efinancemanagement.com Open in urlscan Pro
2606:4700:3035::ac43:87df Public Scan

Software

sffe /

Resource Hash

020a40af4ceb596485f00199fa9c67dec5a5af90b4fe700dd291518453a2f229

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27846
x-xss-protection: 0
server: sffe
etag: "1162 / 737 of 1000 / last-modified: 1647601789"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 18 Mar 2022 20:03:41 GMT

GET
H/1.1 200
OK wrap.js Show response
confiant-integrations.global.ssl.fastly.net/gptprebidnative/202203171106/ 195 KB
63 KB 11ms
10ms Script
application/javascript 151.101.1.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202203171106/wrap.js
Requested by: Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/ZVeqITFg3t0RVj7Gh41kEbdx9DA/gpt_and_prebid/config.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 94dc5ed88ff1fe1a1a07ef36bd765bbba7247035d927e2a5c89562ac4f4ff90c

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 20:03:40 GMT
Content-Encoding: gzip
Age: 835
X-Cache: HIT
Connection: keep-alive
Content-Length: 63517
x-amz-id-2: RFfL6n44wj/SzleLa563DuZZWlU5JuQfXKXHHb4F2H1FwMg8d9DcOrmoauDiOoHpiIrMqXxAi3I=
X-Served-By: cache-yul12828-YUL
Last-Modified: Thu, 17 Mar 2022 15:09:00 GMT
Server: AmazonS3
X-Timer: S1647633821.967483,VS0,VE0
ETag: "c9dee68b719fdddde43951d8e7b657a4"
x-amz-request-id: KMM3KZA2ERCRPRZD
Via: 1.1 varnish
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Content-Type: application/javascript; charset=utf-8
X-Cache-Hits: 1166

GET
H2 200 choice.js Show response
quantcast.mgr.consensu.org/choice/PRrmquD1Ggcb1/efinancemanagement.com/ 10 KB
4 KB 78ms
32ms Script
application/javascript 2600:9000:21ec:5400:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/choice/PRrmquD1Ggcb1/efinancemanagement.com/choice.js
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/fuse.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21ec:5400:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8d5615c4964c5654fcf7870757e58f84195e8852233fb878ed14dfb720ec025c

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Fri, 18 Mar 2022 20:03:41 GMT
content-encoding: br
last-modified: Thu, 27 May 2021 01:27:13 GMT
server: AmazonS3
age: 23
etag: W/"edd2e521f43fbdf07d6b9c9204c3afa7"
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin,Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 cd63f8907abcdddac217d30e29b586a0.cloudfront.net (CloudFront)
cache-control: max-age=900
cross-origin-resource-policy: cross-origin
x-amz-cf-pop: JFK51-C1
x-amz-cf-id: tz1eYGLwPK7orkVOYgtKCgVa3uGvr5kDIrn3u1nmHyK8bhDprJ3Vxw==

GET
H3 200 pubads_impl_2022031501.js Show response
securepubads.g.doubleclick.net/gpt/ 365 KB
124 KB 50ms
20ms Script
text/javascript 142.250.64.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031501.js?cb=31065673

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b6c2cabe35ab603f2cff6d7b73775bca1d81016b1f1e06fe4da4bbf3c5766eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 15 Mar 2022 18:01:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 266513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 126660
x-xss-protection: 0
last-modified: Tue, 15 Mar 2022 08:35:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 15 Mar 2023 18:01:48 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 135 B
129 B 61ms
34ms XHR
application/json 142.250.64.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=efinancemanagement.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b83a2be14f492f6a153d15ff4111d409571524f16128925e0ebdcee2c4cd968e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0
expires: Fri, 18 Mar 2022 20:03:41 GMT

GET
H2 200 favicon.ico
ad.doubleclick.net/ 1 KB
664 B 86ms
21ms Image
image/x-icon 142.250.65.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 23:51:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72742
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0
last-modified: Tue, 08 May 2012 13:08:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/x-icon
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Mar 2022 23:51:19 GMT

GET
H2 200 px.gif
ad-delivery.net/ 43 B
944 B 61ms
22ms Image
image/gif 2606:4700:20::681a:346
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.5086057608038461
Requested by: Host: efinancemanagement.com
URL: https://efinancemanagement.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:346 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
date: Fri, 18 Mar 2022 20:03:41 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 681072
x-guploader-uploadid: ADPycdupfa7KCtOe0TVtQ1XEXjEqBcYS55h5xltmciWkwyT05QVbX3hl2G6BY1wwXXVxP-9l4WeFTPgHVnUrgCoq0nDtipi3Jg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
content-type: image/gif
content-length: 43
last-modified: Wed, 05 May 2021 19:25:32 GMT
server: cloudflare
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mBOYmoq0TZVBP8xt2%2BsvJMlVEE3QGGhxwpUqodGM%2BqbmMcpapuEjoQ60Mh1%2BlFJR3OJIas5JS9iRoJIYqfyXXJRdAY%2BX6UZb4kZBFuoAuqfFRzqskOB%2FXyH2I5YvXYU0r3E34sVHEzxj9lK%2FGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1620242732037093
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=86400
x-goog-stored-content-length: 43
accept-ranges: bytes
cf-ray: 6ee092b5fae4ca47-YUL
expires: Thu, 10 Mar 2022 23:52:29 GMT

GET
H2 200 cmp2.js Show response
quantcast.mgr.consensu.org/tcfv2/ 178 KB
47 KB 23ms
22ms Script
text/javascript 2600:9000:21ec:5400:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/tcfv2/cmp2.js?referer=efinancemanagement.com
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/choice/PRrmquD1Ggcb1/efinancemanagement.com/choice.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21ec:5400:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f639fefc365d0abb4fbf80e21378cb773d043bcbb18b9c98e35c35a8d9dca67e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:41 GMT
content-encoding: gzip
age: 42
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
access-control-max-age: 86400
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
last-modified: Thu, 03 Feb 2022 15:12:48 GMT
server: AmazonS3
etag: W/"2bfc0a543f667bae068943cd64c48635"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/javascript;charset=UTF-8
via: 1.1 cd63f8907abcdddac217d30e29b586a0.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: JFK51-C1
x-amz-cf-id: -zZl5hLBatNizi2liaLwDeabT5yVjVS0Qle8XEr2h7Z011WS_w8OSg==

GET
H2 204 pv Show response
api.btloader.com/ 0
96 B 75ms
41ms XHR
text/plain 130.211.23.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/pv?tid=kXncCrMBav&w=6230342376620032&o=5708166709903360&cv=2.0.2-8-g186cc00&r=false&vr=1600x1200&pageURL=https%3A%2F%2Fefinancemanagement.com%2F&upapi=true
Requested by: Host: publift-com.videoplayerhub.com
URL: https://publift-com.videoplayerhub.com/galleryplayer.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 18 Mar 2022 20:03:41 GMT
cache-control: no-cache, no-store, must-revalidate
vary: Origin
alt-svc: clear
via: 1.1 google

GET superpwa-sw.js
efinancemanagement.com/ Frame 0
0

POST
H3 200 rum Show response
efinancemanagement.com/cdn-cgi/ 0
170 B 18ms
17ms XHR
text/plain 2606:4700:3035::ac43:87df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://efinancemanagement.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:87df , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
content-type: application/json

Response headers

date: Fri, 18 Mar 2022 20:03:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://efinancemanagement.com
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 6ee092b6d9f77138-YUL
vary: Origin

GET
H2 200 prebid.js Show response
cdn.fuseplatform.net/publift/tags/2/2300/ 247 KB
78 KB 45ms
45ms Script
application/x-javascript 2600:141b:13::17d7:8230
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/fuse.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:13::17d7:8230 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 90f4a7b3dc3e409c590b7c740e0b97496a1a37c402058923d9eaadcc05621978

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:41 GMT
content-encoding: gzip
last-modified: Mon, 07 Mar 2022 02:42:06 GMT
server: AkamaiNetStorage
etag: "7bb702b1b92b8617f41b8819a7114548:1646620926.223442"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1800
accept-ranges: bytes
content-length: 79218
expires: Fri, 18 Mar 2022 20:33:41 GMT

GET
H2 200 arj Show response
publift-d.openx.net/w/1.0/ 174 B
594 B 223ms
191ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://publift-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fefinancemanagement.com%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=a7db2e0a-64ae-4251-8c4b-5f71a61f11f7%2Ca7db2e0a-64ae-4251-8c4b-5f71a61f11f7%2Ca7db2e0a-64ae-4251-8c4b-5f71a61f11f7%2C1a71063e-a6ad-4db3-b76d-3434da48fe9a%2C1a71063e-a6ad-4db3-b76d-3434da48fe9a%2C1a71063e-a6ad-4db3-b76d-3434da48fe9a%2C1ef8d5d5-b643-45e1-b864-8012fabd75c9%2C1ef8d5d5-b643-45e1-b864-8012fabd75c9%2C1ef8d5d5-b643-45e1-b864-8012fabd75c9%2C173fd1a6-6ad2-4d78-bced-55f296c92007%2C8fa5af46-509c-4cdb-a579-eafea96c69f0&nocache=1647633821544&gdpr=0&aus=728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250%7C120x600%2C160x600%2C300x600%7C120x600%2C160x600%2C300x600%7C120x600%2C160x600%2C300x600%7C120x600%2C160x600%2C300x600%7C120x600%2C160x600%2C300x600%7C120x600%2C160x600%2C300x600%7C300x250%7C728x90%2C970x90&divIds=fuse-slot-22258882751-1%2Cfuse-slot-22258882751-1%2Cfuse-slot-22258882751-1%2Cfuse-slot-22297992846-1%2Cfuse-slot-22297992846-1%2Cfuse-slot-22297992846-1%2Cfuse-slot-22297992849-1%2Cfuse-slot-22297992849-1%2Cfuse-slot-22297992849-1%2Cfuse-slot-22297992852-1%2Cfuse-slot-22258882754-1&auid=544009435%2C544009435%2C544009435%2C544009435%2C544009435%2C544009435%2C544009435%2C544009435%2C544009435%2C544009435%2C544009435
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.2.1 /
Resource Hash: 84c516c699acdf174c34285efac14640b51ce136c1d1e1000a76299cac5f4bd6

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:41 GMT
content-encoding: gzip
server: OXGW/17.2.1
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://efinancemanagement.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 163
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
718 B 112ms
75ms XHR
application/json 68.67.161.207
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.161.207 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-54-208-37-96.compute-1.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:41 GMT
X-Proxy-Origin: 149.56.153.180; 149.56.153.180; 802.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 1d751aa6-b0ac-4d85-abc7-9cc6939b9d95
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://efinancemanagement.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
120 B 279ms
225ms XHR
text/plain 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://efinancemanagement.com
date: Fri, 18 Mar 2022 20:03:41 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
652 B 76ms
25ms XHR
application/json 54.208.37.96
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=3.27.1&referrer=https%3A%2F%2Fefinancemanagement.com%2F&tmax=1000&gdpr=false

Requested by

Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.208.37.96 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:41 GMT
accept-ch: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width,SecCH-Viewport-Width, Sec-CH-Viewport-Height,Sec-CH-Device-Memory, Sec-CHRTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme,Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
x-auction-status: 12, 12, 12, 12, 12, 12, 12, 12, 12, 12
content-type: application/json; charset=utf-8
access-control-allow-origin: https://efinancemanagement.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 37 B
336 B 107ms
43ms XHR
application/json 104.94.205.31
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=623404&v=7.2&r=%7B%22id%22%3A%2243886eb0b423b38%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22442e3086d7368f1%22%2C%22ext%22%3A%7B%22siteID%22%3A%22623404%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2245b81d3a3c86bef%22%2C%22ext%22%3A%7B%22siteID%22%3A%22623404%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2246cce87cb58b16c%22%2C%22ext%22%3A%7B%22siteID%22%3A%22623404%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2247c0269769a7d75%22%2C%22ext%22%3A%7B%22siteID%22%3A%22623404%22%2C%22sid%22%3A%22120x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A120%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2248b27dbd7d66a1e%22%2C%22ext%22%3A%7B%22siteID%22%3A%22623404%22%2C%22sid%22%3A%22160x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A160%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22493a195a908493%22%2C%22ext%22%3A%7B%22siteID%22%3A%22623404%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%225056f4a5bd200cd%22%2C%22ext%22%3A%7B%22siteID%22%3A%22623404%22%2C%22sid%22%3A%22120x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A120%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2251bb4001af5b91c%22%2C%22ext%22%3A%7B%22siteID%22%3A%22623404%22%2C%22sid%22%3A%22160x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A160%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22521aa465ee216e1%22%2C%22ext%22%3A%7B%22siteID%22%3A%22623404%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2253e877ea9327bc4%22%2C%22ext%22%3A%7B%22siteID%22%3A%22623404%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fefinancemanagement.com%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.94.205.31 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-94-205-31.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 4213266c2c939fac999a6a5fbfaacbe8957026278b9e92dfec7d6eaa1a6b33a6

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:41 GMT
x-ak-initial-geo: CC:[CA], RC:[QC], CN:[NA], CIP:[149.56.153.180], XFF:[]
server: Apache
content-type: application/json
access-control-allow-origin: https://efinancemanagement.com
x-cs-client-geo: 19
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 37
x-ak-client-geo: 19
expires: Fri, 18 Mar 2022 20:03:41 GMT

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
320 B 104ms
53ms XHR
application/json 74.119.119.129
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=32&wv=3.27.1&cb=31452880452

Requested by

Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.129 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

bidder.va1.vip.prod.criteo.com

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 20:03:40 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://efinancemanagement.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
205 B 395ms
356ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 777ed99c4f0458ae77f918ba22899b4e73468189050bf32c446470ffbb67e978

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 20:03:41 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://efinancemanagement.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
195 B 208ms
169ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 640eb50658c6feb5c35197e348f122d43addc4f4e06878002718e71e1742be28

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 20:03:41 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://efinancemanagement.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
195 B 232ms
193ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 158cae8f2c743f9d7a95539d4e7133b693f9d6e676bf0480796c608586eda07d

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 20:03:41 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://efinancemanagement.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
205 B 280ms
242ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 9803046421d8bb156ff8f5fca2f599dcba16c853fe51cdbffb1db02f9593fce0

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 20:03:41 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://efinancemanagement.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
204 B 389ms
351ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: eac3266faa0337b07767ca7794b33bbda7b2c05307564034a1d73ddaea763d72

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 20:03:41 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://efinancemanagement.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
205 B 273ms
235ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 5e6c97ddaa6827e93ae2d15ff516d9fddd49d710b82885ef05ee062430a922d4

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 20:03:41 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://efinancemanagement.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
196 B 277ms
240ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: aa28f58969b64354f74fd1a99055168e78d101d8317c946395887408adb0f603

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 20:03:41 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://efinancemanagement.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
381 B 190ms
153ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 275eaf2d628ea921c1743ab820e19d71c33d0b94ff56988cb47e145cf1045ab7

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 20:03:41 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://efinancemanagement.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
204 B 384ms
348ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: e7acbc24ec32671bd2c28d26c2fb1a92d40999fb1c28b3d7ecb26ddf4e931fa4

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 20:03:41 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://efinancemanagement.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
205 B 271ms
235ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 8ab186761c6ae6e089df902f441099d9d224ca561ae15b0c5a41fdfd90b4f51c

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 20:03:41 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://efinancemanagement.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H2 204 / Show response
hb.emxdgt.com/ 0
163 B 150ms
91ms XHR
text/plain 54.144.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.emxdgt.com/?t=1000&ts=1647633821560&src=pbjs
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.144.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-144-93-221.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://efinancemanagement.com
date: Fri, 18 Mar 2022 20:03:41 GMT
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: security, Content-Type

POST
H2 200 v2 Show response
i.connectad.io/api/ 303 B
813 B 383ms
348ms XHR
application/json 2606:4700:10::6816:36ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://i.connectad.io/api/v2
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c406096bd56f55b11a9e95317de1b88caf028eba346e680f8ea13dbe74cba20

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 20:03:41 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: https://efinancemanagement.com
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6ee092b90db3715a-YUL
content-type: application/json
via: 1.1 google

POST
H2 200 c Show response
prebid.a-mo.net/a/ 471 B
689 B 266ms
222ms XHR
application/json 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 46d4ded92a99a82cc20e6a3c8e5ba40cd67344029cc3424e5871c847bac80a69

Request headers

Referer: https://efinancemanagement.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 20:03:41 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://efinancemanagement.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 194
content-length: 254

GET
H2 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
792 B 103ms
36ms Script
application/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=efinancemanagement.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031501.js?cb=31065673

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 82ms
34ms Script
application/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=efinancemanagement.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031501.js?cb=31065673

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 217 KB
60 KB 671ms
671ms XHR
text/plain 142.250.64.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1622716216134435&correlator=3572632728342820&eid=31065673%2C31063246&output=ldjh&gdfp_req=1&vrg=2022031501&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&iu_parts=71161633%3A22550154986%2CEFM_efinancemanagement%2Chome_header%2Chome_vrec_1%2Chome_vrec_2%2Chome_mrec_1%2Cmob_footer_sticky&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F3%2C%2F0%2F1%2F4%2C%2F0%2F1%2F5%2C%2F0%2F1%2F6&prev_iu_szs=728x90%7C970x90%7C970x250%2C120x600%7C160x600%7C300x600%2C120x600%7C160x600%7C300x600%2C300x250%2C728x90%7C970x90&ifi=1&adks=296420617%2C3886835766%2C803375848%2C2182458272%2C767581643&sfv=1-0-38&ecs=20220318&fsapi=false&prev_scp=publift_mv_testing%3Doptimized%7Cpublift_mv_testing%3Dexploration4%7Cpublift_mv_testing%3Doptimized%7Cpublift_mv_testing%3Doptimized%7Cpublift_mv_testing%3Dexploration3&eri=1&cust_params=fuse_profanity%3Dfalse%26fuse_site%3Definancemanagement.com%26fuse_path%3D%252F%26fuse_query%3D%26fuse_category%3D%26fuse_industry%3DIAB13%26inskin_yes%3Dtrue%26fuse_uuid%3D79409591-40e8-56ae-9f21-1f9c105e3f0f%26fuse_publication_id%3D2&sc=1&cookie_enabled=1&abxe=1&dt=1647633821976&lmt=1647632250&dlt=1647633820189&idt=993&biw=1600&bih=1200&adxs=436%2C1160%2C1160%2C1070%2C436&adys=73%2C547%2C2326%2C3214%2C1110&oid=2&ucis=1%7C2%7C3%7C4%7C5&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&url=https%3A%2F%2Fefinancemanagement.com%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x0%7C300x-1%7C300x-1%7C300x-1%7C1600x-1&msz=728x0%7C120x-1%7C120x-1%7C300x-1%7C728x-1&fws=132%2C128%2C128%2C128%2C644&ohw=1600%2C0%2C0%2C0%2C1600&ga_vid=580892807.1647633821&ga_sid=1647633822&ga_hid=414747934&ga_fc=true&btvi=0%7C0%7C1%7C2%7C0&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031501.js?cb=31065673

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2b0cf4fa2e648e0299c1cb99e2c17e59c9a2089be54373ea008bda2fb30360a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:42 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61071
x-xss-protection: 0
google-lineitem-id: -1,-1,5838374607,-1,5835140630
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,138370583098,-1,138370541058
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://efinancemanagement.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 87ms
41ms XHR
application/json 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022031501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031501.js?cb=31065673

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

695867fb3e1721539fbc2999c13541b9ee965f1423d1170a6f9db36e86acdcd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10556
x-xss-protection: 0

GET
H2 200 container.html Show response
6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E204 6 KB
4 KB 108ms
33ms Document
text/html 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031501.js?cb=31065673

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Fri, 18 Mar 2022 20:03:42 GMT
expires: Sat, 18 Mar 2023 20:03:42 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 128ms
64ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031501.js?cb=31065673

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 18 Mar 2022 20:03:42 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 103B 13 KB
5 KB 49ms
19ms Document
text/html 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 18 Mar 2022 17:48:17 GMT
expires: Sat, 18 Mar 2023 17:48:17 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 8125
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame E7CC 783 B
534 B 70ms
40ms Document
text/html 2607:f8b0:4006:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:808::2004 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

74877814db090fd6f7c0df01ebfaf67a39fa58d713b3a912906fd538a56fec89

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-630b+cbkkCp/+12DN63Hbg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Fri, 18 Mar 2022 20:03:42 GMT
date: Fri, 18 Mar 2022 20:03:42 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-630b+cbkkCp/+12DN63Hbg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 w5W1EixFGUzWFgZOi1zWjT-g-ai_4t-KN23ava9eLxA.js Show response
pagead2.googlesyndication.com/bg/ Frame 103B 35 KB
14 KB 47ms
20ms Script
text/javascript 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/w5W1EixFGUzWFgZOi1zWjT-g-ai_4t-KN23ava9eLxA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c395b5122c45194cd616064e8b5cd68d3fa0f9a8bfe2df8a376ddabdaf5e2f10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 21:48:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 339322
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13798
x-xss-protection: 0
last-modified: Mon, 14 Mar 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 14 Mar 2023 21:48:20 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame E7CC 0
0 78ms
72ms Image
text/html 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022031501&jk=1622716216134435&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 103B 0
9 B 19ms
19ms Image
text/plain 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?OZzBxg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 97 KB
31 KB 399ms
197ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

ff6956c6d9b77bdecabeef7eafb5625c810cf5694db1204d0a48e102ecd73c89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:42 GMT
content-encoding: gzip
last-modified: Tue, 08 Mar 2022 02:42:25 GMT
server: nginx
etag: W/"6226c291-1834f"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 19 Mar 2022 20:03:42 GMT

