1.11.0
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: b2fee1233d519bd0f709caa28ce6aec8d6720b6573d1717ffad6ced98d2b7d67

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Mon, 15 Feb 2021 10:01:58 GMT
server: Nginx
etag: W/"602a4696-736"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 script.js Show response
blcd.online/wp-content/themes/amy-movie/js/ 23 KB
6 KB 236ms
226ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/themes/amy-movie/js/script.js?ver=1.0.0
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 663b0ff9a2a9e499939458037a5092159905f8ca82b3fffe7d5604e4d0843820

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Mon, 15 Feb 2021 09:20:28 GMT
server: Nginx
etag: W/"602a3cdc-5a44"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 smush-lazy-load.min.js Show response
blcd.online/wp-content/plugins/wp-smushit/app/assets/js/ 8 KB
4 KB 237ms
227ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/wp-smushit/app/assets/js/smush-lazy-load.min.js?ver=3.13.1
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: f65784e5e7332dc1e4bbeacbec70fdeef4a1bea84f16ce2ee144999719d195ce

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:08:48 GMT
server: Nginx
etag: W/"64920750-1ef2"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 163ms
63ms Script
application/javascript 2606:4700::6812:d73b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=6.0.5

Requested by

Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

74475967bdd27d1efa3e20fd636afe5bb0c391494f9fa5768856bb25af4690d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
etag: W/"2ae26a107abd543e72c24128b019bed7"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 7ded6fd7fe22d14f-BUF
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400
expires: Sun, 02 Jul 2023 10:20:26 GMT

GET
H2 200 jquery.smartmenus.min.js Show response
blcd.online/wp-content/plugins/elementor-pro/assets/lib/smartmenus/ 25 KB
7 KB 238ms
228ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.min.js?ver=1.0.1
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 533e264cc615ee4601da8d2c1dee4a8987319e53d4d7162272f067fbbf250020

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Tue, 14 Jun 2022 07:57:12 GMT
server: Nginx
etag: W/"62a83f58-6272"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 video.min.js Show response
blcd.online/wp-content/plugins/video-embed-thumbnail-generator/video-js/v5/ 246 KB
54 KB 239ms
229ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/video-embed-thumbnail-generator/video-js/v5/video.min.js?ver=5.20.5
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 0f4416798107d561cbed150d09e37a5cd107c87cd4863e50464b5f26f03ecfd4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:00 GMT
server: Nginx
etag: W/"6492075c-3d6c9"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 videopack.js Show response
blcd.online/wp-content/plugins/video-embed-thumbnail-generator/src/public/js/ 40 KB
9 KB 241ms
231ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/video-embed-thumbnail-generator/src/public/js/videopack.js?ver=4.8.10
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 7dd293348d6b237b7f703841ca2b09a86a5072c8ddf40e95e7945e56be877cca

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Tue, 20 Jun 2023 20:09:00 GMT
server: Nginx
etag: W/"6492075c-9e08"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 webpack.runtime.min.js Show response
blcd.online/wp-content/plugins/elementor/assets/js/ 5 KB
2 KB 242ms
233ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.6.8
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 08c70fae8c5a06e27f90b3b8bac23c07318fe3ead7cebd2a7ac2e56a7a6c00e0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Sat, 06 Aug 2022 06:15:49 GMT
server: Nginx
etag: W/"62ee0715-135d"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 frontend-modules.min.js Show response
blcd.online/wp-content/plugins/elementor/assets/js/ 32 KB
11 KB 243ms
234ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.6.8
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: dcf3add9ee30897e196931db9947cd4fa29f8b9244b49938f1590ed6fabe4002

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Sat, 06 Aug 2022 06:15:49 GMT
server: Nginx
etag: W/"62ee0715-7f61"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 jquery.sticky.min.js Show response
blcd.online/wp-content/plugins/elementor-pro/assets/lib/sticky/ 6 KB
2 KB 244ms
235ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js?ver=3.0.9
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: a48dea362116d7516a2cf97066a32758d353760ee02dbf900ddff86b02a16473

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Tue, 14 Jun 2022 07:57:12 GMT
server: Nginx
etag: W/"62a83f58-19c3"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 frontend.min.js Show response
blcd.online/wp-content/plugins/elementor-pro/assets/js/ 184 KB
47 KB 245ms
236ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.0.9
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 5a6217137430616363bc2a7917d1ebfda0a6fe2bb0b33b7eb0443367a9009c77

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Tue, 14 Jun 2022 07:57:12 GMT
server: Nginx
etag: W/"62a83f58-2e01b"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 waypoints.min.js Show response
blcd.online/wp-content/plugins/elementor/assets/lib/waypoints/ 12 KB
3 KB 247ms
238ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.2
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 214674cc77aba35ab3567b88e2739fd08e8e96c61d279559ad61874069683ea0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Sat, 06 Aug 2022 06:15:49 GMT
server: Nginx
etag: W/"62ee0715-2fa6"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 swiper.min.js Show response
blcd.online/wp-content/plugins/elementor/assets/lib/swiper/ 136 KB
35 KB 247ms
239ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=5.3.6
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: b23f49f504faa32aac548b6662ffd64412f6738496fab8be38da46c5b7121804

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Sat, 06 Aug 2022 06:15:49 GMT
server: Nginx
etag: W/"62ee0715-21f91"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 share-link.min.js Show response
blcd.online/wp-content/plugins/elementor/assets/lib/share-link/ 3 KB
1 KB 290ms
282ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.6.8
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 4a7ee62eb33f3bbb66c2151e5cac6bf4904e28302efc36128f3e3ccae6fde580

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Sat, 06 Aug 2022 06:15:49 GMT
server: Nginx
etag: W/"62ee0715-a12"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 dialog.min.js Show response
blcd.online/wp-content/plugins/elementor/assets/lib/dialog/ 10 KB
4 KB 292ms
284ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.9.0
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: b936db5880aa9b6b2f26a8d32fc2b689fb75f69d971b94194f16dba801221ffe

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Sat, 06 Aug 2022 06:15:49 GMT
server: Nginx
etag: W/"62ee0715-29ba"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 frontend.min.js Show response
blcd.online/wp-content/plugins/elementor/assets/js/ 40 KB
12 KB 294ms
286ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.6.8
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 37209a2b751204dc01191986b6ef47f27463285de8a341729c514d70a19a90fe

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Sat, 06 Aug 2022 06:15:49 GMT
server: Nginx
etag: W/"62ee0715-9e1d"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 preloaded-modules.min.js Show response
blcd.online/wp-content/plugins/elementor/assets/js/ 42 KB
13 KB 307ms
299ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor/assets/js/preloaded-modules.min.js?ver=3.6.8
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 7eff8a4d2f5a29458fcd0011369e968d11034606827eba00149982d1a3b67c60

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Sat, 06 Aug 2022 06:15:49 GMT
server: Nginx
etag: W/"62ee0715-a880"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 e-202325.js Show response
stats.wp.com/ 13 KB
4 KB 99ms
25ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202325.js
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ab8517f3d5171dd42a8b9c22af6a2f944b41d00e7ea54ba02b4ed71a6c59e543

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nc: HIT jfk
date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: br
last-modified: Fri, 19 May 2023 02:56:22 GMT
server: nginx
etag: W/"6466e556-3508"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Mon, 17 Jun 2024 04:02:18 GMT

GET
H2 200 lazyload.min.js Show response
blcd.online/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/ 8 KB
3 KB 308ms
301ms Script
application/javascript 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/lazyload.min.js
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
last-modified: Tue, 05 Jul 2022 14:38:18 GMT
server: Nginx
etag: W/"62c44cda-2063"
x-powered-by: DLEMP
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
DATA 200
OK truncated
/ 67 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 14b6d4839fa23148afe5471f8455e91f45acee7c8f7dffa933f0c17e28c4d3e9

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 star.png
blcd.online/wp-content/themes/amy-movie/images/frontend/ 1 KB
2 KB 294ms
294ms Image
image/png 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blcd.online/wp-content/themes/amy-movie/images/frontend/star.png
Requested by: Host: blcd.online
URL: https://blcd.online/wp-content/cache/min/1/wp-content/themes/amy-movie/css/style.css?ver=1687291791
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 157304f608868da5bb20f215a4697d4a0334aa9fe36448590c2c52982eaefa04

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/wp-content/cache/min/1/wp-content/themes/amy-movie/css/style.css?ver=1687291791
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
last-modified: Mon, 15 Feb 2021 10:01:16 GMT
server: Nginx
etag: "602a466c-554"
x-powered-by: DLEMP
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 1364
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
DATA 200
OK truncated
/ 380 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 717f6bb5f6cc69c444f54376a72dee0ca7968b2a12e7c9475247ec85c0e75a53

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 wXKuE3kQtZQ4pF3D7-P5FeMKmA.woff2
fonts.gstatic.com/s/arsenal/v12/ 18 KB
18 KB 96ms
33ms Font
font/woff2 2607:f8b0:4006:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/arsenal/v12/wXKuE3kQtZQ4pF3D7-P5FeMKmA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CArsenal%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.0.5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2003 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d44f1f58c468d36116ea4c18f67923c2d879a0af6acde7a089acab6de347b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blcd.online
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 07:54:28 GMT
x-content-type-options: nosniff
age: 95158
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18188
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 18:15:04 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jun 2024 07:54:28 GMT

GET
H2 200 fontawesome-webfont.woff2
blcd.online/wp-content/plugins/elementor/assets/lib/font-awesome/fonts/ 75 KB
76 KB 285ms
282ms Font
font/woff2 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor/assets/lib/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: blcd.online
URL: https://blcd.online/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/font-awesome.min.css?ver=1687291791
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer: https://blcd.online/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/font-awesome.min.css?ver=1687291791
Origin: https://blcd.online
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
web-cache-location: /wp-content/cache/allnull/wp-content/plugins/elementor/assets/lib/font-awesome/fonts/fontawesome-webfont.woff2index.html
last-modified: Sat, 06 Aug 2022 06:15:49 GMT
server: Nginx
etag: "62ee0715-12d68"
x-powered-by: DLEMP
content-type: font/woff2
accept-ranges: bytes
content-length: 77160

GET
H2 200 pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 114ms
51ms Font
font/woff2 2607:f8b0:4006:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3A400%7CRoboto+Condensed%3A700%2C400&ver=6.0.5#038;subset=latin

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2003 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blcd.online
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:13:29 GMT
x-content-type-options: nosniff
age: 547617
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7884
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 17:03:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 22 Jun 2024 02:13:29 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 93ms
31ms Font
font/woff2 2607:f8b0:4006:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2003 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blcd.online
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 24 Jun 2023 16:22:40 GMT
x-content-type-options: nosniff
age: 410266
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 23 Jun 2024 16:22:40 GMT

GET
H2 200 ieVi2ZhZI2eCN5jzbjEETS9weq8-32meGCQYbw.woff2
fonts.gstatic.com/s/robotocondensed/v25/ 15 KB
15 KB 120ms
58ms Font
font/woff2 2607:f8b0:4006:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotocondensed/v25/ieVi2ZhZI2eCN5jzbjEETS9weq8-32meGCQYbw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3A400%7CRoboto+Condensed%3A700%2C400&ver=6.0.5#038;subset=latin

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2003 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e79c1c1a140e6afb861074c70392db54cc65a06050de2a69162ab94eb95b0516

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blcd.online
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 24 Jun 2023 16:01:20 GMT
x-content-type-options: nosniff
age: 411546
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15660
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 18:42:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 23 Jun 2024 16:01:20 GMT

GET
H2 200 fa-brands-400.woff2
blcd.online/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/ 75 KB
75 KB 296ms
295ms Font
font/woff2 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-brands-400.woff2
Requested by: Host: blcd.online
URL: https://blcd.online/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=1687291791
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af

Request headers

Referer: https://blcd.online/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=1687291791
Origin: https://blcd.online
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
web-cache-location: /wp-content/cache/all/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-brands-400.woff2index.html
last-modified: Sat, 06 Aug 2022 06:15:49 GMT
server: Nginx
etag: "62ee0715-12bdc"
x-powered-by: DLEMP
content-type: font/woff2
accept-ranges: bytes
content-length: 76764

GET
H2 206 Hyperventilation-Bonus.mp4
blcd.online/wp-content/uploads/2020/08/ 1 MB
0 272ms
272ms Media
video/mp4 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/uploads/2020/08/Hyperventilation-Bonus.mp4?id=0
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash

Request headers

Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Range: bytes=0-

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
last-modified: Sat, 13 Feb 2021 19:43:24 GMT
server: Nginx
etag: "60282bdc-1b0c3bd"
x-powered-by: DLEMP
content-type: video/mp4
Content-Range: bytes 0-28361660/28361661
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
Content-Length: 28361661
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
DATA 200
OK truncated
/ 547 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eb14baeac955bb11e33cd7fd3fd2f698cf20db1b450325f45ea843b6cdc82366

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 552 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 62f3f809487194fcc55a3ebd88811a604ae496027bb425d4ebd15d9ae1921945

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 177 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d692a67352a3dfa80010c86a62761cfff05c0b1086618106a8576cc45a6a8115

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 351 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 145287b36883dd3061ca7aa9229a8fa9ace2cccd50e0382b4b6201f3916b57c5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 242 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1f4513a435d6a3047d20a50c1e7d4263de42146c74be227f774b5e82e6357e75

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 fa-solid-900.woff2
blcd.online/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/ 76 KB
77 KB 250ms
243ms Font
font/woff2 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-solid-900.woff2
Requested by: Host: blcd.online
URL: https://blcd.online/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=1687291791
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef

Request headers

Referer: https://blcd.online/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=1687291791
Origin: https://blcd.online
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
web-cache-location: /wp-content/cache/all/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-solid-900.woff2index.html
last-modified: Sat, 06 Aug 2022 06:15:49 GMT
server: Nginx
etag: "62ee0715-13174"
x-powered-by: DLEMP
content-type: font/woff2
accept-ranges: bytes
content-length: 78196

GET
H2 200 / Show response
blcd.online/mcd/hyperventilation-bonus-part/ 1 KB
798 B 662ms
659ms XHR
application/json 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL

https://blcd.online/mcd/hyperventilation-bonus-part/?relatedposts=1

Requested by

Host: c0.wp.com
URL: https://c0.wp.com/p/jetpack/11.2.1/_inc/build/related-posts/related-posts.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),

Reverse DNS

Software

Nginx / DLEMP

Resource Hash

94329f59f0c55742b151c087b44b879bcfe26b053ac12487e4cd2e3cddcb49dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
x-requested-with: XMLHttpRequest
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jun 2023 10:20:26 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff, nosniff
content-encoding: gzip
server: Nginx
x-powered-by: DLEMP
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: no-store, no-cache, must-revalidate
x-xss-protection: 1; mode=block
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 284 KB
68 KB 51ms
50ms Script
application/javascript 2606:4700::6812:d73b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151602

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=6.0.5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ed7f43d675c0d203d845162c122fd2a7ec79093655370e9ce24e9408c80227a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 3161
etag: W/"153f1c4acb6a72d6e5def93aaa717bee"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 7ded6fd89e2cd14f-BUF
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400
expires: Sun, 02 Jul 2023 10:20:26 GMT

GET
H2 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306200101/ 345 KB
119 KB 63ms
62ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306200101/show_ads_impl_fy2021.js?bust=31075534

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d94580297c7bf41c7965a7e358f14690c2aababa4ac6d8a587c1c844f2a57b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 121284
x-xss-protection: 0
server: cafe
etag: 14500705108829613190
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Jun 2023 10:20:26 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20230626/r20190131/ Frame 03F3 10 KB
0 98ms
26ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230626/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blcd.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 45333
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4540
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 28 Jun 2023 21:44:53 GMT
etag: 15057649708203361565
expires: Wed, 12 Jul 2023 21:44:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 90ms
29ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: blcd.online
URL: https://blcd.online/wp-content/plugins/amy-user/assets/js/script.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

012379c0906bea273fc92255e24ddea4ef8d10f088686ca40658de94b2cd4822

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 29 Jun 2023 10:20:26 GMT
content-md5: EyNSxk0BVBhassWCHGEAQA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1688
x-fb-debug: LGnH7NgDvQNX3FXQ0buEorMx187RsMYEIOKIOe1fZSKCXHZHpx17UCEH0zAywVVk9m6LArASAZqx5Q3LK7L6CA==
x-fb-content-md5: 760e74953509da978f4d08b999812c74
cross-origin-opener-policy: same-origin-allow-popups
etag: "1a8301c65b2306b8f53be6e0b6c48308"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Thu, 29 Jun 2023 10:26:53 GMT

GET
H2 200 client.js Show response
apis.google.com/js/ 18 KB
7 KB 118ms
43ms Script
text/javascript 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/client.js?onload=onLoadCallback

Requested by

Host: blcd.online
URL: https://blcd.online/wp-content/plugins/amy-user/assets/js/script.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a66116f1637a4fba274c36d309f8148b680c0a9efa7f8e2b8900e85281e3374

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 29 Jun 2023 10:20:26 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7118
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
etag: "313ca5203c7d323f"
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Jun 2023 10:20:26 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
93 B 39ms
26ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A11.2.1&blog=161760725&post=4517&tz=7&srv=blcd.online&host=blcd.online&ref=https%3A%2F%2Fdisq.us%2F&fcp=879&rand=0.18178143127226676
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 29 Jun 2023 10:20:26 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230626/r20190131/ Frame 64B2 10 KB
4 KB 26ms
24ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230626/r20190131/zrt_lookup.html

Requested by

Host: c0.wp.com
URL: https://c0.wp.com/c/6.0.5/wp-includes/js/jquery/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blcd.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 45333
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4540
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 28 Jun 2023 21:44:53 GMT
etag: 15057649708203361565
expires: Wed, 12 Jul 2023 21:44:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 eicons.woff2
blcd.online/wp-content/plugins/elementor/assets/lib/eicons/fonts/ 90 KB
91 KB 220ms
220ms Font
font/woff2 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://blcd.online/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff2?5.15.0
Requested by: Host: blcd.online
URL: https://blcd.online/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=1687291791
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 1525cd3ea05d1c00e4b385e781749c3bac5c01570b5800198bec0a252bb6c715

Request headers

Referer: https://blcd.online/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=1687291791
Origin: https://blcd.online
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
web-cache-location: /wp-content/cache/allnull/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff2index.html
last-modified: Sat, 06 Aug 2022 06:15:49 GMT
server: Nginx
etag: "62ee0715-1691c"
x-powered-by: DLEMP
content-type: font/woff2
accept-ranges: bytes
content-length: 92444