GET
H3 200 container.html Show response
6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 01D8 6 KB
3 KB 47ms
20ms Document
text/html 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202203171106/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 18 Mar 2022 20:03:42 GMT
expires: Sat, 18 Mar 2023 20:03:42 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame B805 6 KB
3 KB 35ms
20ms Document
text/html 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202203171106/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 18 Mar 2022 20:03:42 GMT
expires: Sat, 18 Mar 2023 20:03:42 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 1B15 0
0 44ms
44ms Fetch
image/gif 142.250.64.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsukN4op8mbHP6Am9yMJPay3bDN-0TpcCCvjWoxl2YaZLF3AI0bMCymWA5uyTjmzyEfj_sEriCR0OqZ3Oa8p9R9brfn22K0_QO2qOPpBh_AXPmu3eIO2ynysHU32sST4s3ILNAyUjXIm2UrUCqAxBcax7uaqPZxl4jXWzagKiY9OfctgucyjsFJh1lrnLphLV8cxpCxCRtgsiOIBIKcTiM1TG4AbPW2A4nGcEvGdJuJiS36erg19evGYO7BB_q7MC7w5p9BdQfe8QANkY0IEshRXeRD3Yf2pFreO4rb8zXl4zVnOAqV3aTEkVjSBxlNptt-PSipmK2wWhLm5I_IOH5lcmXseJY9wfA&sai=AMfl-YTm7zYG9tERpo8wAmOC95cqK-mNvRAyvg-P6vRM3QifUjtHBW8egiIzASTdPhDQWKRhp2Vtg5QJBQ56qFLKVKqTwijfCfzF5G9jDravfithx1VXtMWGS3J6AKm4zrjr&sig=Cg0ArKJSzDKM2w4C6WqDEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:42 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 18 Mar 2022 20:03:42 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1B15 117 KB
36 KB 127ms
71ms Script
text/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc68a3e6e6f0074ff46c18beea2033fc4e8c6ee513dc0617758f45e2bdd8b88a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1647431472276194"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 18 Mar 2022 20:03:42 GMT

GET
H3 200 container.html Show response
6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame FF5F 6 KB
3 KB 19ms
19ms Document
text/html 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202203171106/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 18 Mar 2022 20:03:42 GMT
expires: Sat, 18 Mar 2023 20:03:42 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 17A3 0
0 44ms
43ms Fetch
image/gif 142.250.64.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstP80O6g3dRa-eIOATO_kXawqi2U0gq-a3Y3Z5DwC7DFvJ0_f1ihXpxRgo1qw_zJYKZaHyfS3FNW-wh3JVafYAERfnSVIm_sNKylHzM4e_U4iGw8zV9UmCbE-t9Gw4kA3pZtyKWY7shEnuQ4RS2TIChLuuASsjgVXfNcnDWZbQ_wPY3Af18pp0Abskv9W75zrTiZM6e40ZEEx0n8ZoR3w28O4LHwDtThASAmCMxMo4-w2X2lQbjXCynSqH7Rv3GYECzmHyYXMnMC5ZtA19gT2lrA0HL9Wtlv9-ymDpt-GdI0E2Jq2DKpvZmxZ9y7Zl0ke9tAYpCHc7-nrUI4j6r8zWpbUSibKQ8HqcPXTDLDg&sai=AMfl-YRrrPN40bEfPcjECXxHDAlgjueAwZk2hleVwvV4QcwlWGxrQU1Wx14k0MeDcKl4TUXAou7EFiV0Xswoh4g-gqwAqAv-sdfVeVduu4Du9ePcVHTgmHqIwOkC_VqjG4nw&sig=Cg0ArKJSzJAydqd8F5tfEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:42 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 17A3 117 KB
36 KB 96ms
96ms Script
text/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc68a3e6e6f0074ff46c18beea2033fc4e8c6ee513dc0617758f45e2bdd8b88a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1647431472276194"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 18 Mar 2022 20:03:42 GMT

GET
H/1.1 200
OK pixel
protected-by.clarium.io/ Frame 1B15 68 B
345 B 108ms
26ms Image
image/png 3.218.215.219
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_WlZlcUlURmczdDBSVmo3R2g0MWtFYmR4OURBLzI5Mzg5Njk1OTE6MTYweDYwMA==&v=5&s=v31fufa1t1p&id=eyJkZnAiOnsiYWQiOjUwNjgwMzY2OTksImMiOjEzODM3MDU4MzA5OCwibCI6NTgzODM3NDYwNywibyI6MjkzODk2OTU5MSwiQSI6Ii83MTE2MTYzMywyMjU1MDE1NDk4Ni9FRk1fZWZpbmFuY2VtYW5hZ2VtZW50L2hvbWVfdnJlY18yIiwieSI6MCwiY28iOjAsInMiOiJmdXNlLXNsb3QtMjIyOTc5OTI4NDktMSJ9fQ%3D%3D&sb=undefined&cb=4154156&h=efinancemanagement.com&d=eyJ3aCI6IldsWmxjVWxVUm1jemREQlNWbW8zUjJnME1XdEZZbVI0T1VSQkx6STVNemc1TmprMU9URTZNVFl3ZURZd01BPT0iLCJ3ZCI6eyJvIjoyOTM4OTY5NTkxLCJ3IjoiMTYwIiwiaCI6IjYwMCJ9LCJ3ciI6Mn0=
Requested by: Host: efinancemanagement.com
URL: https://efinancemanagement.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.218.215.219 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-218-215-219.compute-1.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:42 GMT
Server: nginx/1.14.0 (Ubuntu)
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 68
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK pixel
protected-by.clarium.io/ Frame 17A3 68 B
345 B 109ms
28ms Image
image/png 3.218.215.219
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_WlZlcUlURmczdDBSVmo3R2g0MWtFYmR4OURBLzI5MzY4NzE3NDc6OTcweDkw&v=5&s=v31fufa1t3i&id=eyJkZnAiOnsiYWQiOjUwNjgwMzY2OTksImMiOjEzODM3MDU0MTA1OCwibCI6NTgzNTE0MDYzMCwibyI6MjkzNjg3MTc0NywiQSI6Ii83MTE2MTYzMywyMjU1MDE1NDk4Ni9FRk1fZWZpbmFuY2VtYW5hZ2VtZW50L21vYl9mb290ZXJfc3RpY2t5IiwieSI6MCwiY28iOjAsInMiOiJmdXNlLXNsb3QtMjIyNTg4ODI3NTQtMSJ9fQ%3D%3D&sb=undefined&cb=1236901&h=efinancemanagement.com&d=eyJ3aCI6IldsWmxjVWxVUm1jemREQlNWbW8zUjJnME1XdEZZbVI0T1VSQkx6STVNelk0TnpFM05EYzZPVGN3ZURrdyIsIndkIjp7Im8iOjI5MzY4NzE3NDcsInciOiI5NzAiLCJoIjoiOTAifSwid3IiOjJ9
Requested by: Host: efinancemanagement.com
URL: https://efinancemanagement.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.218.215.219 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-218-215-219.compute-1.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:42 GMT
Server: nginx/1.14.0 (Ubuntu)
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 68
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 68ms
39ms Script
application/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=efinancemanagement.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031501.js?cb=31065673

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 62ms
35ms Script
application/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=efinancemanagement.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031501.js?cb=31065673

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 87 KB
26 KB 565ms
565ms XHR
text/plain 142.250.64.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1622716216134435&correlator=3572632728342820&eid=31065673%2C31063246&output=ldjh&gdfp_req=1&vrg=2022031501&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&iu_parts=71161633%3A22550154986%2CEFM_efinancemanagement%2Chome_vrec_2%2Cmob_footer_sticky&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F3&prev_iu_szs=120x600%7C160x600%7C300x600%2C728x90%7C970x90&ifi=6&adks=803375848%2C767581643&sfv=1-0-38&ecs=20220318&ris=1~1&rcs=1%2C1&fsapi=false&prev_scp=publift_mv_testing%3Doptimized%26in2w_key%3D2%26in2w_key2%3Dnope%2Coptimization%26in2w_key3%3Dadx984%26in2w_key4%3D--3---%2C--3---%26in2w_key5%3Doptimization%26in2w_key6%3D--3h--qgz%26in2w_key7%3D984%26in2w_key8%3D2%252C3%26in2w_key9%3Doptimization_request%26in2w_key12%3Doptimization%26in2w_key15%3Do0%26in2w_key16%3D4%26in2w_keypm%3Dfuse-slot-22297992849-1%26in2w_key9001%3D1%7Cpublift_mv_testing%3Dexploration3%26in2w_key%3D30%26in2w_key2%3Dnope%2Coptimization%26in2w_key3%3Dadx984%26in2w_key4%3D--3---%2C--3---%26in2w_key5%3Doptimization%26in2w_key6%3D--3h--qgz%26in2w_key7%3D984%26in2w_key8%3D30%252C31%26in2w_key9%3Doptimization_request%26in2w_key12%3Doptimization%26in2w_key15%3Do0%26in2w_key16%3D9%26in2w_keypm%3Dfuse-slot-22258882754-1%26in2w_key9001%3D2&eri=1&cust_params=fuse_profanity%3Dfalse%26fuse_site%3Definancemanagement.com%26fuse_path%3D%252F%26fuse_query%3D%26fuse_category%3D%26fuse_industry%3DIAB13%26inskin_yes%3Dtrue%26fuse_uuid%3D79409591-40e8-56ae-9f21-1f9c105e3f0f%26fuse_publication_id%3D2&sc=1&cookie=ID%3De7260ba4b78fc0be-22073f69e0d100f0%3AT%3D1647633822%3AS%3DALNI_MagMudE0rUE_51u1fhIab7XE_eafA&abxe=1&dt=1647633822892&lmt=1647632250&dlt=1647633820189&idt=993&biw=1600&bih=1200&adxs=1070%2C0&adys=2326%2C1110&oid=2&ucis=3%7C5&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&url=https%3A%2F%2Fefinancemanagement.com%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=300x-1%7C1600x-1&msz=300x-1%7C1600x-1&fws=0%2C516&ohw=0%2C1600&ga_vid=580892807.1647633821&ga_sid=1647633822&ga_hid=414747934&ga_fc=true&btvi=3%7C0&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031501.js?cb=31065673

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6ecd2ca192a2e290afaf46312fdad98b564b7dc0050179f2e90d7006c111559f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:43 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26350
x-xss-protection: 0
google-lineitem-id: -1,5792540072
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,138376928984
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://efinancemanagement.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 70DE 645 B
742 B 87ms
36ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPiUcRC-4HEYib6tuwEwAQ&v=APEucNVmVA90bE8diQ0ry2Bj6udSR_59XR18kbvUcdJbAJUI4BkfCzBMlqiw27TbkyuCfmg71aZEMFTgIwhlbOrQAd4coAnpPh714eAMGDoex8t1_OF1GNo

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Fri, 18 Mar 2022 20:03:42 GMT
server: cafe
cache-control: private
content-length: 285
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame B805 78 KB
33 KB 130ms
82ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D--09reaCyxqYIQUi1uj3OCeJoOs-tawW6ms7e7_JDOZDW1mfwfx8ibSBn3zyq9hyNpE3-WiZvxY0op3dMbZ8TLbPZM9WGq7TL4AOyCRB701_9AkytCv85t-DJe1uQtOLQjPKdjnkAPgWpZaGYaG0E4rY0nA&dbm_d=AKAmf-B6DDKadFUi1jdG3DvvMvVaaw886CFuAFmFh7GSu7kg_LNqT6Ba5K7SOd01mJVTCLGwcYKUmECyKo14T-pn-j_P_t_9xJmdOsFsDX7lemIDa1slNKJbr2VO8-ydROWdwrk15pntoHq6I1hg-SEYFG9pjkWk4DiF1CywgQZ1meXAfx6_Oe9wqs3lD2xuVEpt-crHHHhREq60mRPFEFLs6h-cgeMsmLVl2DMN0OeNaKdGM0APDpOAqVe5UeqBIQaSqhadNoHwAQPL890tmbndQLYPyi_e6-nmuiVUZjR5j6LVwBK6GaAgSBBLLotVlAZSEHtvA03fZV-Rj0uW_7suMISKJgkw2OJIMsu-oBdWueRKGKfElHbCOxSkQDGaHRwbtjkUMYK9rfYwPiG7zJzsdc2PoSui_I8F73oM1OzKXxDmuCETXK0VIQPdEav3DuVSKaSrRNQf050bQph0u24lXjW2Iwb9znevAdMLqlp6rDZPOwf_BcJyZyn_4vJkJ-HfU4xBHUk2KAiSd9Vd-T4AR4aB8zw3tthJ5MimpuuHMU36mVcgvkIxyRW2TEJzOrmnV9I16EEr7_aBE5ERoBU9_Hx4JNbcQp2VzxkL1-Q_kh5SMD26FqCDbq_iWSVMnTWXsYh-wefF1iagtYw1li-8T79LYKHkrEidjk78hUnsYRg1AOCI5sJSOBnG9nmjucp5MYc5yVRPW0V4tr8ymThAQmuqmY1iqzOHXx6VzATouXXB2rUyioYYV448EO9m1OlWN7QDCRN9kI0hYRU5zvbV4WvEy4wpJnKvcadB9IOBqCXAzxHyHhhNOCxVEE_GjzEQzfL3s-NW2VdvHI06_trsJOVtgLzV4gCzKepHIjee_svDQFrT0tEEpLiY8ZOCv0onzpzEYJhFdUQ41iQII1EKXYpp4sSRDds9wqVm-4fco_FlzMdHZN8yLqZsQj8Mts5KGkf1BqxhF8j0hO1VRCmrnKImYNOxN6Cbs184vpCvJBhuWN4XVafVpIFd8IN9RlFoBKX5dGETG9fmtRMSDFOWsHcMfIMibwf01PBlKoEqr5rWZdEdJ3d66lWhHoc7rEU4WkcQzD0KLbK9RGJsCZN6TWVyjEcNMTuhElk37S3hFp2h-DAIeu4S8Nm5iKJjSxmZwqglPw69KjKRCb2wSNNqHD2WaeKOpgUme8kpXQM-CKsYHUFMIQ9co7Vw2GPZWsSds1gI_dG1QQXacag8q5won6nwZKXlcu1ujzbpSX98VoDhM-r8hFU-1dJFYddAL8s5cU30xHj-3jFi7S53VuhiRcJ-oKRdU7ZV1knxYDlCrafcm-mLvanmP8yoOCUX-dZrMwKCrvhWvLlihdERftjNBtpRD6V_3xvwYpMBvNeXzgbe8gRit2fNsfBx2_iUkchSOI26t3hfjcR9EBhu72eFDyf97Uo_MOk19OWlPnsWL0F9FbOpGKqO04QOunjHrrkZug8y3sRUrEq3o0A-8e5_VPAQidLMN_VCIb9IRl5_YeyLXxgkyYMID0lDBeC0HLFWehLQ1KTxwO-AN3WFlR2EnMhMyWlKUVamvSXRcUOV7nBPE2RqZMt-4jdHImWspxuIID1TwRLAP1EpSV1WItkKdzHc4bGlYHmuNNzT_-EdOZJNEHE7XHGBmUiueDYq8AxKVS2_1VveYBWYD_BH82g564Ujh6saepX16K5YcKkkiW_QFSI0tSM80-Fy8n4oxiLu_cfY1oT_QShDP3abOdRPp8EuprV2yuzdARpEKgjZfgq7UFfhUnP7Jlzs2exyrncYRJce4cmypOYUFAmTLHQnbDOWJ_-RGWq82qlkuhOs4LlmcgXx52UwPZJFBAgEqvQAsPiFKSXIxZNMGXYi4P1BlbFYIMtuTaxMYnRGvhAY-oxSjmYzMuciPkNg9J3Gu7k-ruwZ4n-UYPP_XUbkYfw0juUzo2rR9N63RaTzaHwRfNjFiGjAdq2p3vvwo7zaV2hCLRMxa1LC3nRR396G1mZjeoXYEte4Kw879xTc05vZn1zL9txlv_norI5gLDf1z6HIhMGc1R9Zy6QzeEjDzFWV80sc9AKOffQYiQ-gd3B9f62ImNiIENU9bX9I8LOLkeSwWYQoqFWhkbkObAz43wdR1gvXRoFZGgvGoKFr135nsmOZPPxh61wE3L-vailFeMNGjrsn26tcpyLc7NTfRe2gJLM68feoZJk80SwpKoX6zWOwT-dOF4Wg7ySLH0-vUhL6Z0fkKgcc1LBU10KTtkkHkvUXPAohhyGonnXbUNWmTMqEMP7RY59PM9SMyReqwSzMTyraMhoa2VNGstsF3w4L4Krh-hPXwtFJNKVPEVhS4w9wH_L_8kMqrCe9XrZWZv6tx_9EAfs_ZT00kOlPX3Prc-ZI7ZbAPgys2QjkwZ48qyZjuex-uvMdQdcWNSLJwVMnJmZaqlyJcVoLmWPtWdeAX4rj8B7Wxy3tS175a44r61XJNOMAy15VqPUxsg-mzJ4rYzR59xWq6UtYwWJH09H_dh-ZuexFB_xPFlLn2EeF9eJMO5tDSh6chSZguZsmftLIf-ytACsP_T5IRN7mK4oQAfLm2b5ULpdRoGv9xJqMW_bBjKpjgAkifLimQND8hCkgqVkPEfd2qzMIaSoeMKHuON1MxXhglX60B-ZA9exd4IZRtOmTcQm5GklnafB5AprVwjLY-I5w8lgzO1Xf9IhRtD4W3uLZpcOJz8wW9hSxtcPb8LfEZEYkK56U0F3983gSTsaS501lkhNio9OHlFLdepDcG52FCvx0aa1pUuoRMpb4WZxZFEJJACYjka3vuyVOdDKPAboA7V_oENJMI-I7qiiQCWerkDlSj0yYPx34791hXUG0AdiGFOzMkGHqx5axLi_HjSqjwBUAvBRai05VEYCLLB9JuGBG8KrVOtJnzB8zMg87VkNmmKQM7Zalsd9hzoPVKyhag84m8amUtBbqbBmfjwC6zSXyAsQLM_EZzFZQG3YlYVIVOV6sdoxTgoTlbPJVk2Yu_ef1Aazz2kIkZ7E6mO_dkiUPmu8IZZe7KlNTKworT5rs2qbeRLSzQIvYlSN9reI67hdYOYtIiLl_OZuVwe8q1pVJONGjvpkfvB_UOGhk0OXQSm_Lr9jRcI-lUKfn2fFNn3kXkW-73RUbyTYljqrXx3xSRNqp2QLr1Av-Fe29a0Z6axPxwQ3NVNooI7cYLAA8wevYp8UYeB_akrOx0bp5s-SYX-piYJ5PcBnzuwKFsx0frwCzdnNu3NkBFvWsfq3wrmuU_kQVDGOIvVWq3eS8dqIAp6zeltcd2QQAl_mAbLm6cvHKRxST92VreshESFoMwgvAhiDINCjWEGZOXBWJUw&cid=CAASKORoAuJ5dB45IaxWuIljCP4y5WUJVcqbrMrJM7-SoRRMk3qgTqBdMJk&rfl=1%2Chttps%253A%252F%252Fefinancemanagement.com%252F%240

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28ed45aab9e6bc7dd8a96d182fbc6d7884216208a136dee43502ca0cb0ccce2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:42 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33680
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame B805 42 B
63 B 41ms
39ms Image
image/gif 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C14xlx5f76fmbtxgGFso7gqleTRjgWtZxYbUcNIXwnTir3PORO-qioZ-QC8FzvlTfxl1L_RMurz-gVITemRDxHnKHn2NgqTOzv_3mT2B8z-1GqrFw

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/ Frame B805 2 KB
1 KB 22ms
20ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/window_focus_fy2021.js

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 19:48:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 925
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 19:48:17 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B805 117 KB
36 KB 84ms
57ms Script
text/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc68a3e6e6f0074ff46c18beea2033fc4e8c6ee513dc0617758f45e2bdd8b88a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1647431472276194"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 18 Mar 2022 20:03:42 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/ Frame B805 15 KB
6 KB 23ms
21ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c82a58123e9f042fb6f68695578cff668b16b22915e0a8cb8acca14741df2bac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 19:27:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2202
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 1939740185073438140
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 19:27:00 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame B805 0
0 38ms
36ms Image
text/html 2607:f8b0:4006:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTjiDo6Jd7tx_ObbylZhiNZ0aXa4CCmnhYgrrKyZB2VUtsm_cw1JRrQZc6c5NwwhEt_g4kOxIF_-wASWe4b7vGkA5f_3Q
Requested by: Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:808::2004 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H/1.1 200
OK pixel
protected-by.clarium.io/ Frame B805 68 B
345 B 40ms
27ms Image
image/png 3.218.215.219
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_WlZlcUlURmczdDBSVmo3R2g0MWtFYmR4OURBLzM4OTg5ODAzMzozMDB4NjAw&v=5&s=v31fufa1t6a&id=eyJkZnAiOnsiYWQiOjY2MjAzNDMzLCJjIjpudWxsLCJsIjowLCJvIjozODk4OTgwMzMsIkEiOiIvNzExNjE2MzMsMjI1NTAxNTQ5ODYvRUZNX2VmaW5hbmNlbWFuYWdlbWVudC9ob21lX3ZyZWNfMSIsInkiOjEwMDUwNywiY28iOjAsInMiOiJmdXNlLXNsb3QtMjIyOTc5OTI4NDYtMSJ9fQ%3D%3D&sb=undefined&cb=2510444&h=efinancemanagement.com&d=eyJ3aCI6IldsWmxjVWxVUm1jemREQlNWbW8zUjJnME1XdEZZbVI0T1VSQkx6TTRPVGc1T0RBek16b3pNREI0TmpBdyIsIndkIjp7Im8iOjM4OTg5ODAzMywidyI6IjMwMCIsImgiOiI2MDAifSwid3IiOjJ9
Requested by: Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.218.215.219 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-218-215-219.compute-1.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:42 GMT
Server: nginx/1.14.0 (Ubuntu)
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 68
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 5B2A 645 B
349 B 36ms
35ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CK36vQEQ3JmanAMY0vi-xAEwAQ&v=APEucNUK4YsZdmicouBZlQTJBtPxwMKs9KbH18yj1zROTgacMxewh7gG8hh12XSNdPvtCJI7bxfhA7EZA0EKlxlFCRIxg52J3ALnmUyn2qZGMinNkOoOFmo

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Fri, 18 Mar 2022 20:03:42 GMT
server: cafe
cache-control: private
content-length: 285
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 01D8 106 KB
38 KB 89ms
19ms Script
text/javascript 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
Origin: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 05:01:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54137
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 19 Mar 2022 05:01:26 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20220316/r20110914/elements/html/ Frame 01D8 6 KB
3 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220316/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7b175e3d672f1560352dc7df0b4e1aaf4cf6dba4605563465df69fcceb052bbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 20:09:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 86074
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2628
x-xss-protection: 0
server: cafe
etag: 1103433747108554897
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 31 Mar 2022 20:09:09 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20220316/r20110914/ Frame 01D8 19 KB
8 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220316/r20110914/abg_lite_fy2021.js

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a1471ca7e22e8d7fbd213278b0ae7fb0aceb5315df9342f27b5c935f572a873

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 20:21:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85308
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7837
x-xss-protection: 0
server: cafe
etag: 11989895151606364259
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 31 Mar 2022 20:21:55 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 01D8 42 B
63 B 44ms
40ms Image
image/gif 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DFoYkWPKa3yQoW6ALGWox59MZLUgQeNdk6I3VkITia0hgPeQlRHdfSZtt4pm76L2-6TIi3tvjjtPAQSHLukI07n8hTrHltppgmTg0hGKSa2wy4EJA

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/ Frame 01D8 2 KB
1 KB 22ms
19ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/window_focus_fy2021.js

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 19:48:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 926
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 19:48:17 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 01D8 117 KB
36 KB 53ms
51ms Script
text/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc68a3e6e6f0074ff46c18beea2033fc4e8c6ee513dc0617758f45e2bdd8b88a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1647431472276194"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 18 Mar 2022 20:03:43 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/ Frame 01D8 15 KB
6 KB 22ms
21ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c82a58123e9f042fb6f68695578cff668b16b22915e0a8cb8acca14741df2bac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 19:27:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2203
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 1939740185073438140
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 19:27:00 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 01D8 0
0 38ms
36ms Image
text/html 2607:f8b0:4006:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRRFEL-XbYQxgsn2MDOuSZ3vvNtgLc9aXW-O9LOU9_4XdO3gFbTX_x3kjsRUhy1jqmHhLDYeAP7om4YdXqcSfjaO65DWQ
Requested by: Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:808::2004 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H/1.1 200
OK pixel
protected-by.clarium.io/ Frame 01D8 68 B
345 B 28ms
26ms Image
image/png 3.218.215.219
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_WlZlcUlURmczdDBSVmo3R2g0MWtFYmR4OURBLzM4OTg5ODAzMzo5NzB4MjUw&v=5&s=v31fufa1t81&id=eyJkZnAiOnsiYWQiOjY2MjAzNDMzLCJjIjpudWxsLCJsIjowLCJvIjozODk4OTgwMzMsIkEiOiIvNzExNjE2MzMsMjI1NTAxNTQ5ODYvRUZNX2VmaW5hbmNlbWFuYWdlbWVudC9ob21lX2hlYWRlciIsInkiOjEwMDUwNywiY28iOjAsInMiOiJmdXNlLXNsb3QtMjIyNTg4ODI3NTEtMSJ9fQ%3D%3D&sb=undefined&cb=8217893&h=efinancemanagement.com&d=eyJ3aCI6IldsWmxjVWxVUm1jemREQlNWbW8zUjJnME1XdEZZbVI0T1VSQkx6TTRPVGc1T0RBek16bzVOekI0TWpVdyIsIndkIjp7Im8iOjM4OTg5ODAzMywidyI6Ijk3MCIsImgiOiIyNTAifSwid3IiOjJ9
Requested by: Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.218.215.219 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-218-215-219.compute-1.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:43 GMT
Server: nginx/1.14.0 (Ubuntu)
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 68
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame D5D6 645 B
306 B 68ms
36ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPiUcRC-4HEY7bGtuwEwAQ&v=APEucNVVG4DieNtxNzoz9gDRTmnFv7NMUND2ykTHk40oyzRzmT_Sfu9AIM1koYAwC7QyTqeqEFlkL58d5HAqZoj3PmpbdRRtjXdSO2sXsu8Ya8g1ERxFqL4

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Fri, 18 Mar 2022 20:03:43 GMT
server: cafe
cache-control: private
content-length: 285
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame FF5F 78 KB
33 KB 112ms
83ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AgZn-MQ5D75cgvsSYcjwDZZm9Q6JYYnTBMp2JU8c0eCk929_nnCpU703x49f9JjBzko3Fst_iKDGuaedjxve7qTQN7raJkHMmzo63O1n2BEFkD912MlyztQ2gvBtF0iKbwg7OLVAvV1T2dpCtkf03SpevFEQ&dbm_d=AKAmf-D3tfcLG9BOUl5Pk6CQuUXpR87CjAxHlWvPNWQ2f1AfK3nc6nXCITmMC8v8crsLlZryoYLJhPHUm_egMTfx-J2RiYwcOq-fy9HlK1kzS3WGvOD-3Rz4eCh_IAeAHvXAV4JxipJ2blNW5kfxH70HHDW5SSeoWq8QvS4_kCUGp5WHemdloS3QbeV2csAKvAs96oe6m0DbkCNkgXD_R6ks38Dg5muuyMp9Noz49KFTrM0OB_To0rOi4f6KMGokuuMcqOUZHeUtblQer9OvVRf3moGNQ8KtG2mn0wHwf_XnS10ptSmvl-AXP3IqHNhdBBS3BKZue1SfPpsBOgahvs66um_icrKv5B7Y16lMcgHU6CZBMf5Bfd1MzVyXZyNbfU8U7Spo4_HPPoGuOucMqWU2z1p9Xh8yBe4_OjxtO4Me6F-j_TbrM994RXgVKMAGe8FR6rcUJmLu8Zet01y-mbN0nm63kYHFNlF-WCbR-nLRxkpB9IFGcOwaPfHIZKNpy_-jGPUxNyTvstpPJjJd2fcHRjmduACSkJvWK90t6uKVKLJ068f65crOtuzGLq-87aBoCit0xPm3L2i6EwUfjKLoDMXGMjo2oHQ6A64rurCBE3-D2IBp3gbbQLKRnd8daDxZZwfRaDZKpgdXI1_1CuVQkgdJWzLo3rOsNqYFdnPoapgdBDWbYe7WC6SkJadPiM2ZzNDhRFjHqIfLaO4_QFhqSu9UwyUXPV8Nj3jI6MhZjIwn5CtBXNZXjjvo2xfuvyXJ8_YJahOmIp0Rrl7y3uL1y1Xz2jt2mKwPNkiFN4Sa3NTw6mrrq-t5viFJXRJcNtaS9UWr9QAWY_Y42Vr_EXfbMqiTrnEmfLcGRj_-8WA1rK4eY_TuXpbHYiV74-oqyskFiM10SEfikozyIw6BNA93x3q5C90Y6fviwppcD1TA_hdQX6yydDZrKAVMd2YysFYGE22alXWowAvc-HQQjMllYqlfjjZ9GTtXPYkMOK4O1HNfkcLXb7XjzCKoUwtCqs7EZjpFG_jYWRJm6moJfli_eb_v9NkN6EsYl84fYAIbmmujH6eBkNMEnmQQ6GvsZ4w-QlyuHW97Xfwr2WuAMwi57mfLBY2KecDu4dr3nUlF7T2MyTyi3gZA2hPR5HeARl1YjJFOIKtXcyQZUyrSKv3yTB3vt8lTMR-X2yeI8WA6B_Nhj3ZkXxHg6flQaypH1Ej8YriNCeGeTAVcNA1o3qJlmzMgXqEkQ6wPJlitKXJamKv9A1K4qoVywd0qvyvA7wxuYGgqzvr0IV4qC2JhyaUs-JDyMDLcC0feFA59ox7sphlRTPo5LA2l6LfIaY01C42L-zEPaPJZLOTJ1phbmqcWH0wiLkkdcQ2oWhfG7qkVRs-0Hq15BOpHse1Xd4396emD61PvU-ZKOGatr8tM1OzlODEHhgadsaBLXOUFmS09PCzLB5EQ1Z8aG8Hugf8whQBYISmpj2fsRpaXhH56RdEaV5kftF_NE8cDqOpDm6KXYrJ9_yuTdHPGxJZffNc7qbu-hngsXiBGVuvBtHqotJ0YTVvT7yeHuo4LWXe4G2u9lGAauhDovnfuj-t3t8HBnEn_i145P1JVeZDiAsbrv9h0hpXBB5PEgstVQ36Yl7EoVgAF4U2YbJvARNDdiMVS_pWBXnIuzjIHV-4J5rpQlPHl382PXmRC0YCHgsNA-y7YFCb5UUYV6wrrEDzVVif7tdb-qArCL_x_Vi6h-QmEIdKocOYS5xOjaAxeY-UvvKtUUIzihZvUto6V3WFx0yusdmVzw87_REQ3sQ-5JdXepoEEUGiVn_ssF3a7KTG1RA6FeWYc8AD4l3iVoC4QKsZ-YdBA4uhNaZ7meD6iUF-KhOh23C4LYqff-hHoKPn33RvvgrtTow1UO9M8SO8PTKmX3e-C21TTHuEXIYHGw_VQf4M0ig20eLNAoeUeVbqrfWNY3QoD_AqNMH50iCxuYEvWFcKyWfVHvwO0yboBd5sRa4EuCSmrMV5bHdXSCkpF6iO_L_lI4-nzKcW3bZ1wwVa7Rl2TZfuAgxd_6lQpS6Lv2tG279FEG_VvYwRfave64hTh6UzvJimL_WnoxTQ3_m7Xx8fvT6ze2E1nwP1nHV04zMVkWdMJVYp9tyxv90CRIQf_s86j6uiCbDMH1r4Ocx6i-RJp__FaMWMDGDy2Qv3xjHpBX9e-xdnRXPN4LiaauJIyZ1ORmi57o7LGOL9DUhAYZT207BJh7wmqzGdFyED5iFlQfTSLyyXhRDMABaOrvZFZFtGGOUu6vnzqVRjfHlzCc5mLIxJfy1RNpGXnqjz6admEvhQq5bL-coLHmEQW5KyFCLDtZS7c3UOUh4mWvqT13Y_gk_ixSMdJjyQo0GVMzmlwu1cUI7307SgSzBzEqEz-0YcEVKGHAfxTfGTF7pWezdBTS_jsp_ot7lIBr1dn6a8A52Lr0SldD2W0v5S4-C3z4nFqFH8sXLyCfCVwdS5Osuh058cJ_R8d697Nx34QPwMI13LxILrlItlpGJS-ECUCc-qF0-0G5rB_TvzhBE-KLA-QkBY4b7yWnGsiPXGW-OuJsHks1-SZ0umUkj_QmARRrCfbAv99i_BamgwXBsOEezLtq0EjzwxVGT3QBKu6uusIOtmopQlptTt6OirDQb6IgmhO9lSvrgeSZG0SFKX6ZKcWNfyRLO_WvqrIJQT-O_s0TpkCsvB1FTWPVOWvnzv9hB7BKFcrs9g17JR3ujy848fS_TI9XGxW9WIyk7b03DrmFdy54vR3eBnKk_dqbCW0nhF2y33p4eJjI-kfWjXs0kaGMev38OkoPhLx_0pHUifMVga0berlmfrjFPI4nF2G3kdkehOUP3mRMIL3U287SzkCKvIUJIvxgmsOGxg3OB7X05lIcz2o0GvrW3rky-vZASUJkj4g9DoQz7jwq_EWm4cf3fd0QTrsUqw59wRAw5uQ9iwHjKU3v6_ei821ksZkGBNZNg0vORo3E4ZlzlT7ccwpXXMr5mTdbhJVSUye5WkLB1ifeBrRVRuQ2Jg46A_zq9ppoLsZf8HmjWStgoTLqXVmn47ayG43wgUZvJ_lJ3pd7KKlQI_Wb1dgf1wDHtPeNipEu75TyOJbB3hUessJylAceX1uBDBOhml3oFIJkKMHX31H-ou8SwW3gTQQ0lP3YtObAyqjln_c0WaiiURSteqVYTf8xn-8XjW9Rgz1tsvLnTB1X6YYXjRlLReneMRlAy9RUo5rleE1JZRGY1ErzMoBY0iM5OG4PSTx2RUkyJPP9wcxPjyxgIN7N0CwKRyphLp_zj8DbN5m7zZYY--jg8uNg0-eBu7tth1qzf6cXPQVWDRmm6kFS4jLDylNGIDeiZIvj7AaVpo&cid=CAASKORom_Xo2uvEm_XGb4bEQ2w9nYUlnWMHgYmgQxnxmyclexcW-gphksw&rfl=1%2Chttps%253A%252F%252Fefinancemanagement.com%252F%240

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a8f0e899f71af38488a8d489ce7ca7c096a477d322501e9a9586ec9cd3c1a918

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:43 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33601
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame FF5F 42 B
63 B 42ms
40ms Image
image/gif 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CqblQ__X2DdENisRwLLRwCpi1MGCdNol8FgL5JHm_P9KCOReRQIi5ptQayQkC8aNbWDiQYM3UV213_Q4VlionYxp2YL599K3MVGmjfoae_3KeAPrc

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/ Frame FF5F 2 KB
1 KB 22ms
19ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/window_focus_fy2021.js

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 19:48:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 926
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 19:48:17 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FF5F 117 KB
36 KB 59ms
57ms Script
text/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc68a3e6e6f0074ff46c18beea2033fc4e8c6ee513dc0617758f45e2bdd8b88a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1647431472276194"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 18 Mar 2022 20:03:43 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/ Frame FF5F 15 KB
6 KB 24ms
22ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c82a58123e9f042fb6f68695578cff668b16b22915e0a8cb8acca14741df2bac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 19:27:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2203
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 1939740185073438140
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 19:27:00 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame FF5F 0
0 38ms
36ms Image
text/html 2607:f8b0:4006:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaR2xAsU00lgROOxWfkodeF7WlC5IjZOPxsyYFVciwgAKOpKh380It2yrGlqnct5S0WaVrjC3BOwhE-HLIyW2iPq6u2EHA
Requested by: Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:808::2004 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H/1.1 200
OK pixel
protected-by.clarium.io/ Frame FF5F 68 B
345 B 31ms
29ms Image
image/png 3.218.215.219
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_WlZlcUlURmczdDBSVmo3R2g0MWtFYmR4OURBLzM4OTg5ODAzMzozMDB4MjUw&v=5&s=v31fufa1t9v&id=eyJkZnAiOnsiYWQiOjY2MjAzNDMzLCJjIjpudWxsLCJsIjowLCJvIjozODk4OTgwMzMsIkEiOiIvNzExNjE2MzMsMjI1NTAxNTQ5ODYvRUZNX2VmaW5hbmNlbWFuYWdlbWVudC9ob21lX21yZWNfMSIsInkiOjEwMDUwNywiY28iOjAsInMiOiJmdXNlLXNsb3QtMjIyOTc5OTI4NTItMSJ9fQ%3D%3D&sb=undefined&cb=8182550&h=efinancemanagement.com&d=eyJ3aCI6IldsWmxjVWxVUm1jemREQlNWbW8zUjJnME1XdEZZbVI0T1VSQkx6TTRPVGc1T0RBek16b3pNREI0TWpVdyIsIndkIjp7Im8iOjM4OTg5ODAzMywidyI6IjMwMCIsImgiOiIyNTAifSwid3IiOjJ9
Requested by: Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.218.215.219 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-218-215-219.compute-1.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:43 GMT
Server: nginx/1.14.0 (Ubuntu)
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 68
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 1B15 0
0 43ms
42ms Fetch
image/gif 142.250.64.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstTpUJEIxaKklJght0oSZuf3a-UmaMJO_G6Ero1T1vQjpkhaCOlIVo4LQmh_0lYJv7tu6Rzzo2s7jPDtpQPfnVoZw4DM8guPOrffoQcn_gK_ScY2wSBbkYZ5wB68Z4yp8D8_tvAZVJ8-NO1JIx5HpC1SF9aXurbj4Yc99wLgv0BpidDNytrnB7cZcmYgm2DLAQAxCZarTdi-CpUEZSzkQR2tfoztEHT5bXFUelM6EheEXykN_iG-SZDaAt2cUfg9L50Capvf51zhL53f09mMa9g1ePt5L6ev7y_EWIjgrRQaJUXM3o4O4TjX6CygNOQte1Ok_BILzONci2g1sUy2lXxF-wmEPlCRPIT&sai=AMfl-YTAYhlLxpDsYtq4y8OqG1jV9HVvixA7a3y_w5-H1m8_EE0co4ZmiXW3YLPkTeI3BWp0Noa8CAxsMNPN5AmKd3Ek_bJQufhivSMKtWN5zRC1LEZ2OVYslrY3NzaOPpNT&sig=Cg0ArKJSzN2--YZ2T5-kEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:43 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 18 Mar 2022 20:03:43 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 17A3 0
0 45ms
45ms Fetch
image/gif 142.250.64.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssibi6wXIHm6R_MpFgif8iZJ90GVzlIqN2RKhPf3PT1WhKmitXRXOpnoqGoAclm8u323nFdFBQLjUMc9cqnTcMPoTYwbWm5g5EtY3Wkb5iImhbCVc0iJ-se_evHwtalB3jI7C6qDnQZz0CcFXUshGGlMXFNzF6w0yif6gs22XJewZkDFikpFp4D7D-SpmPLwoeMAbiHduy2bduyuzbqjOMxc1CJ3q4WuDtKoAF-NhowZ4QK6Lg-x3ZnSb-2KH5ZEhzVLO5E4tcsmGJjTGCtfe2o76WARC5Ln9rnSZkPOHbPUSmrnKie3CfZhnyoEXTtMUoTFre_qvVYtsqVIBSmnMMmFjPBKmt3khOCdSkE5vQz&sai=AMfl-YSqgs047ZSaUaByoy1duPlCEuMQe6A_vNFwfosEsRYGR7HOg6tDmR49Bk7Uouth4dm_ETSXT4nxzMGnVYGUWlGAQM22qPoPOhMyKMa-bMueLxDqZkpGoOXzQovh-_gh&sig=Cg0ArKJSzEXMcWG1bkcEEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:43 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 18 Mar 2022 20:03:43 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 70DE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAm6UJ-uH5EfowcGxIwCl6M&google_cver=1&gdpr=0

43 B
1012 B

60ms
33ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAm6UJ-uH5EfowcGxIwCl6M&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPiUcRC-4HEYib6tuwEwAQ&v=APEucNVmVA90bE8diQ0ry2Bj6udSR_59XR18kbvUcdJbAJUI4BkfCzBMlqiw27TbkyuCfmg71aZEMFTgIwhlbOrQAd4coAnpPh714eAMGDoex8t1_OF1GNo
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 18 Mar 2022 20:03:43 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAm6UJ-uH5EfowcGxIwCl6M&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 70DE
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YjTln7BTEjh5UmV6guFeIQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAm6UJ-uH5EfowcGxIwCl6M&google_cver=1

43 B
892 B

27ms
27ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAm6UJ-uH5EfowcGxIwCl6M&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPiUcRC-4HEYib6tuwEwAQ&v=APEucNVmVA90bE8diQ0ry2Bj6udSR_59XR18kbvUcdJbAJUI4BkfCzBMlqiw27TbkyuCfmg71aZEMFTgIwhlbOrQAd4coAnpPh714eAMGDoex8t1_OF1GNo
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 18 Mar 2022 20:03:43 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAm6UJ-uH5EfowcGxIwCl6M&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 70DE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEDXmjpStESadubwuAAUktx4&google_cver=1

43 B
1017 B

153ms
148ms

Image
image/gif

68.67.161.207
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEDXmjpStESadubwuAAUktx4&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPiUcRC-4HEYib6tuwEwAQ&v=APEucNVmVA90bE8diQ0ry2Bj6udSR_59XR18kbvUcdJbAJUI4BkfCzBMlqiw27TbkyuCfmg71aZEMFTgIwhlbOrQAd4coAnpPh714eAMGDoex8t1_OF1GNo