GET
H2 200 hyper3.png
i0.wp.com/blcd.online/wp-content/uploads/2019/05/ 13 KB
13 KB 92ms
24ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/blcd.online/wp-content/uploads/2019/05/hyper3.png?resize=150%2C150&ssl=1

Requested by

Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

968e4945d984f99ee08b9c3123dccd72e20321f7e52a39b98c38f1015c66a14c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nc: HIT jfk 3
date: Thu, 29 Jun 2023 10:20:26 GMT
x-content-type-options: nosniff
last-modified: Sat, 24 Jun 2023 20:50:49 GMT
server: nginx
etag: "adee332ab5f1e04f"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://blcd.online/wp-content/uploads/2019/05/hyper3.png>; rel="canonical"
content-length: 13194
expires: Tue, 24 Jun 2025 08:50:49 GMT

GET
H2 200 datte-maou-vol-3.jpg
i0.wp.com/blcd.online/wp-content/uploads/2020/12/ 7 KB
7 KB 116ms
49ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/blcd.online/wp-content/uploads/2020/12/datte-maou-vol-3.jpg?resize=150%2C150&ssl=1

Requested by

Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

b25f00dd162a5ef618615e786b59911f421a03250f59515d248b033b17c6e989

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nc: HIT jfk 3
date: Thu, 29 Jun 2023 10:20:26 GMT
x-content-type-options: nosniff
last-modified: Fri, 23 Jun 2023 00:35:38 GMT
server: nginx
etag: "9595e9c5015d2451"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://blcd.online/wp-content/uploads/2020/12/datte-maou-vol-3.jpg>; rel="canonical"
content-length: 6894
expires: Sun, 22 Jun 2025 12:35:38 GMT

GET
H2 200 yuutsu-2.jpg
i0.wp.com/blcd.online/wp-content/uploads/2019/09/ 7 KB
7 KB 121ms
55ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/blcd.online/wp-content/uploads/2019/09/yuutsu-2.jpg?resize=150%2C150&ssl=1

Requested by

Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

850f5ebb46512bfb518168645aa3ede7adb0b3edd6e61e94bd68b9f7573441c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nc: HIT jfk 3
date: Thu, 29 Jun 2023 10:20:26 GMT
x-content-type-options: nosniff
last-modified: Fri, 23 Jun 2023 01:02:12 GMT
server: nginx
etag: "9a8bc48d82cef019"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://blcd.online/wp-content/uploads/2019/09/yuutsu-2.jpg>; rel="canonical"
content-length: 6730
expires: Sun, 22 Jun 2025 13:02:12 GMT

GET
H2 200 hidamari-ga-kikoeru-cover.jpg
i0.wp.com/blcd.online/wp-content/uploads/2019/06/ 7 KB
7 KB 125ms
59ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/blcd.online/wp-content/uploads/2019/06/hidamari-ga-kikoeru-cover.jpg?resize=150%2C150&ssl=1

Requested by

Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

0fb82bf5e41c73f853f681c65cc12ee22b7920c79d3fadc01018a66975641763

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nc: HIT jfk 3
date: Thu, 29 Jun 2023 10:20:26 GMT
x-content-type-options: nosniff
last-modified: Thu, 22 Jun 2023 01:02:56 GMT
server: nginx
etag: "8ac16a5b7c471149"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://blcd.online/wp-content/uploads/2019/06/hidamari-ga-kikoeru-cover.jpg>; rel="canonical"
content-length: 7482
expires: Sat, 21 Jun 2025 13:02:56 GMT

GET
H2 200 given3.jpg
i0.wp.com/blcd.online/wp-content/uploads/2019/12/ 7 KB
7 KB 131ms
65ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/blcd.online/wp-content/uploads/2019/12/given3.jpg?resize=150%2C150&ssl=1

Requested by

Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

6b6c48b08536d1f27dbdfdd79664ddacaaf53071afb259eaef27396bddfab9de

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nc: HIT jfk 1
date: Thu, 29 Jun 2023 10:20:26 GMT
x-content-type-options: nosniff
last-modified: Fri, 19 May 2023 17:16:26 GMT
server: nginx
etag: "24ace55214352b0d"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://blcd.online/wp-content/uploads/2019/12/given3.jpg>; rel="canonical"
content-length: 7198
expires: Mon, 19 May 2025 05:16:26 GMT

GET
H2 200 blcdonlinelogo2.png
blcd.online/wp-content/uploads/2020/08/ 57 KB
57 KB 194ms
193ms Image
image/png 149.3.170.106
IPCONNECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blcd.online/wp-content/uploads/2020/08/blcdonlinelogo2.png
Requested by: Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.3.170.106 , Seychelles, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: Nginx / DLEMP
Resource Hash: 8ae5c399df27d869c39e5eca75301e37fe70a1bd732bea5daf28f901e2485b52

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/mcd/hyperventilation-bonus-part/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
last-modified: Sat, 13 Feb 2021 19:44:18 GMT
server: Nginx
etag: "60282c12-e28a"
x-powered-by: DLEMP
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 57994
expires: Sat, 29 Jul 2023 10:20:26 GMT

GET
H2 200 web Show response
onesignal.com/api/v1/sync/d3c52460-a711-4ac7-846a-a7c8f5d2e6a3/ 3 KB
2 KB 216ms
192ms Script
text/javascript 2606:4700::6812:d73b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/sync/d3c52460-a711-4ac7-846a-a7c8f5d2e6a3/web?callback=__jp0

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151602

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

52ba8c353e1078183d18878c6e6c3d0cc8866b1672a50664b73a919a3ced7453

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: EXPIRED
content-encoding: br
x-permitted-cross-domain-policies: none
strict-transport-security: max-age=15552000; includeSubDomains
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 9b06cae6-0f9d-43eb-a49d-83f187294c99
x-runtime: 0.037276
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"52ba8c353e1078183d18878c6e6c3d0c"
x-download-options: noopen
vary: Origin, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600
cf-ray: 7ded6fdbde5bd14f-BUF
access-control-allow-headers: SDK-Version
expires: Thu, 29 Jun 2023 11:20:27 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 389 B
602 B 136ms
38ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=blcd.online&callback=_gfp_s_&client=ca-pub-6685813834444181

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306200101/show_ads_impl_fy2021.js?bust=31075534

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9d3460309805dade180877fa55c33f82ee4b285c61e74b76c0a921d069b99d84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 251
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 108ms
48ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=blcd.online

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306200101/show_ads_impl_fy2021.js?bust=31075534

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame CE95 30 KB
12 KB 200ms
198ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6685813834444181&output=html&h=280&slotname=1338356656&adk=1817563164&adf=1156528132&pi=t.ma~as.1338356656&w=350&fwrn=4&fwrnh=100&lmt=1687308604&rafmt=1&format=350x280&url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688034026382&bpp=7&bdt=696&idt=450&shv=r20230626&mjsv=m202306200101&ptt=9&saldr=aa&abxe=1&correlator=6844923129764&frm=20&pv=2&ga_vid=1490640896.1688034027&ga_sid=1688034027&ga_hid=525232461&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1020&ady=126&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31075534%2C42532264%2C44788442%2C44795921%2C44769661&oid=2&pvsid=2230865784680428&tmod=1842262037&uas=0&nvt=1&ref=https%3A%2F%2Fdisq.us%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=AEqw6RsLqk&p=https%3A//blcd.online&dtd=483

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306200101/show_ads_impl_fy2021.js?bust=31075534

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ffbb05d9cacf3e2feefa3fed33523d3c796b7693153a93759f3dfcdf7b20cc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blcd.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 12259
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 29 Jun 2023 10:20:27 GMT
expires: Thu, 29 Jun 2023 10:20:27 GMT
observe-browsing-topics: true
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3829 30 KB
12 KB 164ms
161ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6685813834444181&output=html&h=280&slotname=1338356656&adk=1817563164&adf=1975471561&pi=t.ma~as.1338356656&w=350&fwrn=4&fwrnh=100&lmt=1687308604&rafmt=1&format=350x280&url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688034026389&bpp=2&bdt=704&idt=523&shv=r20230626&mjsv=m202306200101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280&correlator=6844923129764&frm=20&pv=1&ga_vid=1490640896.1688034027&ga_sid=1688034027&ga_hid=525232461&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1020&ady=1172&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31075534%2C42532264%2C44788442%2C44795921%2C44769661&oid=2&pvsid=2230865784680428&tmod=1842262037&uas=0&nvt=1&ref=https%3A%2F%2Fdisq.us%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=34suEQOwjq&p=https%3A//blcd.online&dtd=544

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306200101/show_ads_impl_fy2021.js?bust=31075534

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

91ed5e638a805dedd2b3682c9b14bb3b171b2be0eed4a4c2b3c4a0ad3c8986d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blcd.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 12289
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 29 Jun 2023 10:20:27 GMT
expires: Thu, 29 Jun 2023 10:20:27 GMT
observe-browsing-topics: true
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 301 KB
85 KB 63ms
31ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=5f77464589bc6cc15dc5e49a846f5033

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b49fd50e1ff72619f9ff0a0ffce60108a8387e928adaa8cf02de5b0f86c7cc7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://blcd.online/
Origin: https://blcd.online
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 29 Jun 2023 10:20:27 GMT
content-md5: M8jHgDTVREB2+Y2t94EGoA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 87283
x-fb-debug: mKVZ2IP37/4QZnX5ewRtfWxBK/WWQm2Aa0CqKziPYzrgbdtn2TwNlzCpspqrYyM2FSnchIe3zhGxZhpV05g4dw==
x-fb-content-md5: bb087ec9dd1da40958c1b3cd2df2763a
cross-origin-opener-policy: same-origin-allow-popups
etag: "f5766d3c211cc251bab024a3337e5a46"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
priority: u=3,i
expires: Fri, 28 Jun 2024 08:52:14 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame D7D2 171 KB
26 KB 439ms
433ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6685813834444181&output=html&adk=1812271804&adf=3025194257&lmt=1687308604&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=212x945_l%7C212x945_r&format=0x0&url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688034026412&bpp=4&bdt=727&idt=562&shv=r20230626&mjsv=m202306200101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280%2C350x280&nras=1&correlator=6844923129764&frm=20&pv=1&ga_vid=1490640896.1688034027&ga_sid=1688034027&ga_hid=525232461&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31075534%2C42532264%2C44788442%2C44795921%2C44769661&oid=2&pvsid=2230865784680428&tmod=1842262037&uas=0&nvt=1&fsapi=1&ref=https%3A%2F%2Fdisq.us%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=3&uci=a!3&fsb=1&dtd=598

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306200101/show_ads_impl_fy2021.js?bust=31075534

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e6901ce2fc7a606f61b9c9763083228c459744f202148340680c861d15040b68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blcd.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 26622
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 29 Jun 2023 10:20:27 GMT
expires: Thu, 29 Jun 2023 10:20:27 GMT
observe-browsing-topics: true
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.5o5-TAFr18s.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_qgszOsFrBH7bZ1Rmfwa9Mc03wLQ/ 317 KB
109 KB 40ms
38ms Script
text/javascript 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.5o5-TAFr18s.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_qgszOsFrBH7bZ1Rmfwa9Mc03wLQ/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/client.js?onload=onLoadCallback

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d581ac17f4a552b7cbc6abe540df649d5dafe7ba9551a1820127daf6bd02232

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sun, 25 Jun 2023 16:36:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 323056
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 110695
x-xss-protection: 0
last-modified: Tue, 06 Jun 2023 15:25:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 24 Jun 2024 16:36:11 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/ Frame CE95 3 KB
1 KB 108ms
35ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6685813834444181&output=html&h=280&slotname=1338356656&adk=1817563164&adf=1156528132&pi=t.ma~as.1338356656&w=350&fwrn=4&fwrnh=100&lmt=1687308604&rafmt=1&format=350x280&url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688034026382&bpp=7&bdt=696&idt=450&shv=r20230626&mjsv=m202306200101&ptt=9&saldr=aa&abxe=1&correlator=6844923129764&frm=20&pv=2&ga_vid=1490640896.1688034027&ga_sid=1688034027&ga_hid=525232461&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1020&ady=126&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31075534%2C42532264%2C44788442%2C44795921%2C44769661&oid=2&pvsid=2230865784680428&tmod=1842262037&uas=0&nvt=1&ref=https%3A%2F%2Fdisq.us%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=AEqw6RsLqk&p=https%3A//blcd.online&dtd=483

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 20:27:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49993
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 12 Jul 2023 20:27:14 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/ Frame CE95 20 KB
9 KB 97ms
25ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4a038eb56ed2eb8fb4701ef93757a4d42a433508714b8a11b426e6a9ac3f350

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 20:27:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49993
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8312
x-xss-protection: 0
server: cafe
etag: 8395464388031192745
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 12 Jul 2023 20:27:14 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame CE95 179 KB
57 KB 150ms
74ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6914d47718a28ab8055edac273b3aff57e64e5bddccc616c2b7e355fe986f39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57260
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1687952195399670"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Jun 2023 10:20:27 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/ Frame 3829 3 KB
1 KB 60ms
34ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6685813834444181&output=html&h=280&slotname=1338356656&adk=1817563164&adf=1975471561&pi=t.ma~as.1338356656&w=350&fwrn=4&fwrnh=100&lmt=1687308604&rafmt=1&format=350x280&url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688034026389&bpp=2&bdt=704&idt=523&shv=r20230626&mjsv=m202306200101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280&correlator=6844923129764&frm=20&pv=1&ga_vid=1490640896.1688034027&ga_sid=1688034027&ga_hid=525232461&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1020&ady=1172&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31075534%2C42532264%2C44788442%2C44795921%2C44769661&oid=2&pvsid=2230865784680428&tmod=1842262037&uas=0&nvt=1&ref=https%3A%2F%2Fdisq.us%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=34suEQOwjq&p=https%3A//blcd.online&dtd=544

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 20:27:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49993
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 12 Jul 2023 20:27:14 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/ Frame 3829 20 KB
8 KB 55ms
29ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6685813834444181&output=html&h=280&slotname=1338356656&adk=1817563164&adf=1975471561&pi=t.ma~as.1338356656&w=350&fwrn=4&fwrnh=100&lmt=1687308604&rafmt=1&format=350x280&url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688034026389&bpp=2&bdt=704&idt=523&shv=r20230626&mjsv=m202306200101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280&correlator=6844923129764&frm=20&pv=1&ga_vid=1490640896.1688034027&ga_sid=1688034027&ga_hid=525232461&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1020&ady=1172&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31075534%2C42532264%2C44788442%2C44795921%2C44769661&oid=2&pvsid=2230865784680428&tmod=1842262037&uas=0&nvt=1&ref=https%3A%2F%2Fdisq.us%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=34suEQOwjq&p=https%3A//blcd.online&dtd=544

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4a038eb56ed2eb8fb4701ef93757a4d42a433508714b8a11b426e6a9ac3f350

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 20:27:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49993
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8312
x-xss-protection: 0
server: cafe
etag: 8395464388031192745
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 12 Jul 2023 20:27:14 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3829 179 KB
56 KB 147ms
117ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6685813834444181&output=html&h=280&slotname=1338356656&adk=1817563164&adf=1975471561&pi=t.ma~as.1338356656&w=350&fwrn=4&fwrnh=100&lmt=1687308604&rafmt=1&format=350x280&url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688034026389&bpp=2&bdt=704&idt=523&shv=r20230626&mjsv=m202306200101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280&correlator=6844923129764&frm=20&pv=1&ga_vid=1490640896.1688034027&ga_sid=1688034027&ga_hid=525232461&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1020&ady=1172&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31075534%2C42532264%2C44788442%2C44795921%2C44769661&oid=2&pvsid=2230865784680428&tmod=1842262037&uas=0&nvt=1&ref=https%3A%2F%2Fdisq.us%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=34suEQOwjq&p=https%3A//blcd.online&dtd=544

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6914d47718a28ab8055edac273b3aff57e64e5bddccc616c2b7e355fe986f39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57260
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1687952195399670"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Jun 2023 10:20:27 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame CE95 0
0 54ms
53ms Fetch
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CIlZ_6lqdZNrCN7ifxtYPmLiV2A6cge-wXKqbqap0wI23ARABIABgye6Oi8CkjBCCARdjYS1wdWItNjY4NTgxMzgzNDQ0NDE4McgBCagDAcgDAqoE-wFP0G2XDxedrq4koeK__HSDPGR1fwU07-_1dsRttxNIvmnApQsHUB9sCevEZxuzqFiSweHfVWllgEBIMwcBwyz9aLJKap3C7wlpehq5Y8SdjfvvivGIMwHpR3tmhyPBuJdfXCmtVdNQU_j_8t1VCydMNTb2Lw21Rvz8PfIvS3nYRbOjverBb5bIfdW8kLhYz3SIIEG__i7-p9fk4d1AmB6olgfkCEIlItDHsDi5NMSq2jRMCyQF0maJXi1JqZkEqAKVEXhtNvbnYYAIxBfytLGBoetZWqnmLgF91r4wtEzgGLZJOSANyR8F_Le46gGSmsOhFPJjO_HnhRKWBYAGiKHur8vVqKuEAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTqACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItNjY4NTgxMzgzNDQ0NDE4MRgA&sigh=GGFv6yDLiNM&uach_m=[UACH]&cid=CAQSGwBygQiDZqaK-mdA-0Bjlm3grqc4ZU5D7a8QFRgB

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6685813834444181&output=html&h=280&slotname=1338356656&adk=1817563164&adf=1156528132&pi=t.ma~as.1338356656&w=350&fwrn=4&fwrnh=100&lmt=1687308604&rafmt=1&format=350x280&url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688034026382&bpp=7&bdt=696&idt=450&shv=r20230626&mjsv=m202306200101&ptt=9&saldr=aa&abxe=1&correlator=6844923129764&frm=20&pv=2&ga_vid=1490640896.1688034027&ga_sid=1688034027&ga_hid=525232461&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1020&ady=126&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31075534%2C42532264%2C44788442%2C44795921%2C44769661&oid=2&pvsid=2230865784680428&tmod=1842262037&uas=0&nvt=1&ref=https%3A%2F%2Fdisq.us%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=AEqw6RsLqk&p=https%3A//blcd.online&dtd=483
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 29 Jun 2023 10:20:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 29 Jun 2023 10:20:27 GMT

GET
H2 200 notify
rtb.va.us.criteo.com/google/auction/ Frame CE95 0
0 116ms
42ms Fetch 2620:100:a001::3
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.va.us.criteo.com/google/auction/notify?profile=14&payload=kumHDc36RN4CmALiIp0XAgAAAL2asfGoG_3nsrhsohDqWp1kNnauQaWi87oqSAAAEgAACgpBUVVCQ2dFQkNn&wp=ZJ1a6gAN4VoE0Y-4AAVcGJ-cRpxL5QfEraVkKQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::3 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 228098
server: Kestrel
content-length: 0