Protocol

HTTP/1.1

Server

68.67.161.207 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:43 GMT
X-Proxy-Origin: 149.56.153.180; 149.56.153.180; 802.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 41931444-60f7-4941-9bf3-9bf6967049c9
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEDXmjpStESadubwuAAUktx4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 70DE
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY1NzI2MTIyMDQ0NTQzODY0

170 B
188 B

44ms
43ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY1NzI2MTIyMDQ0NTQzODY0

Requested by

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:43 GMT
X-Proxy-Origin: 149.56.153.180; 149.56.153.180; 802.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: b05c4729-d10a-4211-b6c8-8cd0e035983c
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY1NzI2MTIyMDQ0NTQzODY0
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 5B2A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAm6UJ-uH5EfowcGxIwCl6M&google_cver=1&gdpr=0

43 B
1012 B

60ms
33ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAm6UJ-uH5EfowcGxIwCl6M&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK36vQEQ3JmanAMY0vi-xAEwAQ&v=APEucNUK4YsZdmicouBZlQTJBtPxwMKs9KbH18yj1zROTgacMxewh7gG8hh12XSNdPvtCJI7bxfhA7EZA0EKlxlFCRIxg52J3ALnmUyn2qZGMinNkOoOFmo
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 18 Mar 2022 20:03:43 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAm6UJ-uH5EfowcGxIwCl6M&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 5B2A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YjTln7BTEjh5UmV6guFeIQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAm6UJ-uH5EfowcGxIwCl6M&google_cver=1

43 B
892 B

29ms
28ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAm6UJ-uH5EfowcGxIwCl6M&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK36vQEQ3JmanAMY0vi-xAEwAQ&v=APEucNUK4YsZdmicouBZlQTJBtPxwMKs9KbH18yj1zROTgacMxewh7gG8hh12XSNdPvtCJI7bxfhA7EZA0EKlxlFCRIxg52J3ALnmUyn2qZGMinNkOoOFmo
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 18 Mar 2022 20:03:43 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAm6UJ-uH5EfowcGxIwCl6M&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 5B2A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEDXmjpStESadubwuAAUktx4&google_cver=1

43 B
1017 B

31ms
17ms

Image
image/gif

68.67.161.207
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEDXmjpStESadubwuAAUktx4&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK36vQEQ3JmanAMY0vi-xAEwAQ&v=APEucNUK4YsZdmicouBZlQTJBtPxwMKs9KbH18yj1zROTgacMxewh7gG8hh12XSNdPvtCJI7bxfhA7EZA0EKlxlFCRIxg52J3ALnmUyn2qZGMinNkOoOFmo

Protocol

HTTP/1.1

Server

68.67.161.207 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:43 GMT
X-Proxy-Origin: 149.56.153.180; 149.56.153.180; 802.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: cd696f93-1a4b-4d21-858b-0f0ae2ad7427
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEDXmjpStESadubwuAAUktx4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5B2A
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY1NzI2MTIyMDQ0NTQzODY0

170 B
188 B

45ms
44ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY1NzI2MTIyMDQ0NTQzODY0

Requested by

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:43 GMT
X-Proxy-Origin: 149.56.153.180; 149.56.153.180; 802.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 38a6052f-fa2a-48bb-a4d6-7143b68d7d76
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY1NzI2MTIyMDQ0NTQzODY0
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 07C2 13 KB
5 KB 82ms
32ms Document
text/html 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=efinancemanagement.com&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

38701ad499623031bc05760c368f45e87e247d52738d35862bd415ff7510e839

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/

Response headers

cache-control: private, max-age=3600
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 3074
date: Fri, 18 Mar 2022 20:03:42 GMT
content-length: 5145
strict-transport-security: max-age=31536000; preload;

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 97 KB
31 KB 382ms
190ms XHR
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

ff6956c6d9b77bdecabeef7eafb5625c810cf5694db1204d0a48e102ecd73c89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:43 GMT
content-encoding: gzip
last-modified: Tue, 08 Mar 2022 02:42:25 GMT
server: nginx
etag: W/"6226c291-1834f"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 19 Mar 2022 20:03:43 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 44ms
42ms Image
image/gif 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gpt_2022031501&jk=1622716216134435&bg=!YGOlYyfNAAba2mK92to7ACkAdvg8WgbwxtkYeDC8qUnyILpT3zcDni_8zpOX3vi90gODWZr760YeDwIAAABaUgAAAAJoAQcKAHQgkWkbWmF201ib1kmMeLU9fRHKLYCHc84umcY_kGydyNSnGp3HMjL7H8CKyk91El8Oxd1tkFNDI2BOsgrE2Ut_w12RvnKjAwbWYZ38iLfY4iSE5t47IhKi_kchlZu4WeyWj7TDxOhgsCJs1MzrpKpEpyuDPJkC7Z6jGbYtLEIGBq0SiXnf3PduAKUf2T6xGgXbHIO1y2rsWUOVS0fx7MzrfaM7NTZwSCpoD5srAQrDit-vcH8sEtZVhKgGHU83xOV_46vhM3paR5VPgn2-yCqscrfPyEYcV1C_FRnrpZGe29KNrlZ3mINEKQXXmU0Mq2u2f-wVxVWdeXq892ioQupFsHxGSEqakHv8T2xRAv8Kd0I9aB9luD7_C7Nr5gbbOHdDnY6U3HcIRfVLQVvj8QRrXHhIWCLI0_nVGUgr6_TpcmV7-ppWWl_wiMMEmJfRY8AUN-wvoN3ncuGYwW0uL9DxPXA9fIjF27BrXSzeoS2edUK1zuZyiN081esL5hJ6QBU-6KCXBHIvTjoAjvx1Pfpx7lMIoE-EK34Oe1_gXwHwe5iISxbKJk9svyJGDVuUs6JZwWb3htJ6fsYh6L7gZY0XHVNhnK2MV4uz1pcf0LraPnzpByk3DaMdYVvoGSN-GTnPhJ8WvCsgQsXADfBtffZN3t-6BE9kNFYYQfDvznHrAaRwLIpWC8pcLozUjFiCxxkCRmsvXptjM12mnvrKTjjR86SSuNbQkI01Sy2d7fXZiqsBIDz-YqwwQ_vjBGvLrMQLRpnEkll_gT50ilHQQPxrz57CNZUAXhxmym2h3QzxtA6LHs_3y7Hm3c2rGxs6pb_fL4_S3-4YYIofqTEDXKY082b9yTFZNq3x0WCTjiDSA6jPjdBAGKasctyYhP6lfMK309_WXx91Qan7ci53dhwXKOa25r6yEspnnz7sbuH-_MBZjw13JwJoSDkYs6R4Y2EuPGOR5k1xA87eWjO9fDdRBrQWm5-QOMkxJSQNbveltD84T7ldsezPM63jTghcmx1xqzQTpxkaB-K3Mo8hHYzcLhkRkJTs95A4wL9OVO_Hjz3_tz0NrFwshyVeJsVYAbQGhkX3MCZ-IgIMA2Lxik5IsXDJkWZyz4-Y0IQwtdASQvj64nw0O39sLQYPbGsxjrQen3MJ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame B805 169 KB
59 KB 49ms
22ms Script
text/javascript 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
Origin: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 06:57:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47174
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60173
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 19 Mar 2022 06:57:29 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220316/r20110914/elements/html/ Frame B805 8 KB
3 KB 21ms
21ms Script
text/javascript 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220316/r20110914/elements/html/omrhp.js

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 19:53:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 638
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 19:53:05 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220316/r20110914/ Frame B805 25 KB
9 KB 20ms
20ms Script
text/javascript 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220316/r20110914/abg_lite.js

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a18b0faf6a447454e134730303202f8416b72f1d4f744b1d3b4646636240eb7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:00:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 205
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9657
x-xss-protection: 0
server: cafe
etag: 16576748017229546422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 20:00:18 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame D5D6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAm6UJ-uH5EfowcGxIwCl6M&google_cver=1&gdpr=0

43 B
1012 B

43ms
35ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAm6UJ-uH5EfowcGxIwCl6M&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPiUcRC-4HEY7bGtuwEwAQ&v=APEucNVVG4DieNtxNzoz9gDRTmnFv7NMUND2ykTHk40oyzRzmT_Sfu9AIM1koYAwC7QyTqeqEFlkL58d5HAqZoj3PmpbdRRtjXdSO2sXsu8Ya8g1ERxFqL4
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 18 Mar 2022 20:03:43 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAm6UJ-uH5EfowcGxIwCl6M&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame D5D6
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YjTln7BTEjh5UmV6guFeIQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAm6UJ-uH5EfowcGxIwCl6M&google_cver=1

43 B
892 B

28ms
27ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAm6UJ-uH5EfowcGxIwCl6M&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPiUcRC-4HEY7bGtuwEwAQ&v=APEucNVVG4DieNtxNzoz9gDRTmnFv7NMUND2ykTHk40oyzRzmT_Sfu9AIM1koYAwC7QyTqeqEFlkL58d5HAqZoj3PmpbdRRtjXdSO2sXsu8Ya8g1ERxFqL4
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 18 Mar 2022 20:03:43 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAm6UJ-uH5EfowcGxIwCl6M&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame D5D6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEDXmjpStESadubwuAAUktx4&google_cver=1

43 B
1017 B

98ms
97ms

Image
image/gif

68.67.161.207
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEDXmjpStESadubwuAAUktx4&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPiUcRC-4HEY7bGtuwEwAQ&v=APEucNVVG4DieNtxNzoz9gDRTmnFv7NMUND2ykTHk40oyzRzmT_Sfu9AIM1koYAwC7QyTqeqEFlkL58d5HAqZoj3PmpbdRRtjXdSO2sXsu8Ya8g1ERxFqL4

Protocol

HTTP/1.1

Server

68.67.161.207 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:43 GMT
X-Proxy-Origin: 149.56.153.180; 149.56.153.180; 802.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 5bdb9a29-a1fb-4326-9740-fb7af1ed775d
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEDXmjpStESadubwuAAUktx4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D5D6
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY1NzI2MTIyMDQ0NTQzODY0

170 B
188 B

37ms
36ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY1NzI2MTIyMDQ0NTQzODY0

Requested by

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:43 GMT
X-Proxy-Origin: 149.56.153.180; 149.56.153.180; 802.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 39f788fe-e838-4ca7-a7ff-def8b4f88495
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY1NzI2MTIyMDQ0NTQzODY0
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 01D8 41 KB
15 KB 23ms
20ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 23:40:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73402
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 17 Mar 2023 23:40:21 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 01D8 0
571 B 116ms
50ms Ping
image/gif 142.251.35.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssI86RAjqqlc4qxmP2UvoSdR0QTp0UYY45iILvjsxk8CDTmwWKHMfF1etmbaSp-3hX4TrDIEvVvdXEYcYvophwDtwZ2pT1WlHn2iKAyJ80k9ggzGgOUBZZ_cQ3JWK7g5VdGIovqld81uS2-3fbt5W40-EkBtY6kLNn0Ukh6ryPxvCHuXD5m3Eco2ihrW_jfHC2J_2Mq2kZxH30eG1m9Zx7pkeeuUCZjRn4qQEznScxoosTj6berbyu0MJ5S2BOah3MLwDVoorgmLziwUjyBzC_bv7HkQueKcgcNYFxbCFHVB7H-2TswbsVTzhmcJoMyH-XbE5W4R8OSWFWApUGcoY4_Wiog7D73MSp9M8j6Z4WjB_i0VTLzwLqQjMwSgrWu8GbeBI9HS-mmDox_5qFQmy9lAI8jmR8GJouaJELGizP0KKOnJaw6TulTTR4VfOZGrbr2x8eGk0_ksCRdGcSYtolamEagpoi9k6I01L-uDyrlmImUaOapSmNkqsHiCJ0ha60x2-lYWg45t2D7x_aRd1qDzAXLj-eE20VJCQlr3CmTSxdPW2eox1THnvDfGFotBprdMwhiGTEFxMkAD74_F5Ut8MCTUvrkLL4yvr1--f33kH52Z2lj1dLYwO0ojGxvpHymNXQLmCUbzvki0hsugKSbFKheetB88ZGykeibQiOvDOhX8nsRyq0bRsOklUBdOL-bqSiLJCBqzwCEEznU5tvtyUWidwflqupVign9-Qq8_11tXGeUf8Gwet46A7V2o0DnXK1fCaHDU-DNC211--e3b65RHOW_2wNbImjJaixHWCs7bTuGWopk3Cxucd0L0J53xvV9vzsvwlUKBRuLgWPcEB6rR_xCDtK1mmqFAxKu78e5uE6UspdiL5HOrr6haEPWnZD19Lqe5xcRwvukKgZfWLmo3mvNMqwbbHSPFlZ5ai6PuAf6T34nILLM_ON-v9O1Eq0a12H6X3z8VOaqr11wHLM-316ZTWnHoZyql4nsK1aS9HS1Msx_x_iga1S1U4G32LwcLNA0WoDSa0de8GTxVts4d_W1lgQFQWrbIBeu2psNkFYVSPSHDEkLVafcBVNcwCWt3qlsRoTYAP-m_rYtoGZb3GthnZM7E1tz5eBT0o0NYZ7QeHA226OjpsAibmRPZYQbD3CjcGWN7sBgdGKA4hSdcNSkmJ0ZRZUNxO4rzQlU4zFqGfkJwNX0BoxrjGjqOxuzRYy7o62CiL7yCclADTRhgOb_fYqEPbSXQ9LrT4gpBOrC6aW0w5ujyGij0w&sai=AMfl-YQ9TNYhG3FKcYaqGF2zdatDsG4i-jgsHU2qL1WCFCJzAErEYjtEIyjBiT39xYpPtejVjjRZGtMAr91wWq9l9Jml1Zs2f9XPbGUP7RidIUB-0s-aSKagmW5hKxypvIGKncWIEeMa4ig-fzf4TAmQFtXOHRo16cNpYnAsq-ryEmxj9vYM5m19btiCN6TaWKFseuyCYOnqUdsT4vEuGLoIqWDn-etkzd15q9d06m54M_9rBiHNTtBA0vDqRhr4NNkQyULg9zjBZ8Dz_GbvBD1Ce42Q4QtkLEmLoWYAe7qvgOhJoczQXCKnG_5yUVMN40oRMOzqAE2qp_yGTv8Ke3MBHT0IPcJIYKcP_CnBe_veqmqeYUyrEtXwFqTI8QRgxc9dh9dDGvK0YDT97ScPeZQaSA&sig=Cg0ArKJSzGQrTgkN8I0wEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=225&cbvp=1&cisv=r20220316.02716&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.35.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Fri, 18 Mar 2022 20:03:43 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 8220185156670690759
s0.2mdn.net/simgad/ Frame 01D8 31 KB
31 KB 48ms
21ms Image
image/jpeg 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/8220185156670690759

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

02d7be20131cbbbe123da4b407f4ea9c143ab7d009d7de35bae37de07bf1f009

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:32 GMT
x-content-type-options: nosniff
age: 170411
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31835
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:01:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:32 GMT

GET
H3 200 html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame FF5F 169 KB
59 KB 24ms
24ms Script
text/javascript 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
Origin: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 06:57:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47174
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60173
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 19 Mar 2022 06:57:29 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220316/r20110914/elements/html/ Frame FF5F 8 KB
3 KB 19ms
19ms Script
text/javascript 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220316/r20110914/elements/html/omrhp.js

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 19:53:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 638
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 19:53:05 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220316/r20110914/ Frame FF5F 25 KB
9 KB 24ms
24ms Script
text/javascript 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220316/r20110914/abg_lite.js

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a18b0faf6a447454e134730303202f8416b72f1d4f744b1d3b4646636240eb7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:00:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 205
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9657
x-xss-protection: 0
server: cafe
etag: 16576748017229546422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 20:00:18 GMT

GET
DATA 200
OK truncated
/ Frame 01D8 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cc3b71eba9647fbae6c24705315be3dd9dcf9d690595b548a272d04e61d06424

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame B805 41 KB
15 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 23:40:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73402
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 17 Mar 2023 23:40:21 GMT

GET
DATA 200
OK truncated
/ Frame B805 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b3809919d5a94375fc9468080efa91b143770b5c78c0290e3169e8d728adcd62

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

sid Show response
mug.criteo.com/ Frame 07C2
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=efinancemanagement.com&sn=ChromeSyncframe&so=0&topUrl=efinancemanagement.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=yF2Ld3xzTmMvOGpIUHovRmhzRE9KMWltZFdqMTcrTXV5WThldElTS1d2N05OVC8rMExUVEhaZ0pTV3NXOGs1RGc2U3JCUUlEczUyMmxzM1dtZ1Y4WEJuMlBESUtuVThGOFRzL2UxUGszMitOQkNLZjNlVU8rWG9iYTVnYU...

460 B
659 B

86ms
27ms

Fetch
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=yF2Ld3xzTmMvOGpIUHovRmhzRE9KMWltZFdqMTcrTXV5WThldElTS1d2N05OVC8rMExUVEhaZ0pTV3NXOGs1RGc2U3JCUUlEczUyMmxzM1dtZ1Y4WEJuMlBESUtuVThGOFRzL2UxUGszMitOQkNLZjNlVU8rWG9iYTVnYUFIT05JR3FhS1duaDYxNCtuemlmdE5SVWI4OWNxU3Y1cUlQR0xIenZhaU95bTg5NkJjeEV2RytlTWZQQ2lTWmlSMXU1V3I0cS84VEMyQkpvSCsxSU84ZTQ4bXVzdGI2Z21veDZ3S0ZKT2ZJR3VGNlR0cXdsUnhPM0xlQi9iKzBENHVCLzl0VFR2R1BFWWxTMXQwY05rS2dzMUZSMksxZFltVStLQ3EzTXQzQm50VTFjQnBIUT18&cppv=2

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

ad5b0b791d28beae5561234034c87ee37feacfce7d9604b3f4f56797e4307857

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:42 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 5833
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:42 GMT
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=yF2Ld3xzTmMvOGpIUHovRmhzRE9KMWltZFdqMTcrTXV5WThldElTS1d2N05OVC8rMExUVEhaZ0pTV3NXOGs1RGc2U3JCUUlEczUyMmxzM1dtZ1Y4WEJuMlBESUtuVThGOFRzL2UxUGszMitOQkNLZjNlVU8rWG9iYTVnYUFIT05JR3FhS1duaDYxNCtuemlmdE5SVWI4OWNxU3Y1cUlQR0xIenZhaU95bTg5NkJjeEV2RytlTWZQQ2lTWmlSMXU1V3I0cS84VEMyQkpvSCsxSU84ZTQ4bXVzdGI2Z21veDZ3S0ZKT2ZJR3VGNlR0cXdsUnhPM0xlQi9iKzBENHVCLzl0VFR2R1BFWWxTMXQwY05rS2dzMUZSMksxZFltVStLQ3EzTXQzQm50VTFjQnBIUT18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 2139
content-length: 567
expires: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 953D 22 KB
8 KB 21ms
20ms Document
text/html 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 17 Mar 2022 23:40:21 GMT
expires: Fri, 17 Mar 2023 23:40:21 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 73402
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame B805 8 KB
4 KB 91ms
18ms Script
application/javascript 2600:1400:d:58c::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=11556288&cmp=25753269&sid=2742014&plc=320686250&num=&adid=&advid=5673126&adsrv=1&region=30&btreg=495396827&btadsrv=doubleclick&crt=148659883&crtname=&chnl=&unit=&pid=&uid=&tagtype=&dvtagver=6.1.src%22type=%22text/javascript
Requested by: Host: efinancemanagement.com
URL: https://efinancemanagement.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:58c::4469 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 1e2134188ba5770173198ec9e02abedaea41d37449ae544e2fa3cb8e229ac54a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 20:03:43 GMT
Content-Encoding: gzip
Last-Modified: Thu, 17 Mar 2022 08:13:20 GMT
Server: Microsoft-IIS/10.0
ETag: "010f1dcd639d81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3290

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/15468249809515949982/ Frame 354A 119 KB
34 KB 41ms
40ms Document
text/html 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15468249809515949982/index.html?e=69&leftOffset=0&topOffset=0&c=SXjhYzOttR&t=1&renderingType=2

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d5485e4112bdf7dbe81bee34b55e6613d103916fc22ea204700449713df4f6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:43 GMT
expires: Sat, 18 Mar 2023 20:03:43 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 01 Apr 2021 19:31:44 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame B805 0
24 B 81ms
54ms Ping
image/gif 142.251.35.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvsfr4BP_tDUtaieCXEPx1-yQBWkSpFStFypVmEM-2B3gQCCuEnsNfv5uJqB3Y39oCdDtbrqZGOp7y87scKaZhiYKWWaSZboCcRdgZwUGWNsFLsytqtBLrOP-B5Slsxw2AWqZVHMlmHajxH0zFcHavEeapdNtzwLPF-DwST3AyoMgaGYW_3K-QNn68AhKSepC1ozIjFzLWjAFHk-t7eEIBLT9XwXNgSHEDOPpqurwBNlLjSHK3anGbuq3KU0oQ_JxdNspKGY9XF-gcXGHjGGJOkfTxiSuR7loYCq3by-vKRT8rwhrKLu1bMqziMaAuZ9R7sF1agKcftTY9E87N76vYkO2IiPYqO4hxWoEphzo3QFxummcRGPMkwmTSdBgO6TEnffJbSN3yaUeUC7ZAQj_-OnNzOlxGPeDJDISP2h6n3lcEYgvqUzsJv1KKoe4aDtCxSnYNM95SDHQ6RaIu9rA5vKw55DAH9sFGdjnpW9_MZCCMifBKvSJK9UpqVrnOO4f2Y-hQ8s52zpXy8SZgQVkgugzEkwBMCJIXeOgYz48zXXaut0MtrtCjnmmVequ2fhV20-jMO5GUStZnML03ViS9BVOvy8q1owaxEeZStY0VmciybEIpc3_f19O9bYvsVFv03dK-D7A9D_yYTn7GtWNGiwi6YvNH6tw2kgE-T9F9O_UAztkY1dCi159VQZR8GLIbI3Ha8IpofhsiSEuWocnaAcQUGP_Hwh3jlxvJh8mJhyl5lHtIwWe9i_jdlsIE7C0zKsa3N_UO4ywm7wG8hZnhBpZj_Df4kd0cI9r1XJtI2outYBOK_kbXP4MGiYy0-D2XR_-JKMKNy3BG7tMhSYSN9KFoWBKoM44O3JW6DzImf2oN3wsFVjBexqDTfGnZeVHB53JWh_PHg1xPBe8SXtZ62ud4MxV_BGJt5NwuooABsPY4cHJD9WIvY1ydyKFGOWo1SZu8RJNtKmTsa4iUUGMA2XxKraP9ILhef9A_xAhmGT3swrUcZTOMQ7-SEju7Lg6M1K-9MoyzbZtyjq4inIWIsW41Chtta4nsmvxA_CFPRcA9vS8P-dXox2g_WEz9ujxsrUrlyer6A9zWmJgOA8TZhztYYNpeNE474qlWv8NRbysJwvvO5SHqxz59zgEMdKxI49PXwjDPDY79gWhsZCCElGSXzYkqJNWZR8vW843aVKB9r1IqHkJi_K9YnqgHHuCkEMpQY2GmpShM2-BwFw5wIhLn2gpj3BBKHSMiEwrP7VK33_Q4qCNZi9JRaHgWBsn2Yt-o_BMXVsoa-8ZgHI5Em0V7X&sai=AMfl-YQWxvA767YYIxFMxXzspD4LJIAMh1lp3Jri8sBsmd0itC0iUSxmmZ1glfQ6fJ92Sg-jmX77812SNnnhHuesWz23dVhU6VmvObhz6pY2xJ-edVX9-S5aDKIuT1gh7Xk-RccyyW-EqWBYybBDeA_tE_eJnLOab8tOzIoa8QY4rOjrlWZya317dswS33GQ2KeMtftU1mNtVCdMruMYWTzKMnAZX_I75RaDyw&sig=Cg0ArKJSzAZlsxLlr9O5EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=208&cbvp=1&cstd=201&cisv=r20220316.69395&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Fri, 18 Mar 2022 20:03:43 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame FF5F 41 KB
15 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 23:40:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73402
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 17 Mar 2023 23:40:21 GMT

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame FF5F 8 KB
4 KB 25ms
18ms Script
application/javascript 2600:1400:d:58c::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=11556288&cmp=25753269&sid=2742014&plc=320686244&num=&adid=&advid=5673126&adsrv=1&region=30&btreg=495731955&btadsrv=doubleclick&crt=148659886&crtname=&chnl=&unit=&pid=&uid=&tagtype=&dvtagver=6.1.src%22type=%22text/javascript
Requested by: Host: efinancemanagement.com
URL: https://efinancemanagement.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:58c::4469 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 1e2134188ba5770173198ec9e02abedaea41d37449ae544e2fa3cb8e229ac54a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 20:03:43 GMT
Content-Encoding: gzip
Last-Modified: Thu, 17 Mar 2022 08:13:20 GMT
Server: Microsoft-IIS/10.0
ETag: "010f1dcd639d81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3290

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/3576529225204264240/ Frame 5E8D 118 KB
33 KB 39ms
39ms Document
text/html 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3576529225204264240/index.html?e=69&leftOffset=0&topOffset=0&c=soFmfCprkm&t=1&renderingType=2

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4688a72b77f9fa94a3befc021f2ddeea4b58a942c6f04935087fa46e12b76dd3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:43 GMT
expires: Sat, 18 Mar 2023 20:03:43 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 01 Apr 2021 19:31:46 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame FF5F 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e48929386a3b91ad3b00a46d22cb15ececa97a7c721876f25ffae555db556619

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FF5F 0
24 B 55ms
55ms Ping
image/gif 142.251.35.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstyY4VRb0XAt3har1VhwoxLodOjyHk0bmtANu9WianXFyP-AlhQGw2YFN3dlZVgusHSmpcbVFw4yyfQVAX4i0C3iSEMIk575VJyCZ8vTuUxbgb41EHp6y6jy9cDTDT3xZphRzWiHs9ENoL7a3V77rqcUfUSH5rQwmdcfVJNHmrK91XkaU_YqkPB_kIe-247H_OfAVnMAW7zmHPVU8deIDi9tdszLkbHDQtlC_Sw6bvhwllwObscvxsDPniW0h1SRqt8HJe8GfUnZZrksgLs5gd4K1sozPr4u2rg4RZ2MS6Jvp0LLfviACJNOCyy6eif3nX9zDJ3J1LdEBRFYYenIHz6_yiY4nszDSwlbUxwCYVSQyaw_VrY7askqCkMGS1Ug1iz4MpbQkOpUX-TqirqaxCECPwNJh7ympePXiShXfTYZIItK3JwZLhtdY-lNjH_6Op_1Gg1bIMmyKpK1ZRzOavlD5rJi6bJTk5Q2MkHO2Bun1OkcTmf-Y2yacTdKxW8qYV_zRsJS6Tl6RGrBugvr-MW7LQwZIfXeUBj0x7-QIFGTpeJvDfPWmCdkd0IaMZlQLcx5dwVtxR4x9ur3rbCEB1Yf6JRc2oq-z7KJNrj_i_dLz6qLGzU_XLlJk9sftCzzdWRO2K3CWHEiuqw7BvgNPXSknfPQFBjgCn2b70WP_Lwyf2FuhWp2WcPU5rWkaCCHCcCGb1XnZPv72Ion0QhQPMuUymzKodKfg4rKetqILiq8deGwqOznw58PJxlsROv6BUpOhoOr2DyHOxGZy3sQKXm1QEKppm7xZPMf-7Ef-A5zmvWC3hIROJVDbTJUF43aihVwtqEGC2Xtj4jts1yEZXAsrq2Mg9rbipq4LrI4iImhAzlyuoUM4g21y9Ev-l5PaMgw6ndVv5-iVVT11dQLk5WzrriKv3MLz3RwPKzavNSmiDx26pMcQcQUMBW9bUPZsZoi2jhl5ycszj_n4677q6QbvBcS8vf9DxHxGiJiZw6eQ5cakFEopQl8NQRXvbtlVBlU1tzu863joH3s-zfFlw2I07xJIo-1sQ2roDM4DFTiePzIfIQbd84x_dlBTR53FVRK2x5Q9huSDglrTNilnSYpZEtBmyYU4BiJ3X7CXIBeppx2DTDe0m9nlatlI7c5OSpBbiHOJcYRgH5UejiuQVkQHadGhUb6ba8dbVvYGWaKsVJd63KZ6XWBMcIXUwpynKGAI51yUvKKG1iKaKn5sqwT0vfBXiDCplkg5IVmw045l60dRB6lXoJMpQvzhc5tg2oD3Yf6AmuhMLimMofgTClocwR1CkMDR9mfN0&sai=AMfl-YQA_e_HyH8Iy9x75tNDWDTqBbwb3KHRp2HajjqPLtSX6z3gWauMuj2kUsnhB-TDlg8gE_xy4ROzEJKM8pLJUXqsCVvDP7k_m8HpN4r_Cd2qUYg5764N1u2f1kY0g6iPsv9Kl3oK6gt-cxx6E7FgP5W9tbvsxZ2qF5RcDNOM0zhh32NGzqAdotdmkY5Xw5FcbzaMOglXOC01VoKC8GDjjyPW-cUT2C5tTw&sig=Cg0ArKJSzNOEZ_P_Ybu4EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=211&cbvp=1&cstd=206&cisv=r20220316.58608&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Fri, 18 Mar 2022 20:03:43 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 2222 22 KB
8 KB 20ms
19ms Document
text/html 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 17 Mar 2022 23:40:21 GMT
expires: Fri, 17 Mar 2023 23:40:21 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 73402
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 1B15 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 17A3 0
0

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012202142035000/ Frame 54EA 220 KB
61 KB 89ms
19ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012202142035000/amp4ads-v0.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202203171106/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed7385b2ca535f7f90bb14266ddd68d64393f41d1559cbb4af01ece4dd36b8fb

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 73450
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61563
x-xss-protection: 0
server: sffe
date: Thu, 17 Mar 2022 23:39:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "74cdf3878bfbef53"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 17 Mar 2023 23:39:33 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012202142035000/v0/ Frame 54EA 16 KB
6 KB 120ms
51ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012202142035000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202203171106/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

32b8fae56a7edbfe89e7f7fd22aa7df75546183f81660692c9cf03d3c8d914ba

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 73450
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5733
x-xss-protection: 0
server: sffe
date: Thu, 17 Mar 2022 23:39:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "42a91727bcc93df1"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 17 Mar 2023 23:39:33 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012202142035000/v0/ Frame 54EA 96 KB
29 KB 122ms
54ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012202142035000/v0/amp-analytics-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202203171106/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e02189b6990b38c43207a8c0c206a2fda1833e7b7401fa42af72671e62f43a5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 73450
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29577
x-xss-protection: 0
server: sffe
date: Thu, 17 Mar 2022 23:39:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "42f1ed997a28c2a2"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 17 Mar 2023 23:39:33 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012202142035000/v0/ Frame 54EA 5 KB
2 KB 129ms
61ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012202142035000/v0/amp-fit-text-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202203171106/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3110966fa73dac64901ac2cec67656155bb9717286b7b0da0544cdd8ae7c888d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 73450
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1873
x-xss-protection: 0
server: sffe
date: Thu, 17 Mar 2022 23:39:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "8e63b195883091b5"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 17 Mar 2023 23:39:33 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012202142035000/v0/ Frame 54EA 42 KB
13 KB 130ms
62ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012202142035000/v0/amp-form-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202203171106/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac2a6bdf3640e1213ba9a0a900ea6864a0274b080ba3bcf05ff245bfabb5eba0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 73450
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13633
x-xss-protection: 0
server: sffe
date: Thu, 17 Mar 2022 23:39:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "d3c67c66f710e82a"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 17 Mar 2023 23:39:33 GMT

GET
DATA 200
OK truncated
/ Frame 54EA 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d045f41ed4e73152df911b2a2f0e2040457845b0c7fd22d24beec6a43c4cb71a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 5DCA 0
0 43ms
42ms Fetch
image/gif 142.250.64.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvkD3bPQe4Bct143B8XsShskSOkxmx7ERZdr7xIoTqBjQbYkmOa8HGdrG-CnNWYWIxWTAxkWVjennigOQYlzqs8jzlCU4GxXyjweZXguujpPDE3vsVpmxoyveHtpUKopC7sCI14zyx8cqk7B-yvNONSvWLw4wOPbm2xIfLepqDLQpf796Z3MuNWwjso5yeCq1HNgV4dQucfgVDKr3cF_N1q29vz6fk6SFtC5AShhlotoO8NQMIEU6hdqvIqFQAD34cC2swRJrmunT1m3ttY_mY3MzcO9gK9AF7qrHl7xGDUwZB9GrgL_hpSvpZ-jSKMOAybs4OAuvX45dt4IpQ9LLLQBZo9FZffz12X-eqE5w&sig=Cg0ArKJSzEm_ybPYZXs7EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:43 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5DCA 117 KB
36 KB 47ms
47ms Script
text/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc68a3e6e6f0074ff46c18beea2033fc4e8c6ee513dc0617758f45e2bdd8b88a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1647431472276194"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 18 Mar 2022 20:03:43 GMT

GET
H/1.1 200
OK pixel
protected-by.clarium.io/ 68 B
345 B 27ms
26ms Image
image/png 3.218.215.219
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_WlZlcUlURmczdDBSVmo3R2g0MWtFYmR4OURBLzI5MDg1NjE1ODA6MzAweDYwMA==&v=5&s=v31fufa1tpp&sb=-1&h=efinancemanagement.com&cb=5256094&d=eyJ3aCI6IldsWmxjVWxVUm1jemREQlNWbW8zUjJnME1XdEZZbVI0T1VSQkx6STVNRGcxTmpFMU9EQTZNekF3ZURZd01BPT0iLCJ3ZCI6eyJvIjoyOTA4NTYxNTgwLCJ3IjoiMzAwIiwiaCI6IjYwMCJ9LCJ3ciI6Mn0=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.218.215.219 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-218-215-219.compute-1.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:43 GMT
Server: nginx/1.14.0 (Ubuntu)
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 68
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3 200 12869006132050308585
tpc.googlesyndication.com/simgad/ Frame 54EA 34 KB
34 KB 25ms
24ms Image
image/png 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12869006132050308585?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qkMbkbTZjOmNW1J-SN6DyJ-i4JsxQ

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d0a6b7617f2fada3187b4c3f92173d2ec6ab6976458aef38a9a92ecdd75f29b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 15 Mar 2022 21:16:03 GMT
x-content-type-options: nosniff
age: 254860
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34963
x-xss-protection: 0
last-modified: Mon, 07 Mar 2022 23:17:02 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 15 Mar 2023 21:16:03 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 54EA 2 KB
2 KB 20ms
19ms Image
image/png 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 17:24:30 GMT
x-content-type-options: nosniff
server: cafe
age: 9553
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Sat, 19 Mar 2022 17:24:30 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 54EA 295 B
319 B 31ms
30ms Image
image/png 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 00:17:40 GMT
x-content-type-options: nosniff
server: cafe
age: 71163
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Sat, 19 Mar 2022 00:17:40 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 54EA 0
0 38ms
37ms Image
text/html 2607:f8b0:4006:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTy6X7f1w2QdhXfN3xY1foXKtftHGb4yZtFASQfmldJlSSmAeqnrqafrLmiLcsGle6Y3MIVKhrdADxrbFgXKPd6yY3zgQ
Requested by: Host: efinancemanagement.com
URL: https://efinancemanagement.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:808::2004 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 54EA 0
0 50ms
49ms Image
text/html 142.250.64.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CDQ-cnuU0YqKjOrmQj-8Pppy0qA711vXzaJnjkaj0D8Pvj5yuIxABINPLzjBgfaABzPGSxgPIAQLgAgCoAwHIAwiqBPoBT9ABly-1zY5SGGrWtjuGrP0NqgbZY6vBC5LpoKFruamEEWtlbkVFN-C9M_liULOat2HVqdY8ozYGWwEpSEdsBiflBqNCzIo65KkSkFqvcU5oKPtrPKZahHbaippu4DoU77PEhNYVkRcYQqFYjPeqEcHrI_U5L6_wMvL_zBtfBMjV_yurcrA8n9BeDv7Mpd7WXIB8Xz9i1rxw2kUOvO7ZcpFjNtsMZstQIvlx-4iC6Vfex-IcWyvei1NfHYWB5N7Czl2iLuNgm7nPPktiqQPszC6cdRchWJXbXZAMLeD_JowZh2gaMCMP53GHgLDczxMuiiyuy8Ogtt9HU8AE7Z_Ps70D4AQBkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBgKAB5yO7TmoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBC8pFPSCAcIgGEQARgd8ggbYWR4LXN1YnN5bi01NDgzNTA0NjY4MjExODg5gAoDyAsB2BMN0BUBmBYBgBcBshceChwIABIUcHViLTU4ODQyOTQ0NzkzOTE2MzgYmdIh&sigh=BDHyCe64-FA&uach_m=[UACH]
Requested by: Host: efinancemanagement.com
URL: https://efinancemanagement.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.64.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s31-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H/1.1 200
OK pixel
protected-by.clarium.io/ Frame 5DCA 68 B
329 B 28ms
27ms Image
image/png 3.218.215.219
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_WlZlcUlURmczdDBSVmo3R2g0MWtFYmR4OURBLzI5MDg2ODc4ODU6MXgx&v=5&s=v31fufa1tr5&id=eyJkZnAiOnsiYWQiOjUwNjgwMzY2OTksImMiOjEzODM3NjkyODk4NCwibCI6NTc5MjU0MDA3MiwibyI6MjkwODY4Nzg4NSwiQSI6Ii83MTE2MTYzMywyMjU1MDE1NDk4Ni9FRk1fZWZpbmFuY2VtYW5hZ2VtZW50L21vYl9mb290ZXJfc3RpY2t5IiwieSI6MCwiY28iOjAsInMiOiJmdXNlLXNsb3QtMjIyNTg4ODI3NTQtMSJ9fQ%3D%3D&sb=undefined&cb=2203833&h=efinancemanagement.com&d=eyJ3aCI6IldsWmxjVWxVUm1jemREQlNWbW8zUjJnME1XdEZZbVI0T1VSQkx6STVNRGcyT0RjNE9EVTZNWGd4Iiwid2QiOnsibyI6MjkwODY4Nzg4NSwidyI6IjEiLCJoIjoiMSJ9LCJ3ciI6Mn0=
Requested by: Host: efinancemanagement.com
URL: https://efinancemanagement.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.218.215.219 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-218-215-219.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:43 GMT
Server: nginx
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 68
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3 200 Enabler_01_245.js Show response
s0.2mdn.net/879366/ Frame 354A 110 KB
38 KB 25ms
21ms Script
text/javascript 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_245.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15468249809515949982/index.html?e=69&leftOffset=0&topOffset=0&c=SXjhYzOttR&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15468249809515949982/index.html?e=69&leftOffset=0&topOffset=0&c=SXjhYzOttR&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 21:13:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82240
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38568
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 19:32:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Mar 2022 21:13:03 GMT

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 35ms
34ms Script
application/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=efinancemanagement.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031501.js?cb=31065673

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 39ms
37ms Script
application/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=efinancemanagement.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031501.js?cb=31065673

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 18 KB
10 KB 265ms
264ms XHR
text/plain 142.250.64.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1622716216134435&correlator=3572632728342820&eid=31065673%2C31063246&output=ldjh&gdfp_req=1&vrg=2022031501&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&iu_parts=71161633%3A22550154986%2CEFM_efinancemanagement%2Cmob_footer_sticky&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90|970x90&ifi=8&adks=767581643&sfv=1-0-38&ecs=20220318&ris=1&rcs=2&fsapi=false&prev_scp=publift_mv_testing%3Dexploration3%26fuse_industry%3DIAB13%26fuse_path%3D%252F%26fuse_profanity%3Dfalse%26fuse_publication_id%3D2%26fuse_site%3Definancemanagement.com%26fuse_uuid%3D79409591-40e8-56ae-9f21-1f9c105e3f0f%26in2w_key%3D31%26in2w_key12%3Doptimization%26in2w_key15%3Do0%26in2w_key16%3D1%26in2w_key2%3Dnope%2Coptimization%26in2w_key3%3Dadx984%26in2w_key4%3D--38gz%26in2w_key5%3Doptimization%26in2w_key6%3D--3h--qgz%26in2w_key7%3D984%26in2w_key8%3D30%2C31%26in2w_key9001%3D3%26in2w_keypm%3Dfuse-slot-22258882754-1%26inskin_yes%3Dtrue&eri=1&cust_params=fuse_profanity%3Dfalse%26fuse_site%3Definancemanagement.com%26fuse_path%3D%252F%26fuse_query%3D%26fuse_category%3D%26fuse_industry%3DIAB13%26inskin_yes%3Dtrue%26fuse_uuid%3D79409591-40e8-56ae-9f21-1f9c105e3f0f%26fuse_publication_id%3D2&sc=1&cookie=ID%3De7260ba4b78fc0be%3AT%3D1647633822%3AS%3DALNI_MZRcaOyMMsZndrBZ5aZiI0R1LbWPQ&abxe=1&dt=1647633823645&lmt=1647632250&dlt=1647633820189&idt=993&biw=1600&bih=1200&adxs=0&adys=1110&oid=2&ucis=5&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&url=https%3A%2F%2Fefinancemanagement.com%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x-1&msz=1600x-1&fws=516&ohw=1600&ga_vid=580892807.1647633821&ga_sid=1647633822&ga_hid=414747934&ga_fc=true&btvi=0&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031501.js?cb=31065673