GET
H2 200 afr.php Show response
ads.us.criteo.com/delivery/r/ Frame 48E1 161 KB
50 KB 162ms
85ms Document
text/html 2620:100:a001::24
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/afr.php?z=ZJ1a6gAN4VoE0Y-4AAVcGJ-cRpxL5QfEraVkKQ&u=%7CneHBKftYU6zVANl2dmx5sOTxR8b6hJDY9U2ZV54GuBA%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-dbHERHVj9MQgFtTN83TUdVFZz6mvMC78INU6e6727c9TpoF6_Hy_3OA2J3vCm6mYUX1NAdc9l2Sv3kQRyjeS7yaQwRqR7subRek4WsbAF4HzHdhw_QzreC81lxWLXFi_A7kJF6P6Q_tEu2A4C_N1Kneqj1oiWFtxyM3C-qFemum_06o7sFRvaU4xSXPQF-1BBHzm2LVLZPwFFHMxiJiWm1szKwriTPLzAurjGxygExNWxkHa1Z957I_2pQJo-ArvAIlUduLZsgBZofnYacIHgTB64wwc1HfGSjiLXvz28nDITOrIMuE7dTlk-H5CjbA25ucqZbq5y2mNvpA6FuNowqWqWBtvIc2pu7EAjwFanoWBXW9nrNWSDNHiqPCZtkxpRKp5CvqrU6zg9N5eBAbtQzp85I9bO7fTjwRpTTHGhPZaCRDTZVSWjTCgYO1ZqWIIvipRKQcVraGisTki-B8v1xVEDiVvWew9-Tjh5lxCxbznYFZ2RjQOR8-FyZ1ftAQHjFWW7-THZvYL2AIxDgbJ5jvM3HpBNgUXMjaFR0qTOGLfCZJ2TVkyxrKmGcWPmlZN-W3aWRMbE9zb7n9PcAa3jPHEAV1Vipoh&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCDjNh6lqdZNrCN7ifxtYPmLiV2A6cge-wXKqbqap0wI23ARABIABgye6Oi8CkjBCCARdjYS1wdWItNjY4NTgxMzgzNDQ0NDE4McgBCagDAcgDAqoE_gFP0G2XDxedrq4koeK__HSDPGR1fwU07-_1dsRttxNIvmnApQsHUB9sCevEZxuzqFiSweHfVWllgEBIMwcBwyz9aLJKap3C7wlpehq5Y8SdjfvvivGIMwHpR3tmhyPBuJdfXCmtVdNQU_j_8t1VCydMNTb2Lw21Rvz8PfIvS3nYRbOjverBb5bIfdW8kLhYz3SIIEG__i7-p9fk4d1AmB6olgfkCEIlItDHsDi5NMSq2jRMCyQF0maJXi1JqZkEqAKVEXhtNvbnYYAIxBfytLGBoetZWqnmbANdRBXCPUwjkdvF0lqECqg51L6W8sUJabko3Ux9F-lOU4OWxkGMiIAGiKHur8vVqKuEAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1juHiseRGaSvhA2biOiKQlNKxz3w%26client%3Dca-pub-6685813834444181%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::24 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

2cac7b781ab6b399b631ff7cb46eb7d4cd281c0981b5671733c2897b29a53d93

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 29 Jun 2023 10:20:26 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.us.criteo.net/heavyad?cppv=3&cpp=SrUf93Dk_HRver-DPvrJoBTlgqzr_z4wtD1dLxVWPYOBnK2T-48_2IKFYT5hYZYxkRKtFo3yahg7XCxJ0tR5LyuLg5UQavOHsJV0AjnTTcONTKFEUdxC98C5uTAFhwiae0UT_snNV4xoWegAdaBARlXvQDj48PqLPhcOWkxN7h-e76EgWlNpnfrNVuIifnlbntdFFO8wrujBWLceMsU8_B96qleKUbnYk_OTtxTB0SIdaBimEXfBjbzguc1Zx5puMT93yg"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 40489302
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 3829 0
0 62ms
62ms Fetch
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CRjkb6lqdZInwO67tvPIPpMmKqA-cge-wXLKaqap0wI23ARABIABgye6Oi8CkjBCCARdjYS1wdWItNjY4NTgxMzgzNDQ0NDE4McgBCagDAcgDAqoEgQJP0J1RUFC1RFm1pKKFEgwAPSNJ9J3SI8JWIZPGb9ox7Sqbq4504wb-0WlLP5ARlBw3WjvxGi1W8Wu4XZaBNsLFAw0agpmHCy1_0DZDDkDo1LKb62emb7Gld_YDwjFWXrbn4j6eh5tWUkWLJFfazXZ2Hur27I2dy3AR3Wju9YS83t7FSYX-rFmL3WJD65uWQgZh2vC-V56coSq4lMed1UO6Kv4uClTyuNONtUS9ioJSUQICOhXQzr5prpwVAPg8yUXwLwvcK8Y68zIeaWyoSzmCoBWY06cWy3uvZjB9MGiExESPLXjaoHtlKMbDJFjKbKWKlGHtt9bCL_XH4P6X18-JUYAGiKHur8vVqKuEAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTqACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItNjY4NTgxMzgzNDQ0NDE4MRgA&sigh=Qv2NV22ii1c&uach_m=[UACH]&cid=CAQSGwBygQiDE0ETzjnTioI3rcihC2Bde75dn1MjJxgB

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6685813834444181&output=html&h=280&slotname=1338356656&adk=1817563164&adf=1975471561&pi=t.ma~as.1338356656&w=350&fwrn=4&fwrnh=100&lmt=1687308604&rafmt=1&format=350x280&url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688034026389&bpp=2&bdt=704&idt=523&shv=r20230626&mjsv=m202306200101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280&correlator=6844923129764&frm=20&pv=1&ga_vid=1490640896.1688034027&ga_sid=1688034027&ga_hid=525232461&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1020&ady=1172&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31075534%2C42532264%2C44788442%2C44795921%2C44769661&oid=2&pvsid=2230865784680428&tmod=1842262037&uas=0&nvt=1&ref=https%3A%2F%2Fdisq.us%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=34suEQOwjq&p=https%3A//blcd.online&dtd=544

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6685813834444181&output=html&h=280&slotname=1338356656&adk=1817563164&adf=1975471561&pi=t.ma~as.1338356656&w=350&fwrn=4&fwrnh=100&lmt=1687308604&rafmt=1&format=350x280&url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688034026389&bpp=2&bdt=704&idt=523&shv=r20230626&mjsv=m202306200101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280&correlator=6844923129764&frm=20&pv=1&ga_vid=1490640896.1688034027&ga_sid=1688034027&ga_hid=525232461&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1020&ady=1172&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31075534%2C42532264%2C44788442%2C44795921%2C44769661&oid=2&pvsid=2230865784680428&tmod=1842262037&uas=0&nvt=1&ref=https%3A%2F%2Fdisq.us%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=34suEQOwjq&p=https%3A//blcd.online&dtd=544
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 29 Jun 2023 10:20:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.va.us.criteo.com/google/auction/ Frame 3829 0
0 35ms
29ms Fetch 2620:100:a001::3
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.va.us.criteo.com/google/auction/notify?profile=14&payload=kumHDc36RN4CmALiIp0XAgAAAL2asfGoG_3nsrhsohDqWp1keTlEH-MJ9QOLnwAAEgAACgpBUVVCQ2dFQkNn&wp=ZJ1a6gAO-AkITzauAAKkpD-yY15SSctqNIbczw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6685813834444181&output=html&h=280&slotname=1338356656&adk=1817563164&adf=1975471561&pi=t.ma~as.1338356656&w=350&fwrn=4&fwrnh=100&lmt=1687308604&rafmt=1&format=350x280&url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688034026389&bpp=2&bdt=704&idt=523&shv=r20230626&mjsv=m202306200101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280&correlator=6844923129764&frm=20&pv=1&ga_vid=1490640896.1688034027&ga_sid=1688034027&ga_hid=525232461&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1020&ady=1172&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31075534%2C42532264%2C44788442%2C44795921%2C44769661&oid=2&pvsid=2230865784680428&tmod=1842262037&uas=0&nvt=1&ref=https%3A%2F%2Fdisq.us%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=34suEQOwjq&p=https%3A//blcd.online&dtd=544

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::3 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 148317
server: Kestrel
content-length: 0

GET
H2 200 afr.php Show response
ads.us.criteo.com/delivery/r/ Frame 624A 165 KB
51 KB 151ms
141ms Document
text/html 2620:100:a001::24
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/afr.php?z=ZJ1a6gAO-AkITzauAAKkpD-yY15SSctqNIbczw&u=%7CneHBKftYU6z2kKbWpVkkxmeEU5cOr2E4PDNQWFqsXJs%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-dbHERHVj9MQgFtTN83TUdVFZz6mvMC78INU6e6727c9TpoF6_Hy_3OA2J3vCm6mYUX1NAdc9l2Qce0rLSvi7hLeNul4KJjn91GHNzPvrNNIITJ6oiRCCkM7rY313mzKvm0QYnwpRtnf0yLz4uNUG7lr_vY7SrV7HeJJ9VI14GHi_IxTkJ4EMqNcjAj2Bs9FXMADQAZ1XW4ypvB6S7N66WMhi7ItKuTnd1XoSrZQu-iOPDhxxoIiTTSmj5UYkKMDqO7ZRZ2djGcTfiNrQCcbz8aIStumX7mLrNnH6tU8GxE1RuG9LgWimBbiXV97RrL73EOSvVFLCSNiaCA0HwiK8_CdwwKvOoKaoy2tYsRk8ZnLvonIwjahihYZxZMgPPB2KQNdULB1APRaebBWAbDm4Zb0Vc7Y7Kn859HfPoUDiZcu87KQDCkDHyE5Dvn5YxGAHz-yOaox6vooRXKcVWuZHie9O1HTMOltAM6Z-h7S5-lQ3N8oumxl_VCadrbYMoyxqJovvaSXEQNRWOc5HnP9Ca0QCZtnMPkZJbA3sVKIsZTcieD78-vTKk11Cm4A-6MnwVRUDE_wU_qHHpjx1oJCc4mfivGmYCOzj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCndKT6lqdZInwO67tvPIPpMmKqA-cge-wXLKaqap0wI23ARABIABgye6Oi8CkjBCCARdjYS1wdWItNjY4NTgxMzgzNDQ0NDE4McgBCagDAcgDAqoEhAJP0J1RUFC1RFm1pKKFEgwAPSNJ9J3SI8JWIZPGb9ox7Sqbq4504wb-0WlLP5ARlBw3WjvxGi1W8Wu4XZaBNsLFAw0agpmHCy1_0DZDDkDo1LKb62emb7Gld_YDwjFWXrbn4j6eh5tWUkWLJFfazXZ2Hur27I2dy3AR3Wju9YS83t7FSYX-rFmL3WJD65uWQgZh2vC-V56coSq4lMed1UO6Kv4uClTyuNONtUS9ioJSUQICOhXQzr5prpwVAPg8yUXwLwvcK8Y68zIeaWyoSzmCoBWY06cWy3uvZjB9cmqkVu99pHgZKRbpw7xK5-_2RKykjKV2RKxL5kvZzOY-AV6JkhMK4YAGiKHur8vVqKuEAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0o7mLbPPEdBjjMVE407yXQcmlA9Q%26client%3Dca-pub-6685813834444181%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6685813834444181&output=html&h=280&slotname=1338356656&adk=1817563164&adf=1975471561&pi=t.ma~as.1338356656&w=350&fwrn=4&fwrnh=100&lmt=1687308604&rafmt=1&format=350x280&url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688034026389&bpp=2&bdt=704&idt=523&shv=r20230626&mjsv=m202306200101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280&correlator=6844923129764&frm=20&pv=1&ga_vid=1490640896.1688034027&ga_sid=1688034027&ga_hid=525232461&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1020&ady=1172&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31075534%2C42532264%2C44788442%2C44795921%2C44769661&oid=2&pvsid=2230865784680428&tmod=1842262037&uas=0&nvt=1&ref=https%3A%2F%2Fdisq.us%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=34suEQOwjq&p=https%3A//blcd.online&dtd=544

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::24 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

db28e90921f6d7d59d829db878baa14e8dbd0dfcd3b688fad45ba93f4bb2dcd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 29 Jun 2023 10:20:27 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.us.criteo.net/heavyad?cppv=3&cpp=807bC3Dk_HRver-Df_TNMPvovNjrfmBnRjRxQ5P5NuHnerGKOKo-pmF0Sk6VJQ3DfWxLPbtwqUUN8Lrc6wrrmBs56yI8pTHBiqXwrpnpr5dd0HFEHCqPWyMBJ2X5-q_P6Tu_gmndb8VqCHY8-uaS2Q2ktd2ogEO5-yFa6VhvgJtlCfWtWVnyV467g5sslXdU6CPczpc2laUWZ0jnIie9mSGjA0oGPa0klQpyrp8qh8L17t4cvM6J18VJ9Mr9KChEcCiS9w"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 44189200
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 proxy.html Show response
content.googleapis.com/static/ Frame 01C3 382 B
905 B 74ms
45ms Document
text/html 2607:f8b0:4006:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.5o5-TAFr18s.O%2Fd%3D1%2Frs%3DAHpOoo_qgszOsFrBH7bZ1Rmfwa9Mc03wLQ%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.5o5-TAFr18s.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_qgszOsFrBH7bZ1Rmfwa9Mc03wLQ/cb=gapi.loaded_0?le=scs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9782dc9a4ac7b585cb6c257d483499b2f0fd45c2f2535c55d6abf9401acf784b

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-uP3nX5PCXaGZX2RRCbeHuA' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/apiserving; base-uri 'none' require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apiserving
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blcd.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 272
content-security-policy: script-src 'nonce-uP3nX5PCXaGZX2RRCbeHuA' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/apiserving; base-uri 'none' require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apiserving
content-type: text/html
cross-origin-embedder-policy: require-corp; report-to="apiserving"
cross-origin-opener-policy-report-only: same-origin; report-to="apiserving"
cross-origin-resource-policy: cross-origin
date: Thu, 29 Jun 2023 10:20:27 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
last-modified: Wed, 28 Jun 2023 17:48:00 GMT
pragma: no-cache
report-to: {"group":"apiserving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apiserving"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame CE95 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a9ef2af321964aed3d0a641d24049b297550c5329f38577efa4b66164c25839

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 3829 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ea9816f9cf6bdc94edd911b28fb3f81c1e2ea20dd57207bb4ed88ab193c7396c

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 48E1 2 KB
1 KB 101ms
29ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZJ1a6gAN4VoE0Y-4AAVcGJ-cRpxL5QfEraVkKQ&u=%7CneHBKftYU6zVANl2dmx5sOTxR8b6hJDY9U2ZV54GuBA%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-dbHERHVj9MQgFtTN83TUdVFZz6mvMC78INU6e6727c9TpoF6_Hy_3OA2J3vCm6mYUX1NAdc9l2Sv3kQRyjeS7yaQwRqR7subRek4WsbAF4HzHdhw_QzreC81lxWLXFi_A7kJF6P6Q_tEu2A4C_N1Kneqj1oiWFtxyM3C-qFemum_06o7sFRvaU4xSXPQF-1BBHzm2LVLZPwFFHMxiJiWm1szKwriTPLzAurjGxygExNWxkHa1Z957I_2pQJo-ArvAIlUduLZsgBZofnYacIHgTB64wwc1HfGSjiLXvz28nDITOrIMuE7dTlk-H5CjbA25ucqZbq5y2mNvpA6FuNowqWqWBtvIc2pu7EAjwFanoWBXW9nrNWSDNHiqPCZtkxpRKp5CvqrU6zg9N5eBAbtQzp85I9bO7fTjwRpTTHGhPZaCRDTZVSWjTCgYO1ZqWIIvipRKQcVraGisTki-B8v1xVEDiVvWew9-Tjh5lxCxbznYFZ2RjQOR8-FyZ1ftAQHjFWW7-THZvYL2AIxDgbJ5jvM3HpBNgUXMjaFR0qTOGLfCZJ2TVkyxrKmGcWPmlZN-W3aWRMbE9zb7n9PcAa3jPHEAV1Vipoh&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCDjNh6lqdZNrCN7ifxtYPmLiV2A6cge-wXKqbqap0wI23ARABIABgye6Oi8CkjBCCARdjYS1wdWItNjY4NTgxMzgzNDQ0NDE4McgBCagDAcgDAqoE_gFP0G2XDxedrq4koeK__HSDPGR1fwU07-_1dsRttxNIvmnApQsHUB9sCevEZxuzqFiSweHfVWllgEBIMwcBwyz9aLJKap3C7wlpehq5Y8SdjfvvivGIMwHpR3tmhyPBuJdfXCmtVdNQU_j_8t1VCydMNTb2Lw21Rvz8PfIvS3nYRbOjverBb5bIfdW8kLhYz3SIIEG__i7-p9fk4d1AmB6olgfkCEIlItDHsDi5NMSq2jRMCyQF0maJXi1JqZkEqAKVEXhtNvbnYYAIxBfytLGBoetZWqnmbANdRBXCPUwjkdvF0lqECqg51L6W8sUJabko3Ux9F-lOU4OWxkGMiIAGiKHur8vVqKuEAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1juHiseRGaSvhA2biOiKQlNKxz3w%26client%3Dca-pub-6685813834444181%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 48E1 2 KB
1 KB 103ms
32ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 48E1 308 B
636 B 37ms
30ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 48E1 293 B
621 B 40ms
33ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 lg.php
cat.va.us.criteo.com/delivery/ Frame 48E1 43 B
348 B 114ms
31ms Image
image/gif 74.119.119.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.va.us.criteo.com/delivery/lg.php?cppv=3&cpp=kjFP4WdH02nrEadw42YdVD3p90QDxdtzgJPoMHFQWzBIzKTW-UF4IMn93Q0DejPBirpikpmSB5Kp-UVbGhgREotZlC_sHSxCmLgVyLMCStxr5Xw-NRnYPkm5rXRsEP2xGEB5Ugb5uCupg0M-6fQ4gNr1n-XjG9pjzQd_5xljsrbKPO6hGzcXcATXjSO-PWTHIXLY-yN63TYp2N6zGNlttpB2XSftELbQEtcF9BKvzhx9tT-xNYe6ellZVh3bXjIR1swBAibDIZFhAnDDLYjdqV57sU6vhyoGO-Uug1-7B9w0DJ1AbfQNbdrFaui-BZP6SS7yFxn-7GKaEFj7lrWRxN-MT82yd9zdIjXAJ9LJ5RnFVLUgdgQs3ULg-RnAqbCo8OqYG0HI8lu3agDwqxVIpLh2Lhs2plKZOKp4P72UJywqYWu1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jun 2023 10:20:26 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1951323
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

B24217808.274313803;dc_pre=CPjY1eSg6P8CFYUtDAodGKsEyg;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aea2de3e821ce2feab9aba8faa8;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=
ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/ Frame 48E1
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aea2de3e821ce2feab9aba8faa8;dc_lat=;dc_rdid=;tag_for_child_directed...
https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_pre=CPjY1eSg6P8CFYUtDAodGKsEyg;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aea2de3e821ce2feab9aba8faa8;dc_la...