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58d810bece482b7f39c30f946328b197a6e10b3bfd1b036ba0530109d69e0b63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:43 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9980
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://efinancemanagement.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Enabler_01_245.js Show response
s0.2mdn.net/879366/ Frame 5E8D 110 KB
38 KB 28ms
28ms Script
text/javascript 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_245.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3576529225204264240/index.html?e=69&leftOffset=0&topOffset=0&c=soFmfCprkm&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3576529225204264240/index.html?e=69&leftOffset=0&topOffset=0&c=soFmfCprkm&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 21:13:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82240
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38568
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 19:32:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Mar 2022 21:13:03 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 01D8 0
23 B 44ms
43ms Ping
image/gif 142.251.35.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssI86RAjqqlc4qxmP2UvoSdR0QTp0UYY45iILvjsxk8CDTmwWKHMfF1etmbaSp-3hX4TrDIEvVvdXEYcYvophwDtwZ2pT1WlHn2iKAyJ80k9ggzGgOUBZZ_cQ3JWK7g5VdGIovqld81uS2-3fbt5W40-EkBtY6kLNn0Ukh6ryPxvCHuXD5m3Eco2ihrW_jfHC2J_2Mq2kZxH30eG1m9Zx7pkeeuUCZjRn4qQEznScxoosTj6berbyu0MJ5S2BOah3MLwDVoorgmLziwUjyBzC_bv7HkQueKcgcNYFxbCFHVB7H-2TswbsVTzhmcJoMyH-XbE5W4R8OSWFWApUGcoY4_Wiog7D73MSp9M8j6Z4WjB_i0VTLzwLqQjMwSgrWu8GbeBI9HS-mmDox_5qFQmy9lAI8jmR8GJouaJELGizP0KKOnJaw6TulTTR4VfOZGrbr2x8eGk0_ksCRdGcSYtolamEagpoi9k6I01L-uDyrlmImUaOapSmNkqsHiCJ0ha60x2-lYWg45t2D7x_aRd1qDzAXLj-eE20VJCQlr3CmTSxdPW2eox1THnvDfGFotBprdMwhiGTEFxMkAD74_F5Ut8MCTUvrkLL4yvr1--f33kH52Z2lj1dLYwO0ojGxvpHymNXQLmCUbzvki0hsugKSbFKheetB88ZGykeibQiOvDOhX8nsRyq0bRsOklUBdOL-bqSiLJCBqzwCEEznU5tvtyUWidwflqupVign9-Qq8_11tXGeUf8Gwet46A7V2o0DnXK1fCaHDU-DNC211--e3b65RHOW_2wNbImjJaixHWCs7bTuGWopk3Cxucd0L0J53xvV9vzsvwlUKBRuLgWPcEB6rR_xCDtK1mmqFAxKu78e5uE6UspdiL5HOrr6haEPWnZD19Lqe5xcRwvukKgZfWLmo3mvNMqwbbHSPFlZ5ai6PuAf6T34nILLM_ON-v9O1Eq0a12H6X3z8VOaqr11wHLM-316ZTWnHoZyql4nsK1aS9HS1Msx_x_iga1S1U4G32LwcLNA0WoDSa0de8GTxVts4d_W1lgQFQWrbIBeu2psNkFYVSPSHDEkLVafcBVNcwCWt3qlsRoTYAP-m_rYtoGZb3GthnZM7E1tz5eBT0o0NYZ7QeHA226OjpsAibmRPZYQbD3CjcGWN7sBgdGKA4hSdcNSkmJ0ZRZUNxO4rzQlU4zFqGfkJwNX0BoxrjGjqOxuzRYy7o62CiL7yCclADTRhgOb_fYqEPbSXQ9LrT4gpBOrC6aW0w5ujyGij0w&sai=AMfl-YQ9TNYhG3FKcYaqGF2zdatDsG4i-jgsHU2qL1WCFCJzAErEYjtEIyjBiT39xYpPtejVjjRZGtMAr91wWq9l9Jml1Zs2f9XPbGUP7RidIUB-0s-aSKagmW5hKxypvIGKncWIEeMa4ig-fzf4TAmQFtXOHRo16cNpYnAsq-ryEmxj9vYM5m19btiCN6TaWKFseuyCYOnqUdsT4vEuGLoIqWDn-etkzd15q9d06m54M_9rBiHNTtBA0vDqRhr4NNkQyULg9zjBZ8Dz_GbvBD1Ce42Q4QtkLEmLoWYAe7qvgOhJoczQXCKnG_5yUVMN40oRMOzqAE2qp_yGTv8Ke3MBHT0IPcJIYKcP_CnBe_veqmqeYUyrEtXwFqTI8QRgxc9dh9dDGvK0YDT97ScPeZQaSA&sig=Cg0ArKJSzGQrTgkN8I0wEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=672&vt=11&dtpt=447&dett=3&cstd=672&cisv=r20220316.02716&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:43 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/ Frame FAD9 6 KB
2 KB 21ms
20ms Document
text/html 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fbd2b03a7f20d12424377c93cccb8d88234ce7c06e7baeca3b8b0962fa7c3f5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 1812
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Wed, 16 Mar 2022 20:43:33 GMT
expires: Thu, 16 Mar 2023 20:43:33 GMT
cache-control: public, max-age=31536000
age: 170410
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 6951 22 KB
8 KB 21ms
19ms Document
text/html 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 17 Mar 2022 23:40:21 GMT
expires: Fri, 17 Mar 2023 23:40:21 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 73402
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK dv-measurements2394.js Show response
cdn.doubleverify.com/ Frame 994B 513 KB
95 KB 25ms
24ms Script
application/javascript 2600:1400:d:58c::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements2394.js
Requested by: Host: efinancemanagement.com
URL: https://efinancemanagement.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:58c::4469 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: ddc9f0f8a5712dd54bd74954300a96084fa2ad10892ad9d92b335974244ee515

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 20:03:43 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Mar 2022 14:45:16 GMT
Server: Microsoft-IIS/10.0
ETag: "02628734439d81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 96951

GET
H3 200 Dtrk1l3d69CApoaJcCvKSIFK_q0S4za4Q5VfteMZCz0.js Show response
pagead2.googlesyndication.com/bg/ Frame 953D 36 KB
14 KB 20ms
20ms Script
text/javascript 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtrk1l3d69CApoaJcCvKSIFK_q0S4za4Q5VfteMZCz0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edae4d65dddebd080a68689702bca48814afead12e336b843955fb5e3190b3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 23:39:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 73442
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13875
x-xss-protection: 0
last-modified: Mon, 14 Mar 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 17 Mar 2023 23:39:41 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 5DCA 0
0 41ms
40ms Fetch
image/gif 142.250.64.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssf8BXIOvG0d7GHfWrilqts0r5jLEZ5mc7CqRwBqwjOFOvIyXWZoIjiNZfnmdX_TmZjuBIuPbO66YOB1IQhERFmrgRi_S3xX0oSAa3L-lZ2R-B9-_RMVZYNF1OilqW0U6HOLx8ut5QlTQ-l5StySw_sPPxPMWqojYpCcHFErovBfvz-CCqaAH4Pt3F4EHZ1Pa7annb-MvKL-T5R15aVEEt3OmKLcCuFisCDAO6FQ8fOG-7fGd5qgvehDJm-eQUmLbIUGmRkLC3DCUjKEccqKo3IAadIF_wcUYt5tXk05admr6-Ar6apDr7Vn-Dui2IBuaKGw-zGnGJxIJ3c77IW8YHMsMePSfrPS39ok_Ms12Dx&sig=Cg0ArKJSzJB0nWLWBvmDEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:43 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 18 Mar 2022 20:03:43 GMT

GET
H/1.1 200
OK dv-measurements2394.js Show response
cdn.doubleverify.com/ Frame F52D 513 KB
95 KB 20ms
20ms Script
application/javascript 2600:1400:d:58c::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements2394.js
Requested by: Host: efinancemanagement.com
URL: https://efinancemanagement.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:58c::4469 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: ddc9f0f8a5712dd54bd74954300a96084fa2ad10892ad9d92b335974244ee515

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 20:03:43 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Mar 2022 14:45:16 GMT
Server: Microsoft-IIS/10.0
ETag: "02628734439d81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 96951

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.5.1/ Frame FAD9 60 KB
22 KB 68ms
39ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.5.1/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:43 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 786887
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 21845
timing-allow-origin: *
last-modified: Wed, 26 Aug 2020 23:14:08 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f46ecc0-eeae"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vjv31gt6VJhogYQodhu0CFF2RRkdtGl8DddXa2k72TKrs7wtmNsJ4Fnm0G5pKMfJKo%2BcEhq6OG0czuhvjqxIAXl27dHVS9q2nON3zNjx0sHsdGJAB%2FtZKqdIZ1v1VG9c9WfNtPnzZmNn7idnr7d76zFL"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6ee092c77fe47148-YUL
expires: Wed, 08 Mar 2023 20:03:43 GMT

GET
H3 200 default.min.css
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/css/ Frame FAD9 477 B
278 B 21ms
21ms Stylesheet
text/css 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/css/default.min.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e3740127f0af2a6c3f3886392bf3e0e3370f27daf0a26ff11a02b356a9c087bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 170410
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 249
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:33 GMT

GET
H3 200 style.css
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/ Frame FAD9 3 KB
502 B 23ms
22ms Stylesheet
text/css 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7bf00b98fc0c4d18ad2c0539fe5d9f1651ddc5d2faccfebcf408a19c2822e8a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 170410
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 473
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:33 GMT

GET
H3 200 imagesloaded.pkgd.min.js Show response
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/js/ Frame FAD9 5 KB
2 KB 24ms
23ms Script
application/x-javascript 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/js/imagesloaded.pkgd.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96abf166b3cbb5f7df525d86fdeeeccea4af3c120b19bc26b0613530a94e8b44

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 170410
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1810
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:33 GMT

GET
H3 200 main.js Show response
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/ Frame FAD9 5 KB
951 B 23ms
23ms Script
application/x-javascript 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c54fba24b8b6621558c3bb4a6ea22a9c908ff6885bfb4a9ff4a11ea7fd05005

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 170410
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 922
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:33 GMT

GET
H3 200 w5W1EixFGUzWFgZOi1zWjT-g-ai_4t-KN23ava9eLxA.js Show response
pagead2.googlesyndication.com/bg/ Frame 2222 35 KB
14 KB 22ms
21ms Script
text/javascript 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/w5W1EixFGUzWFgZOi1zWjT-g-ai_4t-KN23ava9eLxA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c395b5122c45194cd616064e8b5cd68d3fa0f9a8bfe2df8a376ddabdaf5e2f10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 21:48:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 339323
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13798
x-xss-protection: 0
last-modified: Mon, 14 Mar 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 14 Mar 2023 21:48:20 GMT

GET
H3 200 TDGraphik-Medium.woff
s0.2mdn.net/sadbundle/15468249809515949982/ Frame 354A 55 KB
55 KB 21ms
21ms Font
application/octet-stream 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15468249809515949982/TDGraphik-Medium.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15468249809515949982/index.html?e=69&leftOffset=0&topOffset=0&c=SXjhYzOttR&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e6360dc11537e50f7311ef6adc6b903683d7b987fed5687073a79ffc15ea4fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15468249809515949982/index.html?e=69&leftOffset=0&topOffset=0&c=SXjhYzOttR&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 06:21:04 GMT
x-content-type-options: nosniff
age: 135759
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 56668
x-xss-protection: 0
last-modified: Thu, 01 Apr 2021 19:31:44 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Mar 2023 06:21:04 GMT

GET
H3 200 TDGraphik-Regular.woff
s0.2mdn.net/sadbundle/15468249809515949982/ Frame 354A 51 KB
51 KB 27ms
26ms Font
application/octet-stream 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15468249809515949982/TDGraphik-Regular.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15468249809515949982/index.html?e=69&leftOffset=0&topOffset=0&c=SXjhYzOttR&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a78ffb986b79bae87ce2bbb790630988c5e17a0eaff345379d8222404b2dcc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15468249809515949982/index.html?e=69&leftOffset=0&topOffset=0&c=SXjhYzOttR&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 06:21:04 GMT
x-content-type-options: nosniff
age: 135759
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52104
x-xss-protection: 0
last-modified: Thu, 01 Apr 2021 19:31:44 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Mar 2023 06:21:04 GMT

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 54EA
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

44ms
43ms

Image
text/html

2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Protocol: H3
Server: 2607:f8b0:4006:81e::2002 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Redirect headers

date: Fri, 18 Mar 2022 20:03:43 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame 994B 1 KB
1 KB 359ms
24ms Script
text/javascript 204.154.110.85
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=270&ttfrms=31&brid=3&brver=99.0.4844.51&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTau67%3A%3F2%3F46%3E2%3F286%3E6%3FE%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTau67%3A%3F2%3F46%3E2%3F286%3E6%3FE%5D4%40%3ETar9EEADTbpTauTaue7aad7hgh355baf4a4f5_5%6063d7cfa5h%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&dfs=663&ddur=92&uid=1647633823992219&jsCallback=dvCallback_1647633823992647&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F99.0.4844.51%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=600&winw=300&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=2394&tgjsver=2394&lvvn=28&m1=13&refD=1&referrer=https%3A%2F%2F6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&fcifrms=9&brh=2&sdf=2&dvp_epl=251&noc=4&ctx=11556288&cmp=25753269&sid=2742014&plc=320686250&crt=148659883&btreg=495396827&btadsrv=doubleclick&adsrv=1&advid=5673126&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&region=30&dvtagver=6.1.src%22type=%22text/javascript&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=4211201359.153177&dvp_tukv=1045669.2622946748&dvp_uuid=263451438.6652232&dvp_strhd=1.7999992370605469&dvpx_strhd=1.7999992370605469&dvp_tuid=867699190065
Requested by: Host: efinancemanagement.com
URL: https://efinancemanagement.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 204.154.110.85 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS: nycp-phlb115.doubleverify.com
Software: /
Resource Hash: b424c5fba9b21ecef66c495a794b401052a96b7fdc497d007c199f233645a8d3

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:44 GMT
Content-Encoding: br
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Transfer-Encoding: chunked
Expires: 03/17/2022 20:03:44

GET
H3 200 12869006132050308585
tpc.googlesyndication.com/simgad/ Frame 54EA 34 KB
34 KB 20ms
20ms Image
image/png 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12869006132050308585?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qkMbkbTZjOmNW1J-SN6DyJ-i4JsxQ

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012202142035000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d0a6b7617f2fada3187b4c3f92173d2ec6ab6976458aef38a9a92ecdd75f29b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 15 Mar 2022 21:16:03 GMT
x-content-type-options: nosniff
age: 254861
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34963
x-xss-protection: 0
last-modified: Mon, 07 Mar 2022 23:17:02 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 15 Mar 2023 21:16:03 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 54EA 2 KB
2 KB 26ms
26ms Image
image/png 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012202142035000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 17:24:30 GMT
x-content-type-options: nosniff
server: cafe
age: 9554
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Sat, 19 Mar 2022 17:24:30 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 54EA 295 B
319 B 26ms
26ms Image
image/png 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012202142035000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 00:17:40 GMT
x-content-type-options: nosniff
server: cafe
age: 71164
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Sat, 19 Mar 2022 00:17:40 GMT

GET
H3 200 TDGraphik-Medium.woff
s0.2mdn.net/sadbundle/3576529225204264240/ Frame 5E8D 55 KB
55 KB 26ms
24ms Font
application/octet-stream 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3576529225204264240/TDGraphik-Medium.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3576529225204264240/index.html?e=69&leftOffset=0&topOffset=0&c=soFmfCprkm&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e6360dc11537e50f7311ef6adc6b903683d7b987fed5687073a79ffc15ea4fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/3576529225204264240/index.html?e=69&leftOffset=0&topOffset=0&c=soFmfCprkm&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:20:26 GMT
x-content-type-options: nosniff
age: 171798
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 56668
x-xss-protection: 0
last-modified: Thu, 01 Apr 2021 19:31:46 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:20:26 GMT

GET
H3 200 TDGraphik-Regular.woff
s0.2mdn.net/sadbundle/3576529225204264240/ Frame 5E8D 51 KB
51 KB 22ms
21ms Font
application/octet-stream 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3576529225204264240/TDGraphik-Regular.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3576529225204264240/index.html?e=69&leftOffset=0&topOffset=0&c=soFmfCprkm&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a78ffb986b79bae87ce2bbb790630988c5e17a0eaff345379d8222404b2dcc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/3576529225204264240/index.html?e=69&leftOffset=0&topOffset=0&c=soFmfCprkm&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 04:38:05 GMT
x-content-type-options: nosniff
age: 141939
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52104
x-xss-protection: 0
last-modified: Thu, 01 Apr 2021 19:31:46 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Mar 2023 04:38:05 GMT

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 5DCA 0
0

GET
H3 200 container.html Show response
6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 1CBA 6 KB
3 KB 19ms
18ms Document
text/html 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202203171106/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 18 Mar 2022 20:03:42 GMT
expires: Sat, 18 Mar 2023 20:03:42 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 354A 7 KB
5 KB 42ms
42ms XHR
application/json 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_245&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fa7e6ee285a2a47db30a3bdea9c045b6a3b844b2f8e0179495c35e4f3386c07e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5595
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame B805 0
23 B 44ms
43ms Ping
image/gif 142.251.35.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvsfr4BP_tDUtaieCXEPx1-yQBWkSpFStFypVmEM-2B3gQCCuEnsNfv5uJqB3Y39oCdDtbrqZGOp7y87scKaZhiYKWWaSZboCcRdgZwUGWNsFLsytqtBLrOP-B5Slsxw2AWqZVHMlmHajxH0zFcHavEeapdNtzwLPF-DwST3AyoMgaGYW_3K-QNn68AhKSepC1ozIjFzLWjAFHk-t7eEIBLT9XwXNgSHEDOPpqurwBNlLjSHK3anGbuq3KU0oQ_JxdNspKGY9XF-gcXGHjGGJOkfTxiSuR7loYCq3by-vKRT8rwhrKLu1bMqziMaAuZ9R7sF1agKcftTY9E87N76vYkO2IiPYqO4hxWoEphzo3QFxummcRGPMkwmTSdBgO6TEnffJbSN3yaUeUC7ZAQj_-OnNzOlxGPeDJDISP2h6n3lcEYgvqUzsJv1KKoe4aDtCxSnYNM95SDHQ6RaIu9rA5vKw55DAH9sFGdjnpW9_MZCCMifBKvSJK9UpqVrnOO4f2Y-hQ8s52zpXy8SZgQVkgugzEkwBMCJIXeOgYz48zXXaut0MtrtCjnmmVequ2fhV20-jMO5GUStZnML03ViS9BVOvy8q1owaxEeZStY0VmciybEIpc3_f19O9bYvsVFv03dK-D7A9D_yYTn7GtWNGiwi6YvNH6tw2kgE-T9F9O_UAztkY1dCi159VQZR8GLIbI3Ha8IpofhsiSEuWocnaAcQUGP_Hwh3jlxvJh8mJhyl5lHtIwWe9i_jdlsIE7C0zKsa3N_UO4ywm7wG8hZnhBpZj_Df4kd0cI9r1XJtI2outYBOK_kbXP4MGiYy0-D2XR_-JKMKNy3BG7tMhSYSN9KFoWBKoM44O3JW6DzImf2oN3wsFVjBexqDTfGnZeVHB53JWh_PHg1xPBe8SXtZ62ud4MxV_BGJt5NwuooABsPY4cHJD9WIvY1ydyKFGOWo1SZu8RJNtKmTsa4iUUGMA2XxKraP9ILhef9A_xAhmGT3swrUcZTOMQ7-SEju7Lg6M1K-9MoyzbZtyjq4inIWIsW41Chtta4nsmvxA_CFPRcA9vS8P-dXox2g_WEz9ujxsrUrlyer6A9zWmJgOA8TZhztYYNpeNE474qlWv8NRbysJwvvO5SHqxz59zgEMdKxI49PXwjDPDY79gWhsZCCElGSXzYkqJNWZR8vW843aVKB9r1IqHkJi_K9YnqgHHuCkEMpQY2GmpShM2-BwFw5wIhLn2gpj3BBKHSMiEwrP7VK33_Q4qCNZi9JRaHgWBsn2Yt-o_BMXVsoa-8ZgHI5Em0V7X&sai=AMfl-YQWxvA767YYIxFMxXzspD4LJIAMh1lp3Jri8sBsmd0itC0iUSxmmZ1glfQ6fJ92Sg-jmX77812SNnnhHuesWz23dVhU6VmvObhz6pY2xJ-edVX9-S5aDKIuT1gh7Xk-RccyyW-EqWBYybBDeA_tE_eJnLOab8tOzIoa8QY4rOjrlWZya317dswS33GQ2KeMtftU1mNtVCdMruMYWTzKMnAZX_I75RaDyw&sig=Cg0ArKJSzAZlsxLlr9O5EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=883&vt=11&dtpt=675&dett=3&cstd=201&cisv=r20220316.69395&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:44 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame F52D 1 KB
1 KB 267ms
22ms Script
text/javascript 204.154.110.85
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=299&ttfrms=9&brid=3&brver=99.0.4844.51&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTau67%3A%3F2%3F46%3E2%3F286%3E6%3FE%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTau67%3A%3F2%3F46%3E2%3F286%3E6%3FE%5D4%40%3ETar9EEADTbpTauTaue7aad7hgh355baf4a4f5_5%6063d7cfa5h%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&dfs=691&ddur=26&uid=1647633824084725&jsCallback=dvCallback_1647633824084331&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F99.0.4844.51%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=250&winw=300&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=2394&tgjsver=2394&lvvn=28&m1=13&refD=1&referrer=https%3A%2F%2F6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&fcifrms=9&brh=2&sdf=2&dvp_epl=251&noc=4&ctx=11556288&cmp=25753269&sid=2742014&plc=320686244&crt=148659886&btreg=495731955&btadsrv=doubleclick&adsrv=1&advid=5673126&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&region=30&dvtagver=6.1.src%22type=%22text/javascript&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=41545001259.49257&dvp_tukv=312596214.042963&dvp_uuid=302851827596.3894&dvp_strhd=1.1999969482421875&dvpx_strhd=1.1999969482421875&dvp_tuid=318032908347
Requested by: Host: efinancemanagement.com
URL: https://efinancemanagement.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 204.154.110.85 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS: nycp-phlb115.doubleverify.com
Software: /
Resource Hash: c34400b7fdab062f32683771f3b2487ad7688ecf6edd5af8e8750dc409f10b02