42 B
107 B

74ms
72ms

Image
image/gif

142.251.40.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_pre=CPjY1eSg6P8CFYUtDAodGKsEyg;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aea2de3e821ce2feab9aba8faa8;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?

Requested by

Protocol

Server

142.251.40.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jun 2023 10:20:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 29 Jun 2023 10:20:27 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_pre=CPjY1eSg6P8CFYUtDAodGKsEyg;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aea2de3e821ce2feab9aba8faa8;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 apiserving
csp.withgoogle.com/csp/ Frame 01C3 0
0 110ms
49ms Other
text/html 2607:f8b0:4006:809::2011
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csp.withgoogle.com/csp/apiserving
Requested by: Host: disq.us
URL: https://disq.us/url?url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F%3AFeMEqxMh35vpOV-yXiwulTHY9lk&cuid=5728715
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:809::2011 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://content.googleapis.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: application/csp-report

Response headers

GET
H3 200 googleapis.proxy.js Show response
apis.google.com/js/ Frame 01C3 18 KB
7 KB 45ms
44ms Script
text/javascript 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/googleapis.proxy.js?onload=startup

Requested by

Host: content.googleapis.com
URL: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.5o5-TAFr18s.O%2Fd%3D1%2Frs%3DAHpOoo_qgszOsFrBH7bZ1Rmfwa9Mc03wLQ%2Fm%3D__features__

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd2b9635ae2c035265315ebe95d5d13faf8711a8232807d0f7e8f53936157e93

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://content.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 29 Jun 2023 10:20:27 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7118
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
etag: "0269e0b43b0d965f"
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Jun 2023 10:20:27 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 624A 2 KB
1 KB 44ms
31ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZJ1a6gAO-AkITzauAAKkpD-yY15SSctqNIbczw&u=%7CneHBKftYU6z2kKbWpVkkxmeEU5cOr2E4PDNQWFqsXJs%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-dbHERHVj9MQgFtTN83TUdVFZz6mvMC78INU6e6727c9TpoF6_Hy_3OA2J3vCm6mYUX1NAdc9l2Qce0rLSvi7hLeNul4KJjn91GHNzPvrNNIITJ6oiRCCkM7rY313mzKvm0QYnwpRtnf0yLz4uNUG7lr_vY7SrV7HeJJ9VI14GHi_IxTkJ4EMqNcjAj2Bs9FXMADQAZ1XW4ypvB6S7N66WMhi7ItKuTnd1XoSrZQu-iOPDhxxoIiTTSmj5UYkKMDqO7ZRZ2djGcTfiNrQCcbz8aIStumX7mLrNnH6tU8GxE1RuG9LgWimBbiXV97RrL73EOSvVFLCSNiaCA0HwiK8_CdwwKvOoKaoy2tYsRk8ZnLvonIwjahihYZxZMgPPB2KQNdULB1APRaebBWAbDm4Zb0Vc7Y7Kn859HfPoUDiZcu87KQDCkDHyE5Dvn5YxGAHz-yOaox6vooRXKcVWuZHie9O1HTMOltAM6Z-h7S5-lQ3N8oumxl_VCadrbYMoyxqJovvaSXEQNRWOc5HnP9Ca0QCZtnMPkZJbA3sVKIsZTcieD78-vTKk11Cm4A-6MnwVRUDE_wU_qHHpjx1oJCc4mfivGmYCOzj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCndKT6lqdZInwO67tvPIPpMmKqA-cge-wXLKaqap0wI23ARABIABgye6Oi8CkjBCCARdjYS1wdWItNjY4NTgxMzgzNDQ0NDE4McgBCagDAcgDAqoEhAJP0J1RUFC1RFm1pKKFEgwAPSNJ9J3SI8JWIZPGb9ox7Sqbq4504wb-0WlLP5ARlBw3WjvxGi1W8Wu4XZaBNsLFAw0agpmHCy1_0DZDDkDo1LKb62emb7Gld_YDwjFWXrbn4j6eh5tWUkWLJFfazXZ2Hur27I2dy3AR3Wju9YS83t7FSYX-rFmL3WJD65uWQgZh2vC-V56coSq4lMed1UO6Kv4uClTyuNONtUS9ioJSUQICOhXQzr5prpwVAPg8yUXwLwvcK8Y68zIeaWyoSzmCoBWY06cWy3uvZjB9cmqkVu99pHgZKRbpw7xK5-_2RKykjKV2RKxL5kvZzOY-AV6JkhMK4YAGiKHur8vVqKuEAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0o7mLbPPEdBjjMVE407yXQcmlA9Q%26client%3Dca-pub-6685813834444181%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 624A 2 KB
1 KB 69ms
55ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 624A 308 B
636 B 32ms
30ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 624A 293 B
621 B 30ms
28ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 lg.php
cat.va.us.criteo.com/delivery/ Frame 624A 43 B
347 B 82ms
32ms Image
image/gif 74.119.119.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.va.us.criteo.com/delivery/lg.php?cppv=3&cpp=fMfl2mdH02nrEadw42YdVD3p90SSgsmG1RcfiG_fQfJle-EPhPcnPnCEiOtPAUV0EkUOIhQQWZM9qlRcPtNRXPTupbIo3-8dfuxC6boNurE8NqzUZdJ_JeIgPqFC_S4xoUXi6Jq-uAFIIhZsiyrK4jt8EAzEs3IPcoIlwiXXNHCohN1hYaXDHSrL0geZPRODgAfXrCDMH1aNKumGrT0xyPPVCioREgjvFFAFCRx8JYkbH_zMgKYHwgbq5pWRgbGgzhhZu48wutN_psdcDW-o9d7HCnXrbSrfYIgAC2549DPUPJ4JsLY82in1KDQ2l9dFxxb0eMD9n4pByLoQYxfNbIwzwK0yfQ0PjVbJGT1FaeindC2sPrVn0rixqedam4cq86ZKeNYM0DdF7cDqsxJR7lVf0E_RVTl-c-svKcbJOrN9V6zp

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jun 2023 10:20:26 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2740420
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

B24217808.274313803;dc_pre=CLnb1eSg6P8CFVjxswodAT8GzA;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aea87e303af637b7917f08095b7;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=
ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/ Frame 624A
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aea87e303af637b7917f08095b7;dc_lat=;dc_rdid=;tag_for_child_directed...
https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_pre=CLnb1eSg6P8CFVjxswodAT8GzA;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aea87e303af637b7917f08095b7;dc_la...

42 B
118 B

72ms
71ms

Image
image/gif

142.251.40.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_pre=CLnb1eSg6P8CFVjxswodAT8GzA;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aea87e303af637b7917f08095b7;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?

Requested by

Protocol

Server

142.251.40.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jun 2023 10:20:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 29 Jun 2023 10:20:27 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_pre=CLnb1eSg6P8CFVjxswodAT8GzA;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aea87e303af637b7917f08095b7;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 48E1 12 KB
5 KB 102ms
38ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5240320
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=103NITU%2B5UIEFF1fZHCeCRFtrnrx5oItEMn4%2FEfLUUgMR51rv8JON7l79x%2FoOFszIiuCgd7y52RVbko45onn8zrBZwapzfoaNKrblZOTOnWP9rXl671ejbssBp%2Bt0r1%2BxX60tprhPR2sLPB5a2ehSGKQ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7ded6fe04e97d14f-BUF
expires: Tue, 18 Jun 2024 10:20:27 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 48E1 12 KB
6 KB 48ms
48ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 624A 12 KB
5 KB 68ms
39ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5240320
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lKGX%2Fd7HPJhbUV1wqlJhsEBuaW85loP9mVjY07KzKl%2FLpeeDafVzlUVzE8ymYowopw31ne%2Bsi%2FoWN3LCbIMFJw5wMxO9%2Fh9pI1cWpywUXBX356Zkz1T4CJ5T%2BwOwAoT7q3Tkf8ac7WRHYPtqoUziE9lJ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7ded6fe04e98d14f-BUF
expires: Tue, 18 Jun 2024 10:20:27 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 624A 12 KB
6 KB 40ms
40ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 58387fca10ec4862886cccc4d3d4e79e_mark+simonson+-+proxima+nova+alt+regular-webfont.woff
static.criteo.net/design/dt/ Frame 48E1 24 KB
24 KB 147ms
82ms Font
application/octet-stream 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/58387fca10ec4862886cccc4d3d4e79e_mark+simonson+-+proxima+nova+alt+regular-webfont.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

e9fdc188060ed6e1f88c478d14ec18de88aa08f8a04920a03c707b158b91bb41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
Origin: https://ads.us.criteo.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 06 Dec 2018 15:42:02 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c09434a-5e6c"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 58387fca10ec4862886cccc4d3d4e79e_mark+simonson+-+proxima+nova+alt+regular-webfont.woff
static.criteo.net/design/dt/ Frame 624A 24 KB
24 KB 127ms
73ms Font
application/octet-stream 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/58387fca10ec4862886cccc4d3d4e79e_mark+simonson+-+proxima+nova+alt+regular-webfont.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

e9fdc188060ed6e1f88c478d14ec18de88aa08f8a04920a03c707b158b91bb41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
Origin: https://ads.us.criteo.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 06 Dec 2018 15:42:02 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c09434a-5e6c"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 48E1 8 KB
8 KB 97ms
35ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?h=116&m=0&partner=25144&q=80&r=0&u=http%3A%2F%2Fstatic.va.us.criteo.net%2Fdesign%2Fdt%2F25144%2F200701%2F49c7fdefdb4a4feebd2bf14922e3bf51_relaterentals_core_logowht.png&v=3&w=696&s=9V7Oi1K5A9Jg9Wm6K_ZKJ58B

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

c583913a43bf56bca2fa929fc41b6bfd165c95a6a07437369693674b2a2fd881

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
content-length: 7980
expires: Tue, 14 May 2024 12:34:56 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 48E1 18 KB
18 KB 133ms
71ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=25144&q=80&r=2&u=https%3A%2F%2Fwww.relatedrentals.com%2Fsites%2Fdefault%2Ffiles%2Fstyles%2Funit_hero_large_2x%2Fpublic%2F2018-12%2Ftate-nyc-studio.jpg%3Fh%3D25e404c5%26itok%3DTr7am9x5&v=3&w=400&s=FcDDB3G259ALK3uwM4lY45nY&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

6cd95aca183562241c146c19e088e81429b79d41065553d49c7c4733c38ffb28

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=1209600
content-length: 17928
expires: Fri, 30 Jun 2023 21:14:09 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 48E1 17 KB
17 KB 133ms
72ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=25144&q=80&r=2&u=https%3A%2F%2Fwww.relatedrentals.com%2Fsites%2Fdefault%2Ffiles%2Fstyles%2Fimage_gallery_large_2x%2Fpublic%2F2019-01%2FOne-Bennett-Park-Chicago-02-Kitchen_3.jpg%3Fitok%3DeZDYor6U&v=3&w=400&s=fWBxlSwOn-T9rr-gnUmuvt9z&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

160dcb54eb94e021bc79bb2ccc46b521517c0a018480c81698d5b636bc7c152b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=1209600
content-length: 17670
expires: Wed, 12 Jul 2023 09:36:07 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame 48E1 0
127 B 97ms
35ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.us.criteo.net/all?cppv=3&cpp=SrUf93Dk_HRver-DPvrJoBTlgqzr_z4wtD1dLxVWPYOBnK2T-48_2IKFYT5hYZYxkRKtFo3yahg7XCxJ0tR5LyuLg5UQavOHsJV0AjnTTcONTKFEUdxC98C5uTAFhwiae0UT_snNV4xoWegAdaBARlXvQDj48PqLPhcOWkxN7h-e76EgWlNpnfrNVuIifnlbntdFFO8wrujBWLceMsU8_B96qleKUbnYk_OTtxTB0SIdaBimEXfBjbzguc1Zx5puMT93yg&sds=2&rev=87007&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 48E1 2 KB
1 KB 33ms
29ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 48E1 2 KB
1 KB 33ms
30ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 624A 8 KB
8 KB 85ms
70ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

c583913a43bf56bca2fa929fc41b6bfd165c95a6a07437369693674b2a2fd881

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
content-length: 7980
expires: Tue, 14 May 2024 12:34:56 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 624A 17 KB
17 KB 121ms
107ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=25144&q=80&r=2&u=https%3A%2F%2Fwww.relatedrentals.com%2Fsites%2Fdefault%2Ffiles%2Fstyles%2Fimage_gallery_large_2x%2Fpublic%2F2019-01%2FOne-Bennett-Park-Chicago-02-Kitchen_3.jpg%3Fitok%3DeZDYor6U&v=3&w=400&s=fWBxlSwOn-T9rr-gnUmuvt9z&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

160dcb54eb94e021bc79bb2ccc46b521517c0a018480c81698d5b636bc7c152b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=1209600
content-length: 17670
expires: Wed, 12 Jul 2023 09:36:07 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 624A 30 KB
30 KB 107ms
95ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=25144&q=80&r=2&u=https%3A%2F%2Fwww.relatedrentals.com%2Fsites%2Fdefault%2Ffiles%2Fstyles%2Fimage_gallery_large_2x%2Fpublic%2F2020-02%2FFifteenFifty_2Bed1_51.jpg%3Fitok%3DEYmaqhck&v=3&w=400&s=fdUnchtNZU3olDP44zyutuqf&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

3149ad3867036735ad2b3fe265cdca8b71affb2d4aacab6aa60ae3abdaaa5840

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=1209600
content-length: 30912
expires: Tue, 11 Jul 2023 19:58:02 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame 624A 0
128 B 47ms
34ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.us.criteo.net/all?cppv=3&cpp=807bC3Dk_HRver-Df_TNMPvovNjrfmBnRjRxQ5P5NuHnerGKOKo-pmF0Sk6VJQ3DfWxLPbtwqUUN8Lrc6wrrmBs56yI8pTHBiqXwrpnpr5dd0HFEHCqPWyMBJ2X5-q_P6Tu_gmndb8VqCHY8-uaS2Q2ktd2ogEO5-yFa6VhvgJtlCfWtWVnyV467g5sslXdU6CPczpc2laUWZ0jnIie9mSGjA0oGPa0klQpyrp8qh8L17t4cvM6J18VJ9Mr9KChEcCiS9w&sds=2&rev=87270&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 624A 2 KB
1 KB 42ms
42ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 624A 2 KB
1 KB 42ms
42ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306200101/ 155 KB
52 KB 50ms
49ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306200101/reactive_library_fy2021.js?bust=31075534

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306200101/show_ads_impl_fy2021.js?bust=31075534

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b72e2e18c4280f8e5174177a17554bee0c182158c088e6fe1826d4ebd946f963

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53664
x-xss-protection: 0
server: cafe
etag: 921110270514654067
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Jun 2023 10:20:27 GMT

GET
H3 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.5o5-TAFr18s.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_qgszOsFrBH7bZ1Rmfwa9Mc03wLQ/ Frame 01C3 77 KB
27 KB 29ms
28ms Script
text/javascript 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.5o5-TAFr18s.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_qgszOsFrBH7bZ1Rmfwa9Mc03wLQ/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/googleapis.proxy.js?onload=startup

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

281cb71a8dce2cb54eb7d97777763adf4e8da177f844a913b7c979012a6a022a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://content.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 19:47:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 570782
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27779
x-xss-protection: 0
last-modified: Tue, 06 Jun 2023 15:25:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 21 Jun 2024 19:47:25 GMT

GET
H2 200 playfairdisplay-400.css
static.criteo.net/design/googlefont/playfairdisplay/ Frame 48E1 1 KB
760 B 43ms
33ms Stylesheet
text/css 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-400.css

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

96ea11f0396cec62f5c20e6a49b719359e3030150c73ef12c15531b8e9bebd4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:12:23 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f0c7-57c"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 playfairdisplay-700.css
static.criteo.net/design/googlefont/playfairdisplay/ Frame 48E1 1 KB
761 B 37ms
27ms Stylesheet
text/css 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-700.css

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

811b6e679ed2a18fb5696054a5386869bef195c0dcdd045f623dc19530216741

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:12:24 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f0c8-57c"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 playfairdisplay-400.css
static.criteo.net/design/googlefont/playfairdisplay/ Frame 624A 1 KB
760 B 36ms
29ms Stylesheet
text/css 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-400.css

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

96ea11f0396cec62f5c20e6a49b719359e3030150c73ef12c15531b8e9bebd4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:12:23 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f0c7-57c"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 playfairdisplay-700.css
static.criteo.net/design/googlefont/playfairdisplay/ Frame 624A 1 KB
761 B 35ms
28ms Stylesheet
text/css 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-700.css

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

811b6e679ed2a18fb5696054a5386869bef195c0dcdd045f623dc19530216741

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:12:24 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f0c8-57c"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 48E1 8 KB
8 KB 47ms
47ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

c583913a43bf56bca2fa929fc41b6bfd165c95a6a07437369693674b2a2fd881

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
content-length: 7980
expires: Tue, 14 May 2024 12:34:56 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 624A 8 KB
8 KB 36ms
28ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

c583913a43bf56bca2fa929fc41b6bfd165c95a6a07437369693674b2a2fd881

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
content-length: 7980
expires: Tue, 14 May 2024 12:34:56 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 48E1 17 KB
17 KB 43ms
35ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=25144&q=80&r=2&u=https%3A%2F%2Fwww.relatedrentals.com%2Fsites%2Fdefault%2Ffiles%2Fstyles%2Fimage_gallery_large_2x%2Fpublic%2F2019-01%2FOne-Bennett-Park-Chicago-02-Kitchen_3.jpg%3Fitok%3DeZDYor6U&v=3&w=400&s=fWBxlSwOn-T9rr-gnUmuvt9z&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

160dcb54eb94e021bc79bb2ccc46b521517c0a018480c81698d5b636bc7c152b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:26 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=1209600
content-length: 17670
expires: Wed, 12 Jul 2023 09:36:07 GMT

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 41ms
39ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=blcd.online

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306200101/show_ads_impl_fy2021.js?bust=31075534

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/ Frame 558E 10 KB
4 KB 30ms
25ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306200101/show_ads_impl_fy2021.js?bust=31075534

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blcd.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 43196
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4540
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 28 Jun 2023 22:20:31 GMT
etag: 15057649708203361565
expires: Wed, 12 Jul 2023 22:20:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/ Frame E1CC 10 KB
4 KB 30ms
28ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306200101/show_ads_impl_fy2021.js?bust=31075534

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blcd.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 43196
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4540
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 28 Jun 2023 22:20:31 GMT
etag: 15057649708203361565
expires: Wed, 12 Jul 2023 22:20:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/ Frame A37D 10 KB
4 KB 32ms
24ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306200101/show_ads_impl_fy2021.js?bust=31075534

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blcd.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 43196
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4540
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 28 Jun 2023 22:20:31 GMT
etag: 15057649708203361565
expires: Wed, 12 Jul 2023 22:20:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 playfairdisplay-700-latin.woff2
static.criteo.net/design/googlefont/playfairdisplay/ Frame 624A 20 KB
21 KB 42ms
41ms Font
application/octet-stream 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-700-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-700.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

c16f06e6edabd22d2c5c9d9b87260eca6faf706400dea89876de323480750489

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-700.css
Origin: https://ads.us.criteo.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:12:24 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f0c8-51e8"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 playfairdisplay-700-latin.woff2
static.criteo.net/design/googlefont/playfairdisplay/ Frame 48E1 20 KB
21 KB 40ms
39ms Font
application/octet-stream 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-700-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-700.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

c16f06e6edabd22d2c5c9d9b87260eca6faf706400dea89876de323480750489

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-700.css
Origin: https://ads.us.criteo.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:12:24 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f0c8-51e8"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 afr.php Show response
ads.us.criteo.com/delivery/r/ Frame B79C 201 KB
56 KB 84ms
83ms Document
text/html 2620:100:a001::24
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/afr.php?z=ZJ1a6wAA_SsE0bJhAAUICV6jvlDp5kO8-OUe4A&u=%7CneHBKftYU6xNDoPitsho4GLvVlwuDxBZ6DUCS8gMIfU%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-pdBd4Yn-iAyg0RfPc5NXLXF37ShTWqW3dXReprTZdqqDdxKZ6LPg3fC_n0cZ1rmV5e7VlaC3Amu5uqCRlBmif_WneQ4Jwe5tSdd22mubUn5RRL-HiNYHj2QsPhJoe3ilaN3y9d_SpHaAJZQLCBE2HTxXOwTIxg3e3Dd9bv8rGnKM4g2fNxzUEkEXcOC4pXOtxRuRbz5V3uT4PNzuslVgBcbAjTltPltbpPU7eq3ho_5Q6PhOwIXnndGhKsM7oKNy_arHuUXx9NB-sgT68KP2Svv58pppFxIQNCPUBa_8AD-Nqf6tbN7x5UGiNVnyjjl6yUTT89R6nB7zjR9uOlMGfOWLbfKqR_4ztrOlcA-h8nsy3zllI14L_0OAKwesBPiQYFCRC958HUjyGP45X9KmoeDsqIJbOoe8rtII5DavgrH8lVaoWgUEDY-T5t0qWdcrnkwi-EbEV_2sS6AEWqx6L7JucMy5YvVkU8xfrbkYiMzycMEF3zzxTE7-XOxzszQbKkuXOCZ4eY-s8AonvLIb5Ln3RdsKtTj2fMy8SBKMUj6VvPYSG5mSD-t5YwlLMcNacj8Fy_xWFQKodgdM3LXNbYUj_x3VAOON&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCNRtx61qdZKv6A-HkxtYPiZCU-Aqcge-wXNqkqap0wI23ARABIABgoQKCARdjYS1wdWItNjY4NTgxMzgzNDQ0NDE4McgBCagDAcgDAqoE_gFP0En6qIK5wWk9UEfqczTKhyJ6eQ1sMPc6ulSBfCPDK7AkiScBIfP4XWW5i4p8vuBY09ALODhCAAC4vPJfvcZuohHAicYZnz1REicDWRHDMgIcojT2dEHVPsZwiTinNOUYCUaO9IKqkFX0OqlCan5F5nGRCOIeBMtyVdidyfsao_i0rjSrBVKA2zguRBuAL4SkXmn72rTGT6_3KnqosURmGc9yQrmy7m88SeCYM4eTHMr_4PfMywHHbUznMlN1RQEsp84eODaq19e1SCVLGepDkf5ivv2BK_hmV2C76UIp3-wKH-HLaDNIrbtxXsGu4Eq5HWiD-EAF6Y-FDy1NJoAGiKHur8vVqKuEAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_3a0JvHxdvFkQ_QjOydGId5cTjksA%26client%3Dca-pub-6685813834444181%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::24 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

8741a6a7d6960fcda0dd3cc3c6fb1423d3543feb7a2bc4f40e731b19a552a264

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 29 Jun 2023 10:20:27 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.us.criteo.net/heavyad?cppv=3&cpp=7-y1OnDk_HRver-D0CLlPQf4Ha35qFNXE2c2xdKxZSyCAL0J5gdc60k9I63rDIbJsYxJCrvxR4yCokLgy7tAAIcvdRyIYTbNRzA7NlI4-rKGaA5jGLbM7Lb3SZSPLLr81IMKabySfm8vUTeWNraJ8JGqBe3y909wkMtPAFo2xF70PoR5qSAu64chQqoy36ZVBixn7wRQNyxUroAhDQG6t3HEXZuFfzWT79vNrKR3DMx7JEtkRBwizNAFPMir9J_NXoV5Lg"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 47163395
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/ Frame 558E 3 KB
1 KB 26ms
23ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 20:27:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49993
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 12 Jul 2023 20:27:14 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/ Frame 558E 20 KB
8 KB 27ms
24ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4a038eb56ed2eb8fb4701ef93757a4d42a433508714b8a11b426e6a9ac3f350

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 20:27:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49993
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8312
x-xss-protection: 0
server: cafe
etag: 8395464388031192745
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 12 Jul 2023 20:27:14 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 558E 179 KB
56 KB 57ms
56ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6914d47718a28ab8055edac273b3aff57e64e5bddccc616c2b7e355fe986f39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57260
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1687952195399670"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Jun 2023 10:20:27 GMT

GET
H2 200 afr.php Show response
ads.us.criteo.com/delivery/r/ Frame 37D5 205 KB
57 KB 78ms
76ms Document
text/html 2620:100:a001::24
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/afr.php?z=ZJ1a6wAA_SwE0bJhAAUICTqIH6sXhi2A1OAxAA&u=%7CneHBKftYU6wXIZh8DmWMO676jZummJ7XF%2BqW1bgpbJM%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-pdBd4Yn-iAyg0RfPc5NXLXF37ShTWqW3dXReprTZdqqDdxKZ6LPg3fC_n0cZ1rmV5e7VlaC3AmtiRxcvx7B1QNv8IFUIEbw6vEo1ODCm0Lpwaxh3U0JQBd-DkMTrHlxEZsRCISG_3S3jyv-Z9g9-1UP_neoJPMlsvOw4e8gAMeDOIArW3uN-QS6yN09wwfSu3cBDb8KE4SeYcjKyIPXv5MCfm48gX79duRiqv3m4anNb93A3SPs1hzSjwu3IX4OciD7oto02A3NpL8BLoAwnTZAcYXx0OmbXGvRo0Jl2zYQYRBgvbNhcW44FQwGsNhihqm2tD4ipeYeSkNRgFaDdRBASIK43NWeO9QWgNNRzG4vyHlD5rQtmK047V17AvOQl6EZtFmo5WrjzRza6pXYYe5CBT7BgAyenhBC9q_ApXnJpwfuHdzJ3Hvl5lNYozbDUqRfyYZz3sHrJV4YY5O6c8vorsCP5ZX-AoVc3gpanTtFFbkophamx3QCrq9SaCMUPZdyT6EWCaqzFSn7BCrgxAl9Ja1o6J1aLGH3z6ZnrfzV9f7r2MuEPNgI0n7W-Gj7QkYHwh17d-YP2tSJLplQYFi7xrQVymnaH&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCvTsC61qdZKz6A-HkxtYPiZCU-Aqcge-wXNqkqap0wI23ARABIABgoQKCARdjYS1wdWItNjY4NTgxMzgzNDQ0NDE4McgBCagDAcgDAqoE_gFP0A28PS2zDY6rPdyugfqJV_sWB8qDvF71FPAn2DY1D4rRU21vBwvQ1NTyBoVVh3uPVrbE3g1ds0ye3JG9jajt1xmjNJjGk_iwpzEksX_KzjwxXs9nqZTCeGMedEa_2eX93V946u-JstUOCd9iSJ8AE6_GkodlUH7Wt0TxDUWMx1qcAr-8bDpIf3yE-MkHboM1G4d0P_xMkFXmKT-324XGOMTJOM3QXzrsjsFcIljOTsBq3T0xxQX18GZeHLImYnTYSgXzwQ3u8hKluUi6_Zg_W0hSre96-r_8pKQF4DF_SdGpLMaAp_kSEzn1HiXWsup29xw5NaILzhNwC-iocYAGiKHur8vVqKuEAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0DJExMoK_xHYPXbQPIxU-Joe7BbA%26client%3Dca-pub-6685813834444181%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::24 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

fc17485e208c521841c0c7b9c0bcd47af7d24d727d193135c1cb5c8b70cd4006

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 29 Jun 2023 10:20:27 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.us.criteo.net/heavyad?cppv=3&cpp=ipaCLnDk_HRver-DpFczy9zbbbxxb40Xwj3n6poz49IIlVjcL5MYaupcpRcBRHRV4gOV5dCGAyC5BIJeoDC3Zr_nAryv3SORmSo2inwjgF28DhgcZekMDkaL27MEYVeBhO5c2MmZmJIulAkUNfH0g4dCyKI8nAF056qwe4tmi0MjCWzjMRS2y3HbIAYqmDqqhXBSmkYeHHzfr54mXlZgjFoM9nAfU0TF3O1vHXa26b5DSdiP1pM5rGeO5x6V_zzA8UsBOA"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 39021488
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/ Frame E1CC 3 KB
1 KB 29ms
26ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 20:27:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49993
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 12 Jul 2023 20:27:14 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/ Frame E1CC 20 KB
8 KB 30ms
27ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4a038eb56ed2eb8fb4701ef93757a4d42a433508714b8a11b426e6a9ac3f350

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 20:27:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49993
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8312
x-xss-protection: 0
server: cafe
etag: 8395464388031192745
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 12 Jul 2023 20:27:14 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E1CC 179 KB
56 KB 68ms
67ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6914d47718a28ab8055edac273b3aff57e64e5bddccc616c2b7e355fe986f39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57260
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1687952195399670"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Jun 2023 10:20:27 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame A37D 0
0 56ms
54ms Fetch
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=ChpiV61qdZK36A-HkxtYPiZCU-Aqcge-wXNqkqap0wI23ARABIABgoQKCARdjYS1wdWItNjY4NTgxMzgzNDQ0NDE4McgBCagDAcgDAqoE_AFP0MXLBKKuZLuDWIepFBkcTmHTRrpJs3eR68QtH6pFfiHc8OrT5R5nJXVgppl_STk3vd_0v15twtkC7MAbDf-paU8ZiuhI0oQ3pED7aSeFIu97NSZnSsKBzXSTQ7aUELvgm0Hu7vplf0ZWxpr6YNhBFeEXsi5yaXigD2weXIq7pJng9xfwR0HVV_eAYyDrY6a63f6IacldQsAzAfCXLDSWambekuaNx40dm5EpUZTH7adkDOUzii3o-ss9-G9_bovqvmjH-_TESAlZvWmBQKZVShSx1ZyVWe4axehMWXIulFC33egJyvYeGV1zF-0shgG0iv0tYpQ4Fe9fLiiABsbUhOPe0aXlxgGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggSCIBhEAEyAooCOgKAQEi9_cE6gAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTY2ODU4MTM4MzQ0NDQxODEYAA&sigh=1CBo0DakKvk&uach_m=[UACH]&cid=CAQSGwBygQiDO6uajVIWbKeDGVnePMrq5BwoJu0H2hgB

Requested by

Host: disq.us
URL: https://disq.us/url?url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F%3AFeMEqxMh35vpOV-yXiwulTHY9lk&cuid=5728715

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 29 Jun 2023 10:20:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.va.us.criteo.com/google/auction/ Frame A37D 0
0 31ms
30ms Fetch 2620:100:a001::3
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.va.us.criteo.com/google/auction/notify?profile=14&payload=kre3Fs36RO0HfOIinRcCAAAAn7cLoeiOtRGyuGyiEOpanWRKg0q-CtQsF0MsAAASAAAKCkFRVUJDZ0VCQ2c&wp=ZJ1a6wAA_S0E0bJhAAUICb_v0kBKAlZRDjFSSw

Requested by

Host: disq.us
URL: https://disq.us/url?url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F%3AFeMEqxMh35vpOV-yXiwulTHY9lk&cuid=5728715

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::3 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 260684
server: Kestrel
content-length: 0

GET
H2 200 afr.php Show response
ads.us.criteo.com/delivery/r/ Frame 8FD7 143 KB
48 KB 93ms
92ms Document
text/html 2620:100:a001::24
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/afr.php?z=ZJ1a6wAA_S0E0bJhAAUICb_v0kBKAlZRDjFSSw&u=%7CneHBKftYU6yYXxwbpRmMUOYlHErn0W9N%2Fryrf0cGycs%3D%7C&c1=m7oIQCLYgBslArNoBtbzWGPvj6heTG_nq948FPMQexFgSXZ5qfLYlz1Dr0C5Jfeybmk8T_2vGR7Ob23Zd9U92InMkPzyF6xgoT0mEX5pszB9v38b_sGpYyJgeZ9x3rOhLXTvGvej4KNiD-cnToJF88IXCF6x8CBoThc2YScrLiLm1qPoF1lzyn8ds86KYKwLVcCem_-RgTHiIVkG-Zu38i5FRt8MsnNjwkd8eQaPvcV8AVe-r3LQZpOeUNzhPTEk-XwhxqTynGyuo2nKlCc8t9qndDSc0nizij0SQI0g_To9lM8vtgf7nSJ7RdyPAAtPYkDdNLpF56_wYdgctcy4VootL3kVHg_BCbkVvvSE_2iWqag64627MXEKyQLGfAGv2LO1Rri9wEy-o13cKR8hz7QF44VFRctQ2i0PWJdMovngMRsSqAnzgUJk4b_W5LXiZ5-ELgZ6zFeqHHKmP15ac7lq65_o1s7Y75GTn0gRLuwei_uJ3-72xTqS6CqtEsUj53MBkt22KzJZb_qbO8o9ZcNKwt6lV0csdiWO8LJBk6Xda90FhQureU5iMKKCEKmcw9JqeTX2uKbOMz-uKzSfY_91NMC9C-ir25uUYvm75jvcej2l0Do1Agvr30yttMzX5YqQDy0q4-o&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCsUHQ61qdZK36A-HkxtYPiZCU-Aqcge-wXNqkqap0wI23ARABIABgoQKCARdjYS1wdWItNjY4NTgxMzgzNDQ0NDE4McgBCagDAcgDAqoE_wFP0MXLBKKuZLuDWIepFBkcTmHTRrpJs3eR68QtH6pFfiHc8OrT5R5nJXVgppl_STk3vd_0v15twtkC7MAbDf-paU8ZiuhI0oQ3pED7aSeFIu97NSZnSsKBzXSTQ7aUELvgm0Hu7vplf0ZWxpr6YNhBFeEXsi5yaXigD2weXIq7pJng9xfwR0HVV_eAYyDrY6a63f6IacldQsAzAfCXLDSWambekuaNx40dm5EpUZTH7adkDOUzii3o-ss9-G9_bovqvmjH-_TESAlZvWmBQKZVShSx1ZyVWawY5Xrnq_suV9naUQNzQzWpJXV6OfXoHfLOAzSTfLggvDnOLuvcCyOABsbUhOPe0aXlxgGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggSCIBhEAEyAooCOgKAQEi9_cE6-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2M-HZEgajTw3X7PQ-IDPHUpd70Vg%26client%3Dca-pub-6685813834444181%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::24 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e8352753b3895c3d27a9ff57c36377fc65821ebee528bed306a62a797ac04094

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 29 Jun 2023 10:20:27 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.us.criteo.net/heavyad?cppv=3&cpp=UsA6SnDk_HRver-D1DLIoNu5_Nm8ixictlu-VT3ORXssVY8cxdZGFKGvkNaikLvfgV7BAayQGiRrjA9tes95HADfdNH0fjcJZABEf0PViMgqsj7n-rPObdKS-VdUfh-cP7C4e1HA3rIxfVbbMUHQuyii1Vx9pFxx9N0tlpQFiiWMY3n98ujc3dA10OaDfqLWShyKLjheAQpFMpK1jj09wg0LGU8YZ9BmSCgwql9JABWnzpWUUS5YPO-sLKvbBJGuWn15Sg"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 57368597
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/ Frame A37D 3 KB
1 KB 37ms
36ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 20:27:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49993
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 12 Jul 2023 20:27:14 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/ Frame A37D 20 KB
8 KB 35ms
34ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230626/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4a038eb56ed2eb8fb4701ef93757a4d42a433508714b8a11b426e6a9ac3f350

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 20:27:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49993
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8312
x-xss-protection: 0
server: cafe
etag: 8395464388031192745
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 12 Jul 2023 20:27:14 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A37D 179 KB
56 KB 64ms
64ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230626/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6914d47718a28ab8055edac273b3aff57e64e5bddccc616c2b7e355fe986f39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57260
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1687952195399670"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Jun 2023 10:20:28 GMT

GET
H2 200 playfairdisplay-400-latin.woff2
static.criteo.net/design/googlefont/playfairdisplay/ Frame 624A 19 KB
20 KB 40ms
40ms Font
application/octet-stream 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-400-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-400.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

2b3fcab0b897a5fdf81ea0a1b01d80802e01544c22fb738fe6365688b9233579

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-400.css
Origin: https://ads.us.criteo.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:12:22 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f0c6-4d94"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 playfairdisplay-400-latin.woff2
static.criteo.net/design/googlefont/playfairdisplay/ Frame 48E1 19 KB
20 KB 47ms
47ms Font
application/octet-stream 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-400-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-400.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