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:44 GMT
Content-Encoding: br
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Transfer-Encoding: chunked
Expires: 03/17/2022 20:03:44

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FF5F 0
23 B 42ms
42ms Ping
image/gif 142.251.35.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstyY4VRb0XAt3har1VhwoxLodOjyHk0bmtANu9WianXFyP-AlhQGw2YFN3dlZVgusHSmpcbVFw4yyfQVAX4i0C3iSEMIk575VJyCZ8vTuUxbgb41EHp6y6jy9cDTDT3xZphRzWiHs9ENoL7a3V77rqcUfUSH5rQwmdcfVJNHmrK91XkaU_YqkPB_kIe-247H_OfAVnMAW7zmHPVU8deIDi9tdszLkbHDQtlC_Sw6bvhwllwObscvxsDPniW0h1SRqt8HJe8GfUnZZrksgLs5gd4K1sozPr4u2rg4RZ2MS6Jvp0LLfviACJNOCyy6eif3nX9zDJ3J1LdEBRFYYenIHz6_yiY4nszDSwlbUxwCYVSQyaw_VrY7askqCkMGS1Ug1iz4MpbQkOpUX-TqirqaxCECPwNJh7ympePXiShXfTYZIItK3JwZLhtdY-lNjH_6Op_1Gg1bIMmyKpK1ZRzOavlD5rJi6bJTk5Q2MkHO2Bun1OkcTmf-Y2yacTdKxW8qYV_zRsJS6Tl6RGrBugvr-MW7LQwZIfXeUBj0x7-QIFGTpeJvDfPWmCdkd0IaMZlQLcx5dwVtxR4x9ur3rbCEB1Yf6JRc2oq-z7KJNrj_i_dLz6qLGzU_XLlJk9sftCzzdWRO2K3CWHEiuqw7BvgNPXSknfPQFBjgCn2b70WP_Lwyf2FuhWp2WcPU5rWkaCCHCcCGb1XnZPv72Ion0QhQPMuUymzKodKfg4rKetqILiq8deGwqOznw58PJxlsROv6BUpOhoOr2DyHOxGZy3sQKXm1QEKppm7xZPMf-7Ef-A5zmvWC3hIROJVDbTJUF43aihVwtqEGC2Xtj4jts1yEZXAsrq2Mg9rbipq4LrI4iImhAzlyuoUM4g21y9Ev-l5PaMgw6ndVv5-iVVT11dQLk5WzrriKv3MLz3RwPKzavNSmiDx26pMcQcQUMBW9bUPZsZoi2jhl5ycszj_n4677q6QbvBcS8vf9DxHxGiJiZw6eQ5cakFEopQl8NQRXvbtlVBlU1tzu863joH3s-zfFlw2I07xJIo-1sQ2roDM4DFTiePzIfIQbd84x_dlBTR53FVRK2x5Q9huSDglrTNilnSYpZEtBmyYU4BiJ3X7CXIBeppx2DTDe0m9nlatlI7c5OSpBbiHOJcYRgH5UejiuQVkQHadGhUb6ba8dbVvYGWaKsVJd63KZ6XWBMcIXUwpynKGAI51yUvKKG1iKaKn5sqwT0vfBXiDCplkg5IVmw045l60dRB6lXoJMpQvzhc5tg2oD3Yf6AmuhMLimMofgTClocwR1CkMDR9mfN0&sai=AMfl-YQA_e_HyH8Iy9x75tNDWDTqBbwb3KHRp2HajjqPLtSX6z3gWauMuj2kUsnhB-TDlg8gE_xy4ROzEJKM8pLJUXqsCVvDP7k_m8HpN4r_Cd2qUYg5764N1u2f1kY0g6iPsv9Kl3oK6gt-cxx6E7FgP5W9tbvsxZ2qF5RcDNOM0zhh32NGzqAdotdmkY5Xw5FcbzaMOglXOC01VoKC8GDjjyPW-cUT2C5tTw&sig=Cg0ArKJSzNOEZ_P_Ybu4EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=836&vt=11&dtpt=625&dett=3&cstd=206&cisv=r20220316.58608&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:44 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 w5W1EixFGUzWFgZOi1zWjT-g-ai_4t-KN23ava9eLxA.js Show response
pagead2.googlesyndication.com/bg/ Frame 6951 35 KB
14 KB 19ms
19ms Script
text/javascript 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/w5W1EixFGUzWFgZOi1zWjT-g-ai_4t-KN23ava9eLxA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c395b5122c45194cd616064e8b5cd68d3fa0f9a8bfe2df8a376ddabdaf5e2f10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 21:48:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 339324
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13798
x-xss-protection: 0
last-modified: Mon, 14 Mar 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 14 Mar 2023 21:48:20 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 354A 17 KB
6 KB 52ms
51ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 18 Mar 2022 20:03:44 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 5E8D 7 KB
5 KB 42ms
41ms XHR
application/json 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_245&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a5295867167fcb52578733b606d41f1e0852f150f3535a2c7b352272bdf43a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5595
x-xss-protection: 0

GET
H3 200 background1.jpg
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/ Frame FAD9 44 KB
44 KB 25ms
21ms Image
image/jpeg 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/background1.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d213cf1868442d824e71d1eb7efd71f0d43e4118a182e08e67bbaf2c0f41bc23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:33 GMT
x-content-type-options: nosniff
age: 170411
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44657
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:33 GMT

GET
H3 200 text1_1.png
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/ Frame FAD9 2 KB
2 KB 27ms
23ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/text1_1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd0d3e1c7ef33d9b90342cb554540fc9996287d7ae3f1f178ea00b07f18278d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:33 GMT
x-content-type-options: nosniff
age: 170411
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2469
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:33 GMT

GET
H3 200 text1_2.png
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/ Frame FAD9 3 KB
3 KB 28ms
24ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/text1_2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c853706d20cb1d1124d43206dbd4301d971c7783e7b1dc5174242547880099e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:33 GMT
x-content-type-options: nosniff
age: 170411
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2754
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:33 GMT

GET
H3 200 triangle1.png
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/ Frame FAD9 4 KB
4 KB 32ms
27ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/triangle1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

216658fed1f215b3b5cbb66457d85a2bfd0beec62b9881b51e1443a84638ebff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:33 GMT
x-content-type-options: nosniff
age: 170411
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4043
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:33 GMT

GET
H3 200 text2_1.png
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/ Frame FAD9 3 KB
3 KB 31ms
26ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/text2_1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0cf95bd910efd3334dd03cc242d01c7def2faad5509ccb25193ad1f6edf2b77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:33 GMT
x-content-type-options: nosniff
age: 170411
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3210
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:33 GMT

GET
H3 200 text2_2.png
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/ Frame FAD9 3 KB
3 KB 34ms
28ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/text2_2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3acf2c1a6546fb425d9649a8e71129d648a4dad72095e9fe0eca1907e7f1f24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:34 GMT
x-content-type-options: nosniff
age: 170410
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3318
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:34 GMT

GET
H3 200 text_FF.png
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/ Frame FAD9 12 KB
12 KB 32ms
27ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/text_FF.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4dba0ced0e99e0bafca7ba8fa7594d999a026d322c7e204ceb44d09f3846db3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:34 GMT
x-content-type-options: nosniff
age: 170410
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11851
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:34 GMT

GET
H3 200 logo_1.png
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/ Frame FAD9 662 B
689 B 33ms
28ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/logo_1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8e6de5c95cd041e13c6295db10f808dad2d61cdac25bd94a0ee07c51570d236

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:33 GMT
x-content-type-options: nosniff
age: 170411
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 662
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:33 GMT

GET
H3 200 logo_2.png
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/ Frame FAD9 2 KB
2 KB 32ms
27ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/logo_2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0c6ae5f8d6332a1ecdfba6119a62b46b3f9e053e0d4f3507c1ef4679cfe9aabf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:33 GMT
x-content-type-options: nosniff
age: 170411
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1590
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:33 GMT

GET
H3 200 logo_3.png
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/ Frame FAD9 1 KB
1 KB 38ms
32ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/logo_3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

437e00ab08f58e7de6c495c7063fd54c831431ba067da813c3edb12a15843a63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:33 GMT
x-content-type-options: nosniff
age: 170411
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1464
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:33 GMT

GET
H3 200 logo_4.png
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/ Frame FAD9 1 KB
1 KB 36ms
31ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/logo_4.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0cee2e8688f47773fb1a9780f2f6df5660d5216802cc71caeb7579207e90d599

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:33 GMT
x-content-type-options: nosniff
age: 170411
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1208
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:33 GMT

GET
H3 200 logo_5.png
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/ Frame FAD9 1 KB
1 KB 36ms
31ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/logo_5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bd09d4c44d41245fb2d6913762af79b89213b11f30a7c27876cd85309acf6e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:33 GMT
x-content-type-options: nosniff
age: 170411
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1377
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:33 GMT

GET
H3 200 logo_6.png
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/ Frame FAD9 2 KB
2 KB 34ms
29ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/logo_6.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

804efcae31a0822340c404d008da63c279938d49595eee845d4c6a2070f1a1af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:33 GMT
x-content-type-options: nosniff
age: 170411
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1659
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:33 GMT

GET
H3 200 logo_7.png
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/ Frame FAD9 1 KB
1 KB 33ms
28ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/logo_7.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d42632b302b1830358bbec98f4aaf05d84a00daaded88f5c49f72f39d4a4404

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:33 GMT
x-content-type-options: nosniff
age: 170411
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1416
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:33 GMT

GET
H3 200 logo_8.png
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/ Frame FAD9 1 KB
1 KB 35ms
30ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/logo_8.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae50b251b3cd703fdada761cdcba81758a97baeaa9cfee6b58bc9f1065da70c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:34 GMT
x-content-type-options: nosniff
age: 170410
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1405
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:34 GMT

GET
H3 200 stripes.png
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/ Frame FAD9 863 B
890 B 34ms
29ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/stripes.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b71a903e97a2db26533942435bb4b5cb02dc9572ac732e695dcc316d67f2a09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:34 GMT
x-content-type-options: nosniff
age: 170410
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 863
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:34 GMT

GET
H3 200 overlay.png
s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/ Frame FAD9 1 KB
1 KB 33ms
28ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/img/overlay.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f0f51a417042f2668baa9b5cec5a4314aa1c46f58dc0938ab559ff6b795e3e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7589941082722660640/10010543_22_TRS_BRN_REPLATFORM_DV3_AWAR_CXQ_EN_0_970x250_V1/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 20:43:34 GMT
x-content-type-options: nosniff
age: 170410
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1368
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 17:00:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 20:43:34 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame E317 668 B
325 B 46ms
35ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMLX3AIQ-9z1Ahis7rW2ATAB&v=APEucNVC_mw15SrhFRtG76oQzQnR9C5j5ol2bwXB9HsNiNM32Tsyu9jiQWIuG3nh_Hx_t0zCMIwFpIXddXPqbhkcTcy4qhnMEdntF0nkA2TkTFj0zD45yHc

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8015a89c7e50b71a6597cfc7bc2be462212ae1f57c37e40878a79e7550768ccd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Fri, 18 Mar 2022 20:03:44 GMT
server: cafe
cache-control: private
content-length: 304
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 1CBA 77 KB
32 KB 77ms
72ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CVYnMvZFyvkxV6yJmdut_nB0wJmRwj7nXZkdOkp4FX-h09dkj7p4HcSHNh79ehUTZBPsaN5ZAXpDvHtIhGxD9_D2MSbScO1bT5jQ4RD1EXz7wJis5fOdjFQBpCA4jrzV0wPl8QosrcwH7vMQpeJmCbbyYKNA&dbm_d=AKAmf-Aeo8a8aGEB0dPQNKMK0MbDWGB3VQhSwUE3W1h1VL_oSCq3wA5_G-3p7MSMqe_9MBfw_cLxZCaZvDkdXvdJ-vv177G1GT7VSphx2aq6BjJ1N6UJB4XCzM2abHgDqZ5w7_0ZcsXQZ1Vznj26RjS4-QlF0lI2OcD9VeV9NF1ZvA3c2XWn-qyfZ1SNStgHB_XR6oAs396BJPMwMGuCc0CdHiCx7VdFC-0KZSDcH8biMaRtTSVLlKH8kYvi39XthTMGovZuhASgBnifUMnIvMNQDvtMS2A3D-avgsfBC-ga35FVDzeFpFdp0VPXq8emDyXm4dYENxcOvDzdS83MZwXvsqauTCTxkvqW_K8QvQw0d10QI6hg0q-dMLKwigSTq6_JyuzyNPWhCkDgrKCfp32hKUVcKf9dgLuBCYG6ITzxPvV14pjR22rOgQ_-ffTP733rZtOpUWZ9egHrMLyjCXDYZEnD6Bshy01nbhH2iij9Z5h04an2_lTZVkZT6saGQV3dG1wZXAQZBV8F6sICgKyWObAoKGH4Qqorcy6qwB_KnZUZE8eIcFNpi8KTw19HER6REdfDxcaAnqaMf3uBiqP_rBd3hQeaDLjbyRKbz_JvzTdDDpuyUFdZ9O3n9N1Xbt9aX7JMbWBsb35-4Yje7ZALLWSSqvsqhUXQyVzO1x4Rx8GDQqz8tKnudkLUYegaHovJcjgLeKUqillqOjhg-Gva-C727DiTwEQFj0H1u8MWioG75MEMq-cz32rU0ZUs3TparuC20prTlS8Km2SW1cN3YfPIj5ioEqnQzlzQ8WEHP16SX4GtKGsag2UUAOOVzIHivUyTUVVa2SwB3-jsRWUZaFz48-l74QcQUy5rJaP0d27sSXeGxh6IYZEAB6HGAI7bk7dsf-Clzksb_ZWvIGhVEKGWd57mebUL1CfNEQ6rj8Z-rEGIpDaozfs-9dQ4tDArOMIeMh0tC-pgUXMW9aATtY5j1xGmB2poVXuvELsxj4LvUDh04a5MkrBowZaRm2Z7sFTqt688f8vt8vXcwDDhWS5FiBUjFWSWYo3z2KDeY8gtV2mPme6umY9CgStt21w9wxQNvzNpqTMeDQIcpqw64noXFDADfOuLjsZlfvYnj9XGXd0H7RkuUPbXGNh2c5kWO2sLyVEWW3y0qR-OBfRzl1j5Wrnz9jwkkaOxi8jK7Ia0iBHfs8ebLliF299w4njSZTs3HiW2EHHpx_mHkyud8GXpbgrnBUcnGV5f1uWYtNtCk9mCopAm9F5ovAsILRXJCH_lb1ldk9K5dakvxp39UK-kjM4TJj4Ea5b9IvdhviVXHyRlIs3Rth_XLfDWe7oxmX92Lv1MLCCAgsvKAkUtBFXRVW4Hk6Bgs4NeuLYaRwQUtWzAX9Aarlp5axO8K6oHhP0sN1Yq3RjX6vDy5lug8FmiEwYr-eE184NqdMmnIYwzhLjJa86bDisNsnXKnc397H3rIYBtM90dRRpI08rVJxPbHNS8Y_RndQ4YTDnCXcpiju6Mhfi2x6GJ5FVGeOGcIt_Qvhw671T1a3Y9-qyiwEYdNwqJwSE2Gz8uBqH9DwIFuiLpReLcw-gslBKZMeCj_Ur9frZHNWITZS1SAlo1BjB57uRk3dtVFmH_prINdmh6BflU4-09YbZlEKOt208rwzNyo-oXBIoqnRZmO42B0Ysuy2aenWUkZY6xs2TlPBpAIUAytbDPer0s9Nd2YZBNMNqFTDjz_0tGZHrydVrpjrkESRYxhu4LJMH1qn7jV7Wk2vau5OCVuqqMBKFZm74uUn4S1OwI65IzOZZIMvxL99iZEbPeNfbCsgNBzr-R0N9LIULIWtMpx9qkMI-oXvHi3b-Zxy-ByN3PKcC3zSMoNV5hhOEivnLxXQMMpUoPhYQL9E2HonoAks-WkPW3P0LhHPmAPLPQX_vyRruoVYWQTrQ_IXiZA86d9cBeVvLX8HzkG_mY9VlSZBLVUQSToeczuULs2ztOtq8NQvRebnVYME1RwC9YxELuamve1C8AFpANvGbPLKa-Qzi0UTd2NFgb-ZNQIi3UI0YL_FkYVT6NNtVXXBunn7_lsLXbYodIsbmJE4_pLp_fY9yegTKpySpsbgKYK_7Hk7tJazUsClJ9pieeWIY1crzV5-iq66ZzW3BsETBC4v5pEQXTSlYHCEgzDxCkwFmoHuJDIT57JglTOQC44t1bogeA1uChanxd9GLNUE2zARQ4NUeMM3T43ntAZcOjILAVvsu_MazjU67_Ad0tswwKhV4Oaj5c5Ud5OzAVZS3ohPwgondafRZ5rLGSWWMoGrx3B_80550S7iv_ag7c5PuDeGNd_E-QmgWvsZQXOjaDB9bPahy8SBM585mEw96Jn6wqrEuQ4v8RJD5apU7FP9dl0BGs3X5FKx_MVH0Ovpu65-WoxdbT6fV37FTqW0T4qwSh6WKYXok9ygcObtyPqNZndEIDBoSjn242mF2tjJkuIjp6hpJ-a3jHVEKd6Ji7uYmeMt5aPQ01xywcPgd_cj_o4w4qGv-N5EB-QBYGJKnmRrHdxW-BLUOX33katwxEo5Ueb0CLhlCtT2Rx_2hurEh6aeRgpTcVB_4esSrF3Yrjwkd5uTiWqGy2m6wHj6zaZjl218TvwQhkPBPE1zXBzwRnVaib3e2I2M58KQHrIOASltGTG-P7TNvU7dKrNKuhalQ0Fgq0DvL9vo980oHnOrit9leU13nEY3NA_O25TokoRkfu5pOI_fLAovooDxVPECx35mpQlO1L6hdkjut6O5ECtpTqnZIc1pryILbFiLBPljIQwtyCnecl-c9gASVpT5hCahIvB3TxYtRHHXA6o4w_ucrOKXDWjEkbuXstfky7qdid60pp7ppqOO9L54hfdSsuisYqAdc_qfasM2vjb-1X8CYBH19lxXga-ip7To0yAV5puzkPL7RLl2zbnSng-unEiUfZmoUkM7PhV5VKIZAVMeH78oGOYL9cm2qjbCa19LEns63JaIMLBzJULu1kXTA8GTf0t441QRu_F0scF3A9QIZ6AUSMaKCED-zJi20lck5uEzPNdoonMcBxK0pkFf_DU7wcm2vPAz8Y113Ub1rOYVXZrva69h78DJhwDjOV94Kpm5s7nGbkPZyUndrpYKIdtTaGxsBxynIPP3-Yu3y581v7n-O2-5umyef2ElMo5prZllrgZ1CDPyhiI5QVYy-NjT6sJJPQ__clf9q2aoS-YOvONvCYP0VYnvlRSzRPIPJbIhxhVeLaaVf8775janl1lwra_Vb9lFwpuRuNE2KessG_6An1g-kYDJHMzDI85JqxAN20ug7s3hg4FD6lusBlRLVOAD0vIP3QMBPVy_J35Q0uieKyBPvkv-yOOLUrkKr9drh1YOrN_5-qGu5LTs21Ai3X_Z4bXSaXAkYwtNyfIg&cid=CAASJeRotH4-KRlGZhBv7UVTTDcGcHCTrnR6HSDBoTe2ybs95CvsOFU&rfl=1%2Chttps%253A%252F%252Fefinancemanagement.com%252F%240

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0e3ae31c2175d55b2ae93913825d2836dd95b1e0f7d825379dc685de25bb85a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33023
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1CBA 42 B
63 B 45ms
42ms Image
image/gif 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BuemaYFZHrtK968KT533k2Ea0EQvjdYdRm-SKD-9_hkU806yzxltP3qbdG3AkPGze7GzbHq-dJxXusCHJEW2UUWoZOE7K_IEgqn4a-zWOrnc-BDck

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/ Frame 1CBA 2 KB
1 KB 26ms
23ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/window_focus_fy2019.js