2b3fcab0b897a5fdf81ea0a1b01d80802e01544c22fb738fe6365688b9233579

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-400.css
Origin: https://ads.us.criteo.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:12:22 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f0c6-4d94"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:27 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame B79C 2 KB
1 KB 32ms
31ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZJ1a6wAA_SsE0bJhAAUICV6jvlDp5kO8-OUe4A&u=%7CneHBKftYU6xNDoPitsho4GLvVlwuDxBZ6DUCS8gMIfU%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-pdBd4Yn-iAyg0RfPc5NXLXF37ShTWqW3dXReprTZdqqDdxKZ6LPg3fC_n0cZ1rmV5e7VlaC3Amu5uqCRlBmif_WneQ4Jwe5tSdd22mubUn5RRL-HiNYHj2QsPhJoe3ilaN3y9d_SpHaAJZQLCBE2HTxXOwTIxg3e3Dd9bv8rGnKM4g2fNxzUEkEXcOC4pXOtxRuRbz5V3uT4PNzuslVgBcbAjTltPltbpPU7eq3ho_5Q6PhOwIXnndGhKsM7oKNy_arHuUXx9NB-sgT68KP2Svv58pppFxIQNCPUBa_8AD-Nqf6tbN7x5UGiNVnyjjl6yUTT89R6nB7zjR9uOlMGfOWLbfKqR_4ztrOlcA-h8nsy3zllI14L_0OAKwesBPiQYFCRC958HUjyGP45X9KmoeDsqIJbOoe8rtII5DavgrH8lVaoWgUEDY-T5t0qWdcrnkwi-EbEV_2sS6AEWqx6L7JucMy5YvVkU8xfrbkYiMzycMEF3zzxTE7-XOxzszQbKkuXOCZ4eY-s8AonvLIb5Ln3RdsKtTj2fMy8SBKMUj6VvPYSG5mSD-t5YwlLMcNacj8Fy_xWFQKodgdM3LXNbYUj_x3VAOON&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCNRtx61qdZKv6A-HkxtYPiZCU-Aqcge-wXNqkqap0wI23ARABIABgoQKCARdjYS1wdWItNjY4NTgxMzgzNDQ0NDE4McgBCagDAcgDAqoE_gFP0En6qIK5wWk9UEfqczTKhyJ6eQ1sMPc6ulSBfCPDK7AkiScBIfP4XWW5i4p8vuBY09ALODhCAAC4vPJfvcZuohHAicYZnz1REicDWRHDMgIcojT2dEHVPsZwiTinNOUYCUaO9IKqkFX0OqlCan5F5nGRCOIeBMtyVdidyfsao_i0rjSrBVKA2zguRBuAL4SkXmn72rTGT6_3KnqosURmGc9yQrmy7m88SeCYM4eTHMr_4PfMywHHbUznMlN1RQEsp84eODaq19e1SCVLGepDkf5ivv2BK_hmV2C76UIp3-wKH-HLaDNIrbtxXsGu4Eq5HWiD-EAF6Y-FDy1NJoAGiKHur8vVqKuEAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_3a0JvHxdvFkQ_QjOydGId5cTjksA%26client%3Dca-pub-6685813834444181%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame B79C 2 KB
1 KB 34ms
33ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame B79C 308 B
636 B 35ms
30ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame B79C 293 B
621 B 33ms
29ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 lg.php
cat.va.us.criteo.com/delivery/ Frame B79C 43 B
347 B 38ms
33ms Image
image/gif 74.119.119.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.va.us.criteo.com/delivery/lg.php?cppv=3&cpp=PQhxxWdH02nrEadw42YdVD3p90REywztdlALW5L7Ng57CLHxGQCEl2Gjd4n1MscsUKG132yKE2gDfUQE13UO0F7vH3XgyLCg8uzIB_NgGj1484cIusyCmL6ROPfzsIfeAsb7aNUAD00Y5PD4iiR4YKPdkcs7frLDzmT-dJfDPjDg_qWg17AhxqFnYGGnwQ15sVxRwGLTWup5LmriKCd7VSNsPmLPj64whVftZCEYdTpdX4rjit-wb_lRxbCCJzC_caF53n1D9TPgU1WqLexwLyhp5LpHG-AGEzP9Hy26IW4P8xZcSwEjtP1IaYHu4HGDANW0Jy9EnRwb4ijv5u4RWEgwNh38T_5Sxwc4SomMSz7UE0R_4_gxHd6pjMZIA-AXgx5_N2DOde6A316d6HEw3B8hH6f8_-889CvckTuP0zyCJYYJ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3193853
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3

200

B24217808.274313803;dc_pre=CMH--uSg6P8CFa1FcgodAJoFcQ;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aeb1af35110a3892365a7e1493b;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=
ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/ Frame B79C
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aeb1af35110a3892365a7e1493b;dc_lat=;dc_rdid=;tag_for_child_directed...
https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_pre=CMH--uSg6P8CFa1FcgodAJoFcQ;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aeb1af35110a3892365a7e1493b;dc_la...

42 B
63 B

56ms
55ms

Image
image/gif

142.251.40.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_pre=CMH--uSg6P8CFa1FcgodAJoFcQ;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aeb1af35110a3892365a7e1493b;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?

Requested by

Protocol

Server

142.251.40.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jun 2023 10:20:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 29 Jun 2023 10:20:28 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_pre=CMH--uSg6P8CFa1FcgodAJoFcQ;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aeb1af35110a3892365a7e1493b;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 37D5 2 KB
1 KB 31ms
30ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZJ1a6wAA_SwE0bJhAAUICTqIH6sXhi2A1OAxAA&u=%7CneHBKftYU6wXIZh8DmWMO676jZummJ7XF%2BqW1bgpbJM%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-pdBd4Yn-iAyg0RfPc5NXLXF37ShTWqW3dXReprTZdqqDdxKZ6LPg3fC_n0cZ1rmV5e7VlaC3AmtiRxcvx7B1QNv8IFUIEbw6vEo1ODCm0Lpwaxh3U0JQBd-DkMTrHlxEZsRCISG_3S3jyv-Z9g9-1UP_neoJPMlsvOw4e8gAMeDOIArW3uN-QS6yN09wwfSu3cBDb8KE4SeYcjKyIPXv5MCfm48gX79duRiqv3m4anNb93A3SPs1hzSjwu3IX4OciD7oto02A3NpL8BLoAwnTZAcYXx0OmbXGvRo0Jl2zYQYRBgvbNhcW44FQwGsNhihqm2tD4ipeYeSkNRgFaDdRBASIK43NWeO9QWgNNRzG4vyHlD5rQtmK047V17AvOQl6EZtFmo5WrjzRza6pXYYe5CBT7BgAyenhBC9q_ApXnJpwfuHdzJ3Hvl5lNYozbDUqRfyYZz3sHrJV4YY5O6c8vorsCP5ZX-AoVc3gpanTtFFbkophamx3QCrq9SaCMUPZdyT6EWCaqzFSn7BCrgxAl9Ja1o6J1aLGH3z6ZnrfzV9f7r2MuEPNgI0n7W-Gj7QkYHwh17d-YP2tSJLplQYFi7xrQVymnaH&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCvTsC61qdZKz6A-HkxtYPiZCU-Aqcge-wXNqkqap0wI23ARABIABgoQKCARdjYS1wdWItNjY4NTgxMzgzNDQ0NDE4McgBCagDAcgDAqoE_gFP0A28PS2zDY6rPdyugfqJV_sWB8qDvF71FPAn2DY1D4rRU21vBwvQ1NTyBoVVh3uPVrbE3g1ds0ye3JG9jajt1xmjNJjGk_iwpzEksX_KzjwxXs9nqZTCeGMedEa_2eX93V946u-JstUOCd9iSJ8AE6_GkodlUH7Wt0TxDUWMx1qcAr-8bDpIf3yE-MkHboM1G4d0P_xMkFXmKT-324XGOMTJOM3QXzrsjsFcIljOTsBq3T0xxQX18GZeHLImYnTYSgXzwQ3u8hKluUi6_Zg_W0hSre96-r_8pKQF4DF_SdGpLMaAp_kSEzn1HiXWsup29xw5NaILzhNwC-iocYAGiKHur8vVqKuEAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0DJExMoK_xHYPXbQPIxU-Joe7BbA%26client%3Dca-pub-6685813834444181%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 37D5 2 KB
1 KB 32ms
32ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 37D5 308 B
636 B 36ms
32ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 37D5 293 B
621 B 33ms
30ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 lg.php
cat.va.us.criteo.com/delivery/ Frame 37D5 43 B
347 B 37ms
34ms Image
image/gif 74.119.119.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.va.us.criteo.com/delivery/lg.php?cppv=3&cpp=D1t672dH02nrEadw42YdVD3p90Rj3lCjgXdZwClkAv-YAzsnEtUGk-UX6UWezlH1wd2lpKgLfuflGPMc9TfKOijICs2hw9Bps2xI8BRzHhVbWRP8PO-dRa8IQ2MNFmDxSTvWQ91Xu8BARBVnOnmk6ekWvHWbw71uJhm720Q_ARXPe6G1-moXtaUxrGgK4CU--KgagxlXQSZ79nL3_Q3qfVSzPiH6wh6cEIxiUOydWkuL_p4rg9Ay1rzsF45LNGEUIAOpC5inO5ZWYNWAg-_4vKp63Em1dGzGVnWvuhwTX2d9QAnbDyS8bUA6_7c-82Kn-FTdOLHNS9FrGolZyHX2Ae9kCowxA-KkcfYGmxcplHN6Jol4-uR4OVz_Nqtt3eCRtxCzwvcpfn8ZuTmvCPB9FYhiYZbvrKhv2x-s1wZF97MlcujA

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2181325
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3

200

B24217808.274313803;dc_pre=CMCb_eSg6P8CFcYLcQodbOMNpw;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aeba34cc838c2be3551924b4f98;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=
ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/ Frame 37D5
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aeba34cc838c2be3551924b4f98;dc_lat=;dc_rdid=;tag_for_child_directed...
https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_pre=CMCb_eSg6P8CFcYLcQodbOMNpw;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aeba34cc838c2be3551924b4f98;dc_la...

42 B
63 B

56ms
55ms

Image
image/gif

142.251.40.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_pre=CMCb_eSg6P8CFcYLcQodbOMNpw;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aeba34cc838c2be3551924b4f98;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?

Requested by

Protocol

Server

142.251.40.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jun 2023 10:20:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 29 Jun 2023 10:20:28 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ad.doubleclick.net/ddm/trackimp/N5192.154378CRITEO/B24217808.274313803;dc_pre=CMCb_eSg6P8CFcYLcQodbOMNpw;dc_trk_aid=468619750;dc_trk_cid=132945847;ord=649d5aeba34cc838c2be3551924b4f98;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 8FD7 2 KB
1 KB 30ms
29ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZJ1a6wAA_S0E0bJhAAUICb_v0kBKAlZRDjFSSw&u=%7CneHBKftYU6yYXxwbpRmMUOYlHErn0W9N%2Fryrf0cGycs%3D%7C&c1=m7oIQCLYgBslArNoBtbzWGPvj6heTG_nq948FPMQexFgSXZ5qfLYlz1Dr0C5Jfeybmk8T_2vGR7Ob23Zd9U92InMkPzyF6xgoT0mEX5pszB9v38b_sGpYyJgeZ9x3rOhLXTvGvej4KNiD-cnToJF88IXCF6x8CBoThc2YScrLiLm1qPoF1lzyn8ds86KYKwLVcCem_-RgTHiIVkG-Zu38i5FRt8MsnNjwkd8eQaPvcV8AVe-r3LQZpOeUNzhPTEk-XwhxqTynGyuo2nKlCc8t9qndDSc0nizij0SQI0g_To9lM8vtgf7nSJ7RdyPAAtPYkDdNLpF56_wYdgctcy4VootL3kVHg_BCbkVvvSE_2iWqag64627MXEKyQLGfAGv2LO1Rri9wEy-o13cKR8hz7QF44VFRctQ2i0PWJdMovngMRsSqAnzgUJk4b_W5LXiZ5-ELgZ6zFeqHHKmP15ac7lq65_o1s7Y75GTn0gRLuwei_uJ3-72xTqS6CqtEsUj53MBkt22KzJZb_qbO8o9ZcNKwt6lV0csdiWO8LJBk6Xda90FhQureU5iMKKCEKmcw9JqeTX2uKbOMz-uKzSfY_91NMC9C-ir25uUYvm75jvcej2l0Do1Agvr30yttMzX5YqQDy0q4-o&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCsUHQ61qdZK36A-HkxtYPiZCU-Aqcge-wXNqkqap0wI23ARABIABgoQKCARdjYS1wdWItNjY4NTgxMzgzNDQ0NDE4McgBCagDAcgDAqoE_wFP0MXLBKKuZLuDWIepFBkcTmHTRrpJs3eR68QtH6pFfiHc8OrT5R5nJXVgppl_STk3vd_0v15twtkC7MAbDf-paU8ZiuhI0oQ3pED7aSeFIu97NSZnSsKBzXSTQ7aUELvgm0Hu7vplf0ZWxpr6YNhBFeEXsi5yaXigD2weXIq7pJng9xfwR0HVV_eAYyDrY6a63f6IacldQsAzAfCXLDSWambekuaNx40dm5EpUZTH7adkDOUzii3o-ss9-G9_bovqvmjH-_TESAlZvWmBQKZVShSx1ZyVWawY5Xrnq_suV9naUQNzQzWpJXV6OfXoHfLOAzSTfLggvDnOLuvcCyOABsbUhOPe0aXlxgGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggSCIBhEAEyAooCOgKAQEi9_cE6-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2M-HZEgajTw3X7PQ-IDPHUpd70Vg%26client%3Dca-pub-6685813834444181%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 8FD7 2 KB
1 KB 31ms
31ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 8FD7 308 B
636 B 30ms
28ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 8FD7 293 B
621 B 31ms
30ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 lg.php
cat.va.us.criteo.com/delivery/ Frame 8FD7 43 B
347 B 33ms
32ms Image
image/gif 74.119.119.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.va.us.criteo.com/delivery/lg.php?cppv=3&cpp=WlwBWJE_Q1RAXicmIlpj0yU52nwF7-vl782YSbkj5hT3etD6BywzruciqLbSpya0DU-ySvJpgUdJrtphE0R-AM2UD7WQeRr11fMqIS-2naaoBON5dTefMHJZjxKJQOYt5ElwhtQqWq5xhZg4qXv4DGCZ4hmMDGODCxq4r4SJ61l8P5gx_GZOlfpAWEgFonHN9K-E43yBubk5aVBK-CpvDJEFijizuaLpOWdFPtxJnmXvH1RKVEMEniGbXhr8LiJySlCx5JR-Mgk1TLZv6MDWvUa6ur_V9A-h9jzdoWFq9BWwBIjAaCJUrBvlpvdOdAXDwIWKPdNQU0kF8DG7rTPmmxEt3-G9cqBwj_2jI-YIEVwHbsWIFPT9MJPo7IdlGOuHUwdPCzqmJ1vMn-v8yMinqBUO7f--EoqJj8uovP6fbpKQ00di92-SHzxB8KnSx8bT3GtJhQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1861675
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 rest Show response
content.googleapis.com/discovery/v1/apis/plus/v1/ Frame 01C3 50 KB
8 KB 27ms
26ms XHR
application/json 2607:f8b0:4006:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://content.googleapis.com/discovery/v1/apis/plus/v1/rest?fields=kind%2Cname%2Cversion%2CrootUrl%2CservicePath%2Cresources%2Cparameters%2Cmethods%2CbatchPath%2Cid&pp=0

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.5o5-TAFr18s.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_qgszOsFrBH7bZ1Rmfwa9Mc03wLQ/cb=gapi.loaded_0?le=scs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f7164858555faeefeb31bfc26cf047999f84cfa4f5b52b119a1130784371a0

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

X-Goog-Encode-Response-If-Executable: base64
X-Origin: https://blcd.online
X-ClientDetails: appVersion=5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.198%20Safari%2F537.36&platform=Win32&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.198%20Safari%2F537.36
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Referer: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.5o5-TAFr18s.O%2Fd%3D1%2Frs%3DAHpOoo_qgszOsFrBH7bZ1Rmfwa9Mc03wLQ%2Fm%3D__features__
X-Requested-With: XMLHttpRequest
X-JavaScript-User-Agent: google-api-javascript-client/1.1.0
X-Referer: https://blcd.online

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 28 Jun 2023 17:00:21 GMT
age: 62407
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7760
x-xss-protection: 0
last-modified: Tue, 24 Sep 2019 20:45:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend"
vary: Accept-Encoding
report-to: {"group":"social-frontend","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend"}]}
content-type: application/json
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Wed, 05 Jul 2023 17:00:21 GMT

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame B79C 12 KB
5 KB 39ms
38ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5240321
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fwCB%2Fu0vFUa5t6rz1xTTyT9l6cOTy60Juf1m9yKmGft0iuDisEvCOE7jTCKyJ5GjXvXYDYIO9q6LhZch3BbFWZHJyjdO8A7G4yK4J1e2lp1Qwzb7xEIrBR2eGb9PvlIyPAJKfV5ejQIwjm0sH2S9K4Nb"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7ded6fe43ed1d14f-BUF
expires: Tue, 18 Jun 2024 10:20:28 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame B79C 12 KB
6 KB 37ms
32ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 37D5 12 KB
5 KB 41ms
37ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5240321
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rB32aCawk3JDoaD753FrC9Sz2EYtkzSV5B1FJwtnq6UWKrvLKHkjirPazOqAlJMVxA2LFetAOlGFwDblitOmaIZMQWgeN6%2B2ruqP%2FA7rFyDk10W63QbX1zIbgiqaB%2BF72%2Fr9ybgBgP9cS9lbb7G6lHSt"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7ded6fe48ed4d14f-BUF
expires: Tue, 18 Jun 2024 10:20:28 GMT

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 8FD7 12 KB
5 KB 40ms
39ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5240321
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jz0J79OuUPyp7eBgs5PuTRG1Hf7UnOuOIYXGsLHvHRMRkS%2FXb0yxyRQXEkP3wxOxKgWBNxDZnuitPdMqfrxGrA1%2BREOLo1AO7V1P4G6CHqfdbcMSXdSvbDkJWMjI5cxOqgFulnvauZgaqUazXQLUvDbC"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7ded6fe49ed5d14f-BUF
expires: Tue, 18 Jun 2024 10:20:28 GMT

GET
DATA 200
OK truncated
/ Frame A37D 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d5397c3331d4c37e8a5e627a98a4a79ac7318ea4c629cd17326e6f2e1ba3b320

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 all
csm.us.criteo.net/ Frame B79C 0
127 B 31ms
30ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.us.criteo.net/all?cppv=3&cpp=7-y1OnDk_HRver-D0CLlPQf4Ha35qFNXE2c2xdKxZSyCAL0J5gdc60k9I63rDIbJsYxJCrvxR4yCokLgy7tAAIcvdRyIYTbNRzA7NlI4-rKGaA5jGLbM7Lb3SZSPLLr81IMKabySfm8vUTeWNraJ8JGqBe3y909wkMtPAFo2xF70PoR5qSAu64chQqoy36ZVBixn7wRQNyxUroAhDQG6t3HEXZuFfzWT79vNrKR3DMx7JEtkRBwizNAFPMir9J_NXoV5Lg&sds=2&rev=87007&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame B79C 2 KB
1 KB 31ms
30ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame B79C 2 KB
1 KB 30ms
30ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 37D5 12 KB
6 KB 32ms
32ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 8FD7 12 KB
6 KB 32ms
31ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame 37D5 0
127 B 30ms
29ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.us.criteo.net/all?cppv=3&cpp=ipaCLnDk_HRver-DpFczy9zbbbxxb40Xwj3n6poz49IIlVjcL5MYaupcpRcBRHRV4gOV5dCGAyC5BIJeoDC3Zr_nAryv3SORmSo2inwjgF28DhgcZekMDkaL27MEYVeBhO5c2MmZmJIulAkUNfH0g4dCyKI8nAF056qwe4tmi0MjCWzjMRS2y3HbIAYqmDqqhXBSmkYeHHzfr54mXlZgjFoM9nAfU0TF3O1vHXa26b5DSdiP1pM5rGeO5x6V_zzA8UsBOA&sds=2&rev=87007&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 29 Jun 2023 10:20:28 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 37D5 2 KB
1 KB 31ms
31ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 37D5 2 KB
1 KB 29ms
29ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 8FD7 10 KB
10 KB 32ms
30ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?h=244&m=0&partner=3462&q=80&r=0&u=http%3A%2F%2Fstatic.va.us.criteo.net%2Fdesign%2Fdt%2F3462%2F191115%2Fb9ab23d991254a4c84a015c482fc4340_slt_logo.png&v=3&w=196&s=qbRNlTIqeE85C5zkerVRlfJ2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

7ff3927c53740adc736985f476ff4dd8f3a6a075ee1240f986a64f616648c965

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
content-length: 10176
expires: Tue, 14 May 2024 14:08:42 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 8FD7 87 KB
88 KB 42ms
40ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=3462&q=80&r=0&u=https%3A%2F%2Fassets.surlatable.com%2Fm%2F4bb5a6da12fb1fef%2Fwebimage-7434426_0922_s.jpg&v=3&w=800&s=npOjXJPEcByiQ6pqfdCsKkP-&b=1200

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

2d339ede54c9ff13631c82c37d65b6408d948ad4ee3d6df5567d5b66f05fbefa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:27 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=172800
content-length: 89423
expires: Fri, 30 Jun 2023 21:25:48 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 8FD7 91 KB
91 KB 35ms
33ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=3462&q=80&r=0&u=https%3A%2F%2Fassets.surlatable.com%2Fm%2F35469d3960a38762%2Fwebimage-4140703_01i_0718_s.jpg&v=3&w=800&s=MGPxWtYpPn5dftZwmirp9UqW&b=1200

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

2bc1333374e3d001d0d2d4a1531ed915588029212becf108221988967083f24e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=172800
content-length: 92952
expires: Fri, 30 Jun 2023 23:25:09 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 8FD7 287 KB
288 KB 69ms
68ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=3462&q=80&r=0&u=https%3A%2F%2Fassets.surlatable.com%2Fm%2F1f91bb8c519408a%2Fwebimage-4140695_06i_0718_p.jpg&v=3&w=800&s=bSDmSRZA5KOC0_3W5aNJ_G1b&b=1200

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

c7ed6ac643e5141eedce6b6706012911e067e81843b5a507f099c5deb7d2cd5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=172800
content-length: 294212
expires: Thu, 29 Jun 2023 19:02:24 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame 8FD7 0
127 B 30ms
29ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.us.criteo.net/all?cppv=3&cpp=UsA6SnDk_HRver-D1DLIoNu5_Nm8ixictlu-VT3ORXssVY8cxdZGFKGvkNaikLvfgV7BAayQGiRrjA9tes95HADfdNH0fjcJZABEf0PViMgqsj7n-rPObdKS-VdUfh-cP7C4e1HA3rIxfVbbMUHQuyii1Vx9pFxx9N0tlpQFiiWMY3n98ujc3dA10OaDfqLWShyKLjheAQpFMpK1jj09wg0LGU8YZ9BmSCgwql9JABWnzpWUUS5YPO-sLKvbBJGuWn15Sg&sds=2&rev=87007&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 29 Jun 2023 10:20:28 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 8FD7 2 KB
1 KB 32ms
31ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 8FD7 2 KB
1 KB 32ms
31ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame CE95 42 B
64 B 100ms
48ms Fetch
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuybl654NrmQa6mGdiFO8hIPekhRyyA9pc1HSpLG3McM_IYJi91_8S5SWxqiq732mcPR61NEnlm9juKf4isbnVftaQ&sig=Cg0ArKJSzN1BbTV8wIpQEAE&id=lidar2&mcvt=1122&p=0,0,280,350&mtos=1122,1122,1122,1122,1122&tos=1122,0,0,0,0&v=20230628&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1817563164&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1688034026870&rpt=522&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jun 2023 10:20:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 playfairdisplay-400.css
static.criteo.net/design/googlefont/playfairdisplay/ Frame B79C 1 KB
760 B 34ms
28ms Stylesheet
text/css 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-400.css

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

96ea11f0396cec62f5c20e6a49b719359e3030150c73ef12c15531b8e9bebd4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:12:23 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f0c7-57c"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 playfairdisplay-700.css
static.criteo.net/design/googlefont/playfairdisplay/ Frame B79C 1 KB
761 B 38ms
33ms Stylesheet
text/css 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-700.css

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

811b6e679ed2a18fb5696054a5386869bef195c0dcdd045f623dc19530216741

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:12:24 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f0c8-57c"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 playfairdisplay-400.css
static.criteo.net/design/googlefont/playfairdisplay/ Frame 37D5 1 KB
760 B 38ms
34ms Stylesheet
text/css 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-400.css

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

96ea11f0396cec62f5c20e6a49b719359e3030150c73ef12c15531b8e9bebd4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:12:23 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f0c7-57c"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 playfairdisplay-700.css
static.criteo.net/design/googlefont/playfairdisplay/ Frame 37D5 1 KB
761 B 34ms
31ms Stylesheet
text/css 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-700.css

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

811b6e679ed2a18fb5696054a5386869bef195c0dcdd045f623dc19530216741

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:12:24 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f0c8-57c"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 lato-400.css
static.criteo.net/design/googlefont/lato/ Frame 8FD7 682 B
665 B 31ms
30ms Stylesheet
text/css 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/lato/lato-400.css

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

907f0ae9397d82a7dc9eca8dfe6c5b9f0bfea55cd1af9aa9713ca667cfdb8ec4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
last-modified: Thu, 08 Dec 2022 14:04:37 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391eef5-2aa"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 lato-700.css
static.criteo.net/design/googlefont/lato/ Frame 8FD7 682 B
665 B 34ms
32ms Stylesheet
text/css 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/lato/lato-700.css

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

e797dd304119008e37d60afe6108fbc5db7fa7c2249b553b407f09997681c15f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
last-modified: Thu, 08 Dec 2022 14:04:38 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391eef6-2aa"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 lato-400-latin.woff2
static.criteo.net/design/googlefont/lato/ Frame 8FD7 23 KB
23 KB 39ms
37ms Font
application/octet-stream 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/lato/lato-400-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/lato/lato-400.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

ae5488cdee6c86ae9f892d07dfa77b93f820e132a99dd1a719cbf909168706c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/lato/lato-400.css
Origin: https://ads.us.criteo.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:04:37 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391eef5-5c1c"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 playfairdisplay-400-latin.woff2
static.criteo.net/design/googlefont/playfairdisplay/ Frame B79C 19 KB
20 KB 46ms
45ms Font
application/octet-stream 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-400-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-400.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

2b3fcab0b897a5fdf81ea0a1b01d80802e01544c22fb738fe6365688b9233579

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-400.css
Origin: https://ads.us.criteo.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:12:22 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f0c6-4d94"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 58387fca10ec4862886cccc4d3d4e79e_mark+simonson+-+proxima+nova+alt+regular-webfont.woff
static.criteo.net/design/dt/ Frame B79C 24 KB
24 KB 41ms
41ms Font
application/octet-stream 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/58387fca10ec4862886cccc4d3d4e79e_mark+simonson+-+proxima+nova+alt+regular-webfont.woff

Requested by

Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

e9fdc188060ed6e1f88c478d14ec18de88aa08f8a04920a03c707b158b91bb41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
Origin: https://ads.us.criteo.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 06 Dec 2018 15:42:02 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c09434a-5e6c"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 lato-700-latin.woff2
static.criteo.net/design/googlefont/lato/ Frame 8FD7 23 KB
23 KB 38ms
38ms Font
application/octet-stream 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/lato/lato-700-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/lato/lato-700.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

716984a7fcbaf6d6d6cc56fee107055f99154d251702b57aefcdcab4e44ba798

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/lato/lato-700.css
Origin: https://ads.us.criteo.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:04:37 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391eef5-5a00"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame 48E1 0
127 B 31ms
29ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 29 Jun 2023 10:20:28 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 playfairdisplay-400-latin.woff2
static.criteo.net/design/googlefont/playfairdisplay/ Frame 37D5 19 KB
20 KB 36ms
35ms Font
application/octet-stream 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-400-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-400.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

2b3fcab0b897a5fdf81ea0a1b01d80802e01544c22fb738fe6365688b9233579

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/playfairdisplay/playfairdisplay-400.css
Origin: https://ads.us.criteo.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:12:22 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f0c6-4d94"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H2 200 58387fca10ec4862886cccc4d3d4e79e_mark+simonson+-+proxima+nova+alt+regular-webfont.woff
static.criteo.net/design/dt/ Frame 37D5 24 KB
24 KB 42ms
41ms Font
application/octet-stream 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/58387fca10ec4862886cccc4d3d4e79e_mark+simonson+-+proxima+nova+alt+regular-webfont.woff

Requested by

Host: blcd.online
URL: https://blcd.online/mcd/hyperventilation-bonus-part/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

e9fdc188060ed6e1f88c478d14ec18de88aa08f8a04920a03c707b158b91bb41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
Origin: https://ads.us.criteo.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 06 Dec 2018 15:42:02 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c09434a-5e6c"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 23 Jun 2024 10:20:28 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 49ms
48ms XHR
application/json 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230626&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306200101/show_ads_impl_fy2021.js?bust=31075534

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bc4a4048ec3fdb29fca6864386d32354b5537b4419cfacee8c66328394acffaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11111
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 74ms
73ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306200101/show_ads_impl_fy2021.js?bust=31075534

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 29 Jun 2023 10:20:28 GMT

GET
H3 200 OneSignalSDKStyles.css
onesignal.com/sdks/ 82 KB
9 KB 59ms
58ms Stylesheet
text/css 2606:4700::6812:d73b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151602

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:28 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 184
etag: W/"4e9aaefffd5f8ae7dc83361aa2294190"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
cf-ray: 7ded6fe82e39d15b-BUF
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400
expires: Sat, 29 Jul 2023 10:20:28 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame ACDB 13 KB
5 KB 26ms
24ms Document
text/html 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blcd.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 73647
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 Jun 2023 13:53:01 GMT
expires: Thu, 27 Jun 2024 13:53:01 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 0F11 783 B
1 KB 104ms
44ms Document
text/html 2607:f8b0:4006:81f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2004 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

40bd16ebbee4e2dabcdbeba9eafd947598686a8aad98079bfcf66282afca40eb

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-8hGWjvh4uYgwCckpo3xJyw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blcd.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-8hGWjvh4uYgwCckpo3xJyw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 29 Jun 2023 10:20:28 GMT
expires: Thu, 29 Jun 2023 10:20:28 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 icon Show response
onesignal.com/api/v1/apps/d3c52460-a711-4ac7-846a-a7c8f5d2e6a3/ 44 B
702 B 208ms
170ms Fetch
application/json 2606:4700::6812:d63b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/apps/d3c52460-a711-4ac7-846a-a7c8f5d2e6a3/icon

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151602

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e51140cdcd044ad76335646936ec53196a169aace83a8b266bc1c182a944609b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:29 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: MISS
x-permitted-cross-domain-policies: none
strict-transport-security: max-age=15552000; includeSubDomains
alt-svc: h3=":443"; ma=86400
content-length: 44
x-xss-protection: 1; mode=block
x-request-id: 2372a519-2d3b-435f-b921-a1900f5e3bbd
x-runtime: 0.019959
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"e51140cdcd044ad76335646936ec5319"
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept, Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=0, private, must-revalidate
accept-ranges: bytes
cf-ray: 7ded6fe90d7dd163-BUF
access-control-allow-headers: SDK-Version

GET
H3 200 fAtTGskzFlJa5Ldh3SiPbiLEXcXjYWf8ZG_gkYEl2B0.js Show response
pagead2.googlesyndication.com/bg/ Frame ACDB 37 KB
14 KB 26ms
26ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/fAtTGskzFlJa5Ldh3SiPbiLEXcXjYWf8ZG_gkYEl2B0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c0b531ac93316525ae4b761dd288f6e22c45dc5e36167fc646fe0918125d81d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 19:16:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 140635
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14697
x-xss-protection: 0
last-modified: Mon, 19 Jun 2023 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Jun 2024 19:16:33 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 0F11 0
0 39ms
38ms Image
text/html 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230626&jk=2230865784680428&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame ACDB 0
10 B 25ms
24ms Image
text/plain 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?4cBL7w
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:20:29 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
DATA 200
OK truncated
/ 582 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c1f6b66e052e0dba3f115f59a94d7304a27a73848db4b8995e2a2017ba79046b

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A37D 42 B
64 B 45ms
44ms Fetch
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstlclUxMKKnicR0Rd31TdVHVIsMUTrbdlzqp8h0YhUoZOr574exymW-FJL21KpLl079o6xLXVEBLCqoD3nRmxMpbwY&sig=Cg0ArKJSzCew-8ZvWcNwEAE&id=lidar2&mcvt=1000&p=0,0,124,1005&mtos=304,820,1000,1000,1000&tos=304,516,180,0,0&v=20230628&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1688034027786&rpt=503&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jun 2023 10:20:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame 8FD7 0
127 B 29ms
29ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 29 Jun 2023 10:20:29 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 41ms
41ms Image
text/html 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230626&jk=2230865784680428&bg=!8_Cl8KTNAAYQ3eRoMN07ADkAdvg8Wl2m6QZnuKPddBec9bygh5WnYmBVxESFJHk3YEinfvLQotom5TfE6i97hvPsZtCJErSUQQsCAAAAdVIAAAATaAEHCgAv7CNBbXJbuEvGgt2hWGRXY4Fzfh4OZRqMbJDzHwB-ewu6TT1KLtEiW0GuHMPHJPuZAqSdNTZ0_XPhmpl5gd08SvJTNHWMjKIUoJGEZTX1NyFp6PyCBpxhIVCla4s66NuVaGvaspfckROPBXmVypmIOjwmtPl0WaXmpbU7TWLqbRq8JWfR-xlsnh9OKnMdvYngM5E4cEu8BYec9FsG34g0w5iWz_4R2xjridgEP4QNPkIMzR4gI-GAtQeJZpOqGMkDTCuEnUxw_49eXekTH4PkIFRwphmNw8jOzYPHAudi7wAnVnc07wTGyL3Qx0wDYoQiyMNf9c_uTuLvdDxxIQ0uRfctD4aZ4UBiKYwXY9TxPS10aJJmyTiMEuLp65oObLSpdM7n1kIIZPmnLeCgXB43SpEOpY4NaVSPzb7tPaDm3WeS-JmeEcmMjlGh6vubW__7-4oPyB34QUYZkN_RfyipCiixZxZIyCuVLnengy46ExTFVTdPiGO9UYOyjqujDplYbGsDhaYe5DqSIj3JLC4MroiNTYM7hkmfgYjHgBu49Ezijw5othyWbjZgFf9tOFdnf0PTXxDY5_lSQn5ehY_Khw4mM8cVoLf2jSFL9wOuF209QbBR_LpsIuQru_1SMxMEnebW9qmzZIEtM2b3UuQkUsGi1dR4CDEPoHcX7J61cgLBaDyx74GW2xGBnFm0o58-vlNB8e6m9T_r6kT1-uDxCNW2ZT5OwcVu80qqFPXSw5tOG6CQw5y260IqpsBVujngSI9mBuVqsuGKd6WKy1bSb90nYMDpvIS7pdyyKM8pB_E2E7-ZYbnP12zveRkkYUSFuzDx_XBAKqyzihhsLeME0g2vLRYL6v3mHDIcv-rAn8PENc5raRwMFjb3y2N4OhagLtXmoTV5_3TNQbUHSVrpcNTmvD3gIyhHrbV31RjacaDMvum-lZm1mIkNfYttiq4bJghe3hLb
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://blcd.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Verdicts & Comments Add Verdict or Comment

211 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.onesignal.com/	1970-01-20 12:53:55	Name: __cf_bm Value: hB0fDLRQEStN_psvxfj3anYSPNp0CvOb33e4.HIX_58-1688034026-0-AVGnGlIBUnN/bYq7yoU9jFlp+cHCs0Q0Nw52wPs12hxZVbnaTuqD/fa/DIfLa3GQAD3iKh/GbmFRCoXjIP0GA6Y=
blcd.online/	1969-12-31 23:59:59	Name: PHPSESSID Value: 5e20582b1452d7e050ee5e0ba1d6aca5
.blcd.online/	1970-01-20 22:15:30	Name: __gads Value: ID=21f0860110693657-22f64ea906e200e3:T=1688034026:RT=1688034026:S=ALNI_MatZqhB_xd2yc3Yj0kpSTfJW0T7yw
.blcd.online/	1970-01-20 22:15:30	Name: __gpi Value: UID=00000c7ac1662f56:T=1688034026:RT=1688034026:S=ALNI_MZ6rJfEhHsr1gCE236irAKPmYieHA
.doubleclick.net/	1970-01-20 22:29:54	Name: IDE Value: AHWqTUmJiuWwX-zBKb_MvFVZ9pdXudmCdrQUqWH6v90OMvRfeZBNqZMeymdjrMrRvwM
.doubleclick.net/	1970-01-20 12:53:54	Name: test_cookie Value: CheckForPermission

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6685813834444181&output=html&h=280&slotname=1338356656&adk=1817563164&adf=1156528132&pi=t.ma~as.1338356656&w=350&fwrn=4&fwrnh=100&lmt=1687308604&rafmt=1&format=350x280&url=https%3A%2F%2Fblcd.online%2Fmcd%2Fhyperventilation-bonus-part%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688034026382&bpp=7&bdt=696&idt=450&shv=r20230626&mjsv=m202306200101&ptt=9&saldr=aa&abxe=1&correlator=6844923129764&frm=20&pv=2&ga_vid=1490640896.1688034027&ga_sid=1688034027&ga_hid=525232461&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1020&ady=126&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31075534%2C42532264%2C44788442%2C44795921%2C44769661&oid=2&pvsid=2230865784680428&tmod=1842262037&uas=0&nvt=1&ref=https%3A%2F%2Fdisq.us%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=AEqw6RsLqk&p=https%3A//blcd.online&dtd=483 Message: Origin trial controlled feature not enabled: 'attribution-reporting'.
security	error	(Line 6) Message: This document requires 'TrustedScript' assignment.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.doubleclick.net
ads.us.criteo.com
adservice.google.com
apis.google.com
blcd.online
c0.wp.com
cat.va.us.criteo.com
cdn.onesignal.com
cdnjs.cloudflare.com
connect.facebook.net
content.googleapis.com
csm.us.criteo.net
csp.withgoogle.com
disq.us
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
i0.wp.com
imageproxy.us.criteo.net
onesignal.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.wp.com
rtb.va.us.criteo.com
static.criteo.net
stats.wp.com
tpc.googlesyndication.com
www.google.com
www.googletagservices.com
142.251.40.230
149.3.170.106
151.101.64.64
192.0.76.3
192.0.77.2
192.0.77.37
2606:4700::6811:180e
2606:4700::6812:d63b
2606:4700::6812:d73b
2607:f8b0:4006:809::2011
2607:f8b0:4006:80b::200a
2607:f8b0:4006:80c::2003
2607:f8b0:4006:816::2002
2607:f8b0:4006:816::200e
2607:f8b0:4006:81c::2001
2607:f8b0:4006:81f::2002
2607:f8b0:4006:81f::2004
2607:f8b0:4006:820::2002
2620:100:a001::16
2620:100:a001::24
2620:100:a001::3
2620:100:a001::4
2620:100:a001::9
2a03:2880:f012:8:face:b00c:0:1
74.119.119.147
012379c0906bea273fc92255e24ddea4ef8d10f088686ca40658de94b2cd4822
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
077bfe0738b737a566cf1dd70834894d972a0918667939e7261f1e5984f31ccd
0786f4e261cf3e68cc9411a74e80e4c2d60d6fb21aa9ca8c4c9779fbb00d5b93
08c70fae8c5a06e27f90b3b8bac23c07318fe3ead7cebd2a7ac2e56a7a6c00e0
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
0979b54eb3095f1320bc5c02f1c8b085932389e9f51aba42f20f5b9a580d0429
0d44f1f58c468d36116ea4c18f67923c2d879a0af6acde7a089acab6de347b26
0f4416798107d561cbed150d09e37a5cd107c87cd4863e50464b5f26f03ecfd4
0fb82bf5e41c73f853f681c65cc12ee22b7920c79d3fadc01018a66975641763
1060091178cbd6c843b802f516f230f1a3a1e85f1afbd6ef84d80e5430ba457e
107041c54b5502c730d03411a892ab7acd32bbb00ba27086ec6f7b156db64924
12ae632eec6299f6f0a956940407af2eba7a5e1634c127479ed4bdf248674b83
145287b36883dd3061ca7aa9229a8fa9ace2cccd50e0382b4b6201f3916b57c5
14b6d4839fa23148afe5471f8455e91f45acee7c8f7dffa933f0c17e28c4d3e9
1525cd3ea05d1c00e4b385e781749c3bac5c01570b5800198bec0a252bb6c715
157304f608868da5bb20f215a4697d4a0334aa9fe36448590c2c52982eaefa04
160dcb54eb94e021bc79bb2ccc46b521517c0a018480c81698d5b636bc7c152b
1b7c12e052b481373bb9c700a7f224e542693974274712a2c3af82c5ae85acca
1c02caf2a0f16318965676fd4b265265728d64fba2794a20b07151a4e891fca6
1ed7f43d675c0d203d845162c122fd2a7ec79093655370e9ce24e9408c80227a
1eec19b60e4d841838a41ff32165cc5a78c37886435b51e7f896ac33e3a7b20d
1f4513a435d6a3047d20a50c1e7d4263de42146c74be227f774b5e82e6357e75
1fbf195700bd0360474b57872e8c44c919d12fa198e18be34c73cda544273536
214674cc77aba35ab3567b88e2739fd08e8e96c61d279559ad61874069683ea0
21b589bbc25d38fbf4c8168b0801ce4cf9d0aa1d372ae1ac773574aaeb10c08d
240b702419d6c39ecc4896f0132ccfc9bc517e9aef0c782d99580e0c678b47d5
281cb71a8dce2cb54eb7d97777763adf4e8da177f844a913b7c979012a6a022a
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2b3fcab0b897a5fdf81ea0a1b01d80802e01544c22fb738fe6365688b9233579
2bc1333374e3d001d0d2d4a1531ed915588029212becf108221988967083f24e
2cac7b781ab6b399b631ff7cb46eb7d4cd281c0981b5671733c2897b29a53d93
2d339ede54c9ff13631c82c37d65b6408d948ad4ee3d6df5567d5b66f05fbefa
2d581ac17f4a552b7cbc6abe540df649d5dafe7ba9551a1820127daf6bd02232
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
2e65f5c3b3b4c402074c19dee3d24d6bc02a8a86b19c8c992a4a6e78b254b2cd
30a55f8debf61584a49dadf436538f66868a3980f6f1c25e96ee33c2b1831c9b
3149ad3867036735ad2b3fe265cdca8b71affb2d4aacab6aa60ae3abdaaa5840
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
3249f30a0968bf4850f7aa36f6dd0c3cdaa09a1d139ed1404c7c6b82038a6e11
32fbacbf3057baf4ea89f620cb234695cb891dde138582795dc23e6e07593b59
366b852a67aeca6a82b972ff59d842387c2a000f984976700ee15fb1045d19fa
37209a2b751204dc01191986b6ef47f27463285de8a341729c514d70a19a90fe
3aebc591462e99894c150881155ac8cabdd775d30a5a5857b9c617d6a0c0c3cc
3be7cad858cdef4952d0ddf9d6986fdbab6c736251dda1fb4e4c6a67fbff28f7
40bd16ebbee4e2dabcdbeba9eafd947598686a8aad98079bfcf66282afca40eb
411419f8049366d9a4ca8a028c5c692e7204b0f7b6d0e0b6bdec2f072d4938e5
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af
4a7ee62eb33f3bbb66c2151e5cac6bf4904e28302efc36128f3e3ccae6fde580
4d94580297c7bf41c7965a7e358f14690c2aababa4ac6d8a587c1c844f2a57b5
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
52ba8c353e1078183d18878c6e6c3d0cc8866b1672a50664b73a919a3ced7453
52d96b283621d0c4de3d56fc4ee1b4892a0aa3b4b33778b3758e10069ef038d5
52db930f81d97113dde679cac624cb5435b56d4ac486e91a0b6692d2cb615a84
52e8e2f11fab8c5f43f66daea5b6f3eb1dda5b602c5d848ed7524bf61f591721
533e264cc615ee4601da8d2c1dee4a8987319e53d4d7162272f067fbbf250020
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0
593a08b1d11451eabc7edbd4d304e31be5872d0ff4bdfac501b66138201c09d5
5a6217137430616363bc2a7917d1ebfda0a6fe2bb0b33b7eb0443367a9009c77
5a9ef2af321964aed3d0a641d24049b297550c5329f38577efa4b66164c25839
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
5cfd3418ebf7c95f8f7a9024ebfa383ff5a267a8568c9a2708c26733824bdf07
60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
62f3f809487194fcc55a3ebd88811a604ae496027bb425d4ebd15d9ae1921945
663b0ff9a2a9e499939458037a5092159905f8ca82b3fffe7d5604e4d0843820
69ddbbb1de9c425c5f594dffcc57bcd00b6aabeb75a3818541733d0a02568ee0
6b6c48b08536d1f27dbdfdd79664ddacaaf53071afb259eaef27396bddfab9de
6cd95aca183562241c146c19e088e81429b79d41065553d49c7c4733c38ffb28
716984a7fcbaf6d6d6cc56fee107055f99154d251702b57aefcdcab4e44ba798
717f6bb5f6cc69c444f54376a72dee0ca7968b2a12e7c9475247ec85c0e75a53
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
72f572c5dd07fac37e4163060402399196415573f52a70526f0e8a848bf1cff3
74475967bdd27d1efa3e20fd636afe5bb0c391494f9fa5768856bb25af4690d0
76ebf95990798f63b000b33a99b03b42c535991887eff93976266c793ab51684
7ba3de98b3a77ffce73c1d8190326add72270614f199dbf11be749fbd61f42c8
7c0b531ac93316525ae4b761dd288f6e22c45dc5e36167fc646fe0918125d81d
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
7dd293348d6b237b7f703841ca2b09a86a5072c8ddf40e95e7945e56be877cca
7eff8a4d2f5a29458fcd0011369e968d11034606827eba00149982d1a3b67c60
7ff3927c53740adc736985f476ff4dd8f3a6a075ee1240f986a64f616648c965
803249bc00e341d5efa127bc9da053669bc8edea743426f5eb011e6d434ee941
811b6e679ed2a18fb5696054a5386869bef195c0dcdd045f623dc19530216741
850f5ebb46512bfb518168645aa3ede7adb0b3edd6e61e94bd68b9f7573441c5
8741a6a7d6960fcda0dd3cc3c6fb1423d3543feb7a2bc4f40e731b19a552a264
88f21490128244f54a38864c301f0c9be49f323f6da36c5f5a6bd02175647ada
8a66116f1637a4fba274c36d309f8148b680c0a9efa7f8e2b8900e85281e3374
8ae5c399df27d869c39e5eca75301e37fe70a1bd732bea5daf28f901e2485b52
8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6
8e4f3f90a14a1f9080af34ee84abeeb6d93272b21ccf21116653df124e2a42ea
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
907f0ae9397d82a7dc9eca8dfe6c5b9f0bfea55cd1af9aa9713ca667cfdb8ec4
908b9ccc0c00803145962480e1659e36554254685a4ebea4939257dda7a05aef
90a71e9b70381e4e0d8c14ea50207cfe37b5e464bb67d673a7d0d9cad4ca8923
91ed5e638a805dedd2b3682c9b14bb3b171b2be0eed4a4c2b3c4a0ad3c8986d9
94329f59f0c55742b151c087b44b879bcfe26b053ac12487e4cd2e3cddcb49dc
968e4945d984f99ee08b9c3123dccd72e20321f7e52a39b98c38f1015c66a14c
96ea11f0396cec62f5c20e6a49b719359e3030150c73ef12c15531b8e9bebd4b
9782dc9a4ac7b585cb6c257d483499b2f0fd45c2f2535c55d6abf9401acf784b
97cf1307c16a437b77b5f7f5c9bc0b985d0745a14be5a279019aca5a3432e264
9900b23f9f49af5f34387eb63a8673a563ab131c1e171cfaf14cf8b67a466b9d
9d3460309805dade180877fa55c33f82ee4b285c61e74b76c0a921d069b99d84
9e65fb5b0032593b7b8fb12b27a01c3c2cefe7e0e231816ee2c8dda3a4355dd8
9ffbb05d9cacf3e2feefa3fed33523d3c796b7693153a93759f3dfcdf7b20cc5
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a48dea362116d7516a2cf97066a32758d353760ee02dbf900ddff86b02a16473
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a663ab80d62dfef74d113892bc1e77e22090026b5f8b606fa8f9722889a6ccdc
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
ab8517f3d5171dd42a8b9c22af6a2f944b41d00e7ea54ba02b4ed71a6c59e543
ae5488cdee6c86ae9f892d07dfa77b93f820e132a99dd1a719cbf909168706c7
b0b4118c0e1ae2a813aa461b6040e664d39ae42d5dd1e9db809e302235d2d94c
b0d02937dbf6d8e91653a55e9b529645c6549f53b14172cf27678cea7751062a
b23f49f504faa32aac548b6662ffd64412f6738496fab8be38da46c5b7121804
b25f00dd162a5ef618615e786b59911f421a03250f59515d248b033b17c6e989
b2fee1233d519bd0f709caa28ce6aec8d6720b6573d1717ffad6ced98d2b7d67
b49fd50e1ff72619f9ff0a0ffce60108a8387e928adaa8cf02de5b0f86c7cc7f
b72e2e18c4280f8e5174177a17554bee0c182158c088e6fe1826d4ebd946f963
b8449a28a151415d580be1dfd69056906199f1dd6ceb2c1b5edf61950ada9d13
b936db5880aa9b6b2f26a8d32fc2b689fb75f69d971b94194f16dba801221ffe
bc4a4048ec3fdb29fca6864386d32354b5537b4419cfacee8c66328394acffaa
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
bda61a9e4e59093c580e68c2b9b6817a2f0e5dc2b6feba9ff4dae433cc03a010
bf48379c4fd77b07208b445fd205200bab0f05a55cf2c51a69c7a047eb056fb5
c16f06e6edabd22d2c5c9d9b87260eca6faf706400dea89876de323480750489
c1f6b66e052e0dba3f115f59a94d7304a27a73848db4b8995e2a2017ba79046b
c30108a682ca0caa68d01b74ec64963ff715840b90444ec56d4ced5c028d2852
c39fb23da7c825a0a843d07f441fc5d7f93f43c118681032515f38d42d296ee1
c55902832fb84522d02ea1a60a30747403a140d8651fa748f13ba398b0c0df3a
c583913a43bf56bca2fa929fc41b6bfd165c95a6a07437369693674b2a2fd881
c71333522736bbe9bc7aaf59b478a3afe1723fd709fa28954f121531f17ee984
c7ed6ac643e5141eedce6b6706012911e067e81843b5a507f099c5deb7d2cd5a
cbc7a6942ab7353e031c2487f985f98cbe6adbc9472db853608af633e37433c6
cbe0b475e48c1ea26068c7397cfe2c763a4c80c8f98a060604ed2c666f299f3e
cc6664449f9bbeea4614a76c1dffa2d5cb67f5f3cce40da0d47eb4baf96a0462
cd2b9635ae2c035265315ebe95d5d13faf8711a8232807d0f7e8f53936157e93
d01a2ba2805c78957e15a2958135de0f3cb88e95159dd0f6c0a032bd76b1b0e9
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef
d5397c3331d4c37e8a5e627a98a4a79ac7318ea4c629cd17326e6f2e1ba3b320
d692a67352a3dfa80010c86a62761cfff05c0b1086618106a8576cc45a6a8115
d6dfc7b02a785912b4d8fc6ee690471ac4e4e2e040565d407ba9f004e7fb559c
db28e90921f6d7d59d829db878baa14e8dbd0dfcd3b688fad45ba93f4bb2dcd8
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
dc7e118b7e07217031d017282955569cb66891f527050135caadb2dd5779824f
dcf3add9ee30897e196931db9947cd4fa29f8b9244b49938f1590ed6fabe4002
e04e18c0bd70418b6195895b170d05471f39553239d0409ec6ae80bb91678eab
e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e51140cdcd044ad76335646936ec53196a169aace83a8b266bc1c182a944609b
e59c3ab5a833e49b36ec5282439b66831e35a670ceb32b8028a102fbf4af47a0
e6901ce2fc7a606f61b9c9763083228c459744f202148340680c861d15040b68
e786b109dbfadad391ba4df0f0e34e5a78db2da1d5afe27b805e6fe34e0c7f67
e797dd304119008e37d60afe6108fbc5db7fa7c2249b553b407f09997681c15f
e79c1c1a140e6afb861074c70392db54cc65a06050de2a69162ab94eb95b0516
e8352753b3895c3d27a9ff57c36377fc65821ebee528bed306a62a797ac04094
e9fdc188060ed6e1f88c478d14ec18de88aa08f8a04920a03c707b158b91bb41
ea9816f9cf6bdc94edd911b28fb3f81c1e2ea20dd57207bb4ed88ab193c7396c
eac9c04698938dd3a9c7fe2be3237e0e21d08f3d0ff768bd0bc7a121251b914a
eb14baeac955bb11e33cd7fd3fd2f698cf20db1b450325f45ea843b6cdc82366
eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f277d7c8e1fee0ec06a296197af4474e9f8062b69425f217ffd0d880c90c9163
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f4a038eb56ed2eb8fb4701ef93757a4d42a433508714b8a11b426e6a9ac3f350
f65784e5e7332dc1e4bbeacbec70fdeef4a1bea84f16ce2ee144999719d195ce
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f6914d47718a28ab8055edac273b3aff57e64e5bddccc616c2b7e355fe986f39
f7f7164858555faeefeb31bfc26cf047999f84cfa4f5b52b119a1130784371a0
faa0b0e2ee39402fa2bf6942ef83eb1bc4f92cefc7726c0668a46024938a3f0d
fc17485e208c521841c0c7b9c0bcd47af7d24d727d193135c1cb5c8b70cd4006
fe513ef974b767510d0a2b9f1b4d3afa53185b89ab617c869e5e3d6db960192c
fe66ac5df69c78be7dfcf75943079129dbf24a254e89febc5a7e916d40de43bc
ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

blcd.online Open in urlscan Pro 149.3.170.106 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

258 Requests

98 %HTTPS

72 %IPv6

16 Domains

29 Subdomains

26 IPs

2 Countries

3540 kBTransfer

10470 kBSize

6 Cookies

5 Outgoing links

Page URL History

Redirected requests

258 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 12 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

blcd.online Open in urlscan Pro
149.3.170.106 Public Scan

Screenshot
Live screenshot

Full Image

258
Requests

98 %
HTTPS

72 %
IPv6

16
Domains

29
Subdomains

26
IPs

2
Countries

3540 kB
Transfer

10470 kB
Size

6
Cookies

258 HTTP transactions
12 data transactions