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:00:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 181
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 20:00:43 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1CBA 117 KB
36 KB 65ms
63ms Script
text/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc68a3e6e6f0074ff46c18beea2033fc4e8c6ee513dc0617758f45e2bdd8b88a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1647431472276194"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 18 Mar 2022 20:03:44 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/ Frame 1CBA 15 KB
6 KB 45ms
42ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 19:56:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 417
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6407
x-xss-protection: 0
server: cafe
etag: 6055885685211612390
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 19:56:47 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 1CBA 0
0 64ms
61ms Image
text/html 2607:f8b0:4006:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTDFz9C6S0WivoJpP-W-CjZWgAppxml_w-F-9SfxZQ0F2b3iHzZ20K2ou1RR_u8eKoN8yWvYsLhgEy8r7kGKibNzYaQMQ
Requested by: Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:808::2004 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H/1.1 200
OK pixel
protected-by.clarium.io/ Frame 1CBA 68 B
345 B 52ms
49ms Image
image/png 3.218.215.219
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_WlZlcUlURmczdDBSVmo3R2g0MWtFYmR4OURBLzI5MDg1NjE1ODA6NzI4eDkw&v=5&s=v31fufa1ufp&id=eyJkZnAiOnsiYWQiOjUwNjgwMzY3MDUsImMiOm51bGwsImwiOjAsIm8iOjI5MDg1NjE1ODAsIkEiOiIvNzExNjE2MzMsMjI1NTAxNTQ5ODYvRUZNX2VmaW5hbmNlbWFuYWdlbWVudC9tb2JfZm9vdGVyX3N0aWNreSIsInkiOjEwMDUwNywiY28iOjAsInMiOiJmdXNlLXNsb3QtMjIyNTg4ODI3NTQtMSJ9fQ%3D%3D&sb=undefined&cb=9547855&h=efinancemanagement.com&d=eyJ3aCI6IldsWmxjVWxVUm1jemREQlNWbW8zUjJnME1XdEZZbVI0T1VSQkx6STVNRGcxTmpFMU9EQTZOekk0ZURrdyIsIndkIjp7Im8iOjI5MDg1NjE1ODAsInciOiI3MjgiLCJoIjoiOTAifSwid3IiOjJ9
Requested by: Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.218.215.219 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-218-215-219.compute-1.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:44 GMT
Server: nginx/1.14.0 (Ubuntu)
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 68
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 5E8D 17 KB
6 KB 61ms
60ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 18 Mar 2022 20:03:44 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 01D8 42 B
64 B 42ms
41ms Fetch
image/gif 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstH92TDErnYJMBDIcxUyIzxrzYg1SS3bcnQ4aNaFnYj-dNW0aHKaKUHaXX_xkJaYflP3tbZGHo3w4tWpKnhxpXcgYRA_pkcgid8Ng&sai=AMfl-YRSW31EeeeB7q-1M75W0c5kJZ-xBHkNjWz_wwTcOYaHoBj7cyvsZtdjq4a7exhyMiMhM8jKlTfOt8QFEtGBPaY5PS_H7V-pa6Zo4JxAAds8ffSYzh9-Vp0TCpbgG7Ed&sig=Cg0ArKJSzDHFYMldpUYLEAE&cid=CAASKORo3zcRRsTK4pzDiXOn4gq5SeRlh7WBDjcQ16qQk7-Xc7EUlbnbzkI&id=lidar2&mcvt=1057&p=73,315,323,1285&mtos=1057,1057,1057,1057,1057&tos=1057,0,0,0,0&v=20220316&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=296420617&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1647633822714&rpt=505&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame B805 42 B
64 B 42ms
42ms Fetch
image/gif 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsssxgyLkeWLWQykhx8VD52w9h5zDzAhl1yp18y3jWW6lgquZ8AzvxNNny90i_arL2uSwcQ57JyF8LNnxxTeMDqXi2IhjCrSEC9cXyKIYUjRvkx6Rs4&sai=AMfl-YTV0O7fCgW5KJ6PPLJOb0aPpGI2S4m6w0UxQ2b5Os6YFwZYE8nnZX42Tj6H0MKrQvI6x0PCjs6fHC2s5-ZsWV7TZndqsl6SidiqASX_8iYZ5_DqG49H6OhYBZCZqdME&sig=Cg0ArKJSzPyTvi3SZpeXEAE&cid=CAASKORoAuJ5dB45IaxWuIljCP4y5WUJVcqbrMrJM7-SoRRMk3qgTqBdMJk&id=lidar2&mcvt=1032&p=547,1329,587,1370&mtos=1032,1032,1032,1032,1032&tos=1032,0,0,0,0&v=20220316&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3886835766&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1647633822725&rpt=608&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 w5W1EixFGUzWFgZOi1zWjT-g-ai_4t-KN23ava9eLxA.js Show response
pagead2.googlesyndication.com/bg/ Frame BBBD 35 KB
14 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/w5W1EixFGUzWFgZOi1zWjT-g-ai_4t-KN23ava9eLxA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c395b5122c45194cd616064e8b5cd68d3fa0f9a8bfe2df8a376ddabdaf5e2f10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 21:48:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 339324
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13798
x-xss-protection: 0
last-modified: Mon, 14 Mar 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 14 Mar 2023 21:48:20 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame E317
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP7qu-1-_hNPsGtB-Xcx4rY&google_cver=1&gdpr=0

43 B
61 B

50ms
27ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP7qu-1-_hNPsGtB-Xcx4rY&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMLX3AIQ-9z1Ahis7rW2ATAB&v=APEucNVC_mw15SrhFRtG76oQzQnR9C5j5ol2bwXB9HsNiNM32Tsyu9jiQWIuG3nh_Hx_t0zCMIwFpIXddXPqbhkcTcy4qhnMEdntF0nkA2TkTFj0zD45yHc
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.2.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
via: 1.1 google
server: OXGW/17.2.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP7qu-1-_hNPsGtB-Xcx4rY&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 306
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E317
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&gdpr=0&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZDI4ODdiNmQtMzdlMi02MWIwLTU4NjUtN2FhMTZhYzgwNzIz

170 B
188 B

41ms
35ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZDI4ODdiNmQtMzdlMi02MWIwLTU4NjUtN2FhMTZhYzgwNzIz

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMLX3AIQ-9z1Ahis7rW2ATAB&v=APEucNVC_mw15SrhFRtG76oQzQnR9C5j5ol2bwXB9HsNiNM32Tsyu9jiQWIuG3nh_Hx_t0zCMIwFpIXddXPqbhkcTcy4qhnMEdntF0nkA2TkTFj0zD45yHc

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 18 Mar 2022 20:03:44 GMT
content-encoding: gzip
server: OXGW/17.2.1
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZDI4ODdiNmQtMzdlMi02MWIwLTU4NjUtN2FhMTZhYzgwNzIz
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame E317
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm&gdpr=0
https://sync.teads.tv/um?eid=3&uid=CAESEFF24qTrmnALS6gVbJ3NRIo&google_cver=1&gdpr=0

23 B
287 B

30ms
29ms

Image
image/gif

23.200.197.46
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEFF24qTrmnALS6gVbJ3NRIo&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMLX3AIQ-9z1Ahis7rW2ATAB&v=APEucNVC_mw15SrhFRtG76oQzQnR9C5j5ol2bwXB9HsNiNM32Tsyu9jiQWIuG3nh_Hx_t0zCMIwFpIXddXPqbhkcTcy4qhnMEdntF0nkA2TkTFj0zD45yHc
Protocol: H2
Server: 23.200.197.46 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-197-46.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
cache-control: max-age=0, no-cache, no-store
expires: Fri, 18 Mar 2022 20:03:44 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEFF24qTrmnALS6gVbJ3NRIo&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 292
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E317
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&gdpr=0&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZjUwZWU0OTMtYmExNS00NWNlLWIxNTYtMDE4MjQ0OTI1MDY5

170 B
188 B

39ms
37ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZjUwZWU0OTMtYmExNS00NWNlLWIxNTYtMDE4MjQ0OTI1MDY5

Requested by

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
server: akka-http/10.2.7
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZjUwZWU0OTMtYmExNS00NWNlLWIxNTYtMDE4MjQ0OTI1MDY5
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Fri, 18 Mar 2022 20:03:44 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 1CBA 106 KB
37 KB 34ms
34ms Script
text/javascript 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
Origin: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 05:01:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54138
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 19 Mar 2022 05:01:26 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220316/r20110914/elements/html/ Frame 1CBA 8 KB
3 KB 35ms
35ms Script
text/javascript 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220316/r20110914/elements/html/omrhp.js

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 19:53:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 639
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 19:53:05 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220316/r20110914/ Frame 1CBA 25 KB
9 KB 32ms
32ms Script
text/javascript 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220316/r20110914/abg_lite.js

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a18b0faf6a447454e134730303202f8416b72f1d4f744b1d3b4646636240eb7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:00:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 206
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9657
x-xss-protection: 0
server: cafe
etag: 16576748017229546422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 20:00:18 GMT

GET
H3 200 w5W1EixFGUzWFgZOi1zWjT-g-ai_4t-KN23ava9eLxA.js Show response
pagead2.googlesyndication.com/bg/ Frame D613 35 KB
14 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/w5W1EixFGUzWFgZOi1zWjT-g-ai_4t-KN23ava9eLxA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c395b5122c45194cd616064e8b5cd68d3fa0f9a8bfe2df8a376ddabdaf5e2f10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 21:48:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 339324
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13798
x-xss-protection: 0
last-modified: Mon, 14 Mar 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 14 Mar 2023 21:48:20 GMT

POST
H/1.1 204
No Content event.png
tpsc-nyc.doubleverify.com/ Frame F52D 0
295 B 68ms
28ms Ping
text/plain 204.154.110.85
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tpsc-nyc.doubleverify.com/event.png?impid=728bc659198b4c759aaa5f2e68c8aced&gdpr=&gdpr_consent=&dvp_gdpr_Error=3&dvp_gdv2_Error=3&dvp_atali=1&eoid=8&msrjs=2394&nav_pltfrm=Linux%20x86_64&sdf=2&vit=2&isvelg=1&tltms=26&tetms=11&msltms=29&vltms=0&sei=290&vetms=396&engms=1&engisel=1&ttfurm=478&cbust=1647633824554288
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements2394.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 204.154.110.85 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS: nycp-phlb115.doubleverify.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:37 GMT
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Vary: Origin
Expires: 03/17/2022 20:03:44

POST
H/1.1 204
No Content event.png
tpsc-nyc.doubleverify.com/ Frame 994B 0
295 B 66ms
27ms Ping
text/plain 204.154.110.85
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tpsc-nyc.doubleverify.com/event.png?impid=503fc9071caa4364a76ac2096e1d7b94&gdpr=&gdpr_consent=&dvp_gdpr_Error=3&dvp_gdv2_Error=3&dvp_atali=1&eoid=8&msrjs=2394&nav_pltfrm=Linux%20x86_64&sdf=2&vit=2&isvelg=1&tltms=92&tetms=14&msltms=57&vltms=0&sei=290&vetms=489&engms=1&engisel=1&ttfurm=593&cbust=1647633824556115
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements2394.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 204.154.110.85 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS: nycp-phlb115.doubleverify.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:43 GMT
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Vary: Origin
Expires: 03/17/2022 20:03:44

GET
H3 200 45445403_20210211104523853_BG_WHITE_300x250.png
s0.2mdn.net/ads/richmedia/studio/45445403/ Frame 5E8D 6 KB
6 KB 21ms
20ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/45445403/45445403_20210211104523853_BG_WHITE_300x250.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a0c8701c23290812879be1ef427bde67d9ecd5736dbaffc34390d0364d802f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3576529225204264240/index.html?e=69&leftOffset=0&topOffset=0&c=soFmfCprkm&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 10:57:01 GMT
x-content-type-options: nosniff
age: 32803
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6212
x-xss-protection: 0
last-modified: Thu, 11 Feb 2021 18:45:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 19 Mar 2022 10:57:01 GMT

GET
H3 200 45445403_20210308130317875_active-rtb-plat-tools4_300x250.jpg
s0.2mdn.net/ads/richmedia/studio/45445403/ Frame 5E8D 16 KB
16 KB 23ms
22ms Image
image/jpeg 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/45445403/45445403_20210308130317875_active-rtb-plat-tools4_300x250.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

736e6160ea54ce0f5ea5829f594769df54b69e331f466d6266c2388160591673

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3576529225204264240/index.html?e=69&leftOffset=0&topOffset=0&c=soFmfCprkm&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 18:42:18 GMT
x-content-type-options: nosniff
age: 4886
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16739
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 21:03:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 19 Mar 2022 18:42:18 GMT

GET
H3 200 45445403_20210211104604910_BG_WHITE_300x600.png
s0.2mdn.net/ads/richmedia/studio/45445403/ Frame 354A 7 KB
7 KB 28ms
27ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/45445403/45445403_20210211104604910_BG_WHITE_300x600.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

367504ec66c69e0ffe7e012e69afebe694875bdf54789f50115c2a7cd6dfdc23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15468249809515949982/index.html?e=69&leftOffset=0&topOffset=0&c=SXjhYzOttR&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 11:04:09 GMT
x-content-type-options: nosniff
age: 32375
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7637
x-xss-protection: 0
last-modified: Thu, 11 Feb 2021 18:46:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 19 Mar 2022 11:04:09 GMT

GET
H3 200 45445403_20210319133612718_active-rtb-people_300x600.jpg
s0.2mdn.net/ads/richmedia/studio/45445403/ Frame 354A 31 KB
31 KB 28ms
27ms Image
image/jpeg 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/45445403/45445403_20210319133612718_active-rtb-people_300x600.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

64e1190aced269c09501ab868536163bcef8f20e60dce855782e5c4c95bc700b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15468249809515949982/index.html?e=69&leftOffset=0&topOffset=0&c=SXjhYzOttR&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:08:52 GMT
x-content-type-options: nosniff
age: 28492
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31897
x-xss-protection: 0
last-modified: Fri, 19 Mar 2021 20:36:13 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 19 Mar 2022 12:08:52 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 1CBA 41 KB
15 KB 20ms
20ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 23:40:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73403
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 17 Mar 2023 23:40:21 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame B2E7 1 KB
749 B 20ms
20ms Document
text/html 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Fri, 18 Mar 2022 19:21:12 GMT
expires: Sat, 19 Mar 2022 19:21:12 GMT
cache-control: public, max-age=86400
age: 2552
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 1CBA 8 KB
4 KB 20ms
19ms Script
application/javascript 2600:1400:d:58c::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js
Requested by: Host: efinancemanagement.com
URL: https://efinancemanagement.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:58c::4469 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 1e2134188ba5770173198ec9e02abedaea41d37449ae544e2fa3cb8e229ac54a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 20:03:44 GMT
Content-Encoding: gzip
Last-Modified: Thu, 17 Mar 2022 08:13:20 GMT
Server: Microsoft-IIS/10.0
ETag: "010f1dcd639d81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3290

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/6102345040260877775/ Frame 6D3B 13 KB
3 KB 22ms
20ms Document
text/html 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6102345040260877775/index.html

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

755fbd541a721fd2874befb0eb8b2f7ae861b8aa1d0cefe62aa648f323cbc055

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 2721
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Tue, 15 Mar 2022 15:18:48 GMT
expires: Wed, 15 Mar 2023 15:18:48 GMT
cache-control: public, max-age=31536000
age: 276296
last-modified: Fri, 25 Feb 2022 01:24:16 GMT
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1CBA 0
24 B 57ms
56ms Ping
image/gif 142.251.35.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvde9207vw-Gpk1SavM0aeevN38CzZIq0ugn_jtkj7ltiYJhOPnJj5irIm29Pzb8IVG0joZxaJryKJ1O5ohDdR3UfRJGevHVe394h1BHqj8rZpRFWIY3lMwH90NrWSLZ4FB0I7ehoV2hDQdxVx_MAZwQGS8FOU4_0G0TuaCIl0n_45J_jUTU7FqGeaXfyqGC9BykjmzjG1uASOOCuZGjN1mv_q39XYZxq1xtnYVYWnjiNcOieFlpGm19Mh6vzhG4ZmgEFTxHcXnVQAv4TpgJXszT7yCnjVpZYgctA1OjxCLHWcvb0dYH4tbCO0me08jQLyor959_0OhSkSjpCP3KgPePS04bFNDJeUeagO3X-IOryPFWIvvCRZITTgYfZ6iGLb1oTRFkuWJJWgf5ogRCta8pSuupsoz1gTpORRP0f_eaBqo3rbV6SvN85zB9yb9TKeF1SMdZAv4JHPiqSAMSwoqDiJHk8VuoEvHkb0JIXUI054jy1Pgs-VXeHP52Ad9FI6MbAz6EfMJ1ZNVOMWyPnAToo0UXlD8GAU4ZAlPSjfaq4RNPsLedziSu-iAx-75pMOnX5NvQ4FkFu8Gc-xQburrFa0NvNAKIp9eRN06xC72w8IdRlRzO2r7icySs7TYQtT0xE8GKl-2qPf6Z6hhciCqqp9tRjN4qCVXYsq6B0Y486vsWTBSU_kL8o8RKU_f3sD1w7QknF6rjZ1BbiJ7Q8LcjAw1sOtokwq-L79nIlcPOoAc_HhnGeuvrjXP2SA5To1ZY1uIYmx9Qgbj2qMsHs77Gm-DPFz1ICQArU4wdPXFr9W45Pyy7UTUfgEmKHka29G3mMbvL2j24UAkeHdzcpjmkg1GRDFms29GVezaBrAvqM3Ke1kRBpz7i5somS9VnxaiLssqsHozzLUd6SnHh8yXnPapgBkMI1Z4iXuY3D3oCUUcaTEl1qYBel-z_P3FGAoRqK9tT24RUUNFJ0dIpR34PnNQoqJD6Shf0u-H1mAuABj25753LWqgGgja6KOcOkyhBXMQXnxgU6I4RNGzDJ0d9JQwlR-Q3pmHRJ-AWr_HKuLJ4_mDhLot4-mKIe5sMhPwQJtiWbAX-dmpMFZzk6OrhljkG6VLRgDKHetUwnrEEKSmyYkpSrHiROYo7MJB127QRunJeRn1Cu2V49WeJYbd2Qlv8uPm6CzqB_aFYHxeGfP3TqKNnVrC9Vp6Q1hYEpGnsHwiMhV3C0_wpAdf388Ryvm5TSH5hLSilspIxu2IO4nZycivQxPmVq_h4NPfi3pFXICANkSglOvTW-yoUdhtsg&sai=AMfl-YTfFBE7gz8MIdLMqTxhlVDFvvVTZcZ4BNJ3LrG5ByY9UGSJcZ_2ePb0r-eBOYD7XpL93GPQsDjWowj-6YPX5PeCsOIuvH-1p_ZGZW4_g_Dmn6zBwTZJQyxSD5tkiW_In--7SHedFMsXzfS7uhe03uyb96Mo39nZzUBesGy3ogL81ebeW9CKw_towIL5dvGaPb9Fg-hzNjjhaarG7vqXiObZ&sig=Cg0ArKJSzJVU_9StaW-9EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=225&cbvp=1&cstd=222&cisv=r20220316.71262&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Fri, 18 Mar 2022 20:03:44 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
DATA 200
OK truncated
/ Frame 1CBA 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8bb33142ded6ce02071a3a2e48ca2c434ef1cdff1fae588f88704420929baa48

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 953D 0
20 B 49ms
48ms Image
image/gif 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bphm4nuU0Yo3dA-35j-8Pq5S9uAoAAAAAOAHgBAI&bg=!aWqlai7NAAba2mK92to7ACkAdvg8WvLx7dyo1ykonIYm91eDQxM9LHyAx2KoamKJeDR3QlOKTwrATAIAAAJtUgAAAAJoAQcKAG1X6CkO-YEVA5qXf0EEosm0cIm6Edpf_mblQVf4a4AOK_VI8913NiKlnCLOPFvAd1oeCauywsqtb1GNhzTe8kS1xvc_jkrOBXp_mLyL6gmanNgH0isra_kCXCt_N8mpRoceP9Jnasf5C3yQjHncmQMiOOwAYGoZPU9_OkIW3rQ4KdMrogw7rSroiQdRZb7EruOPGfupShUTXh03ExqcOFEBc3SwbCFYm79B26etj1kCsallkR1fxbaxCp6_wHeHd9fk2XANmNKrmhTK--WjwgzTE1MVGKwydI-vOTxZ6g-PsA0xdOrOX3mok0TtPjvtMTNohGWnxKTM6s1qdAaF0quWqY1zK7ErKhblSSpfLQWg_HjRLtwemMAWWQU9K4Tvz9skLmna1Z03GKmKY9ETeH2jX1xi216JG8CB6r8idiTfiMW--RQf0ymxr2FHYK_mf7m72GjBJgsmEl1zZ7UkP3MMTOUTQLbvU93d7vWVA-EZKE9SBpzLbSPwvld7KRNAMFaMLwDTFahpwtuVO96TLEIX_N5EIPJLMzUVZcBY1xo5nLrs_fxRmZlrllaMym3Hd5N-LqrzIMA6tSfP73R4Terdgcqi-LA9bOITchLeVTjcs6qSsZbiQtMcPJ4Bo1cEg2_Hbd-PJcWnmnoMzc77rBhQ0VWoSPdpTtaTU_kig0OxLSZkjbc7qE-5oa6rFvWIjMwEjhxFtxH9p8hk_uqxriJyLz_Cnb9YvZtcXQSTg_GqXfkuhPRj41RVu2iqaKUfx6-GBonTDekBStPd-VSNsbq7FaFOqsOhtEPGz9SOFRAPEJOumlYeOSfpNmna8BKY0E09otAsUVpUzMS1yruvT_4DjTt8QCxtNu2L3iErcSLBnJEEr6qGNO8qXC-6Atxct80GWknhFe7dKm_6azSMfghOOOb6k-7Bt_kWlb-RNK0i4JZiPlRJ-tAtVEWlAFEBm05hIkEwHIeBqsb486pfVCUSrkiuOujc65t9X37zpFk5QCDw6H9_K1rfgwYLtMmP3o1sh48VYc9nj7hkgLEA8OLqTISap5J9ME0AeB3yKYpCHPAfhLqpjbMM42019jDn8zkIb40K1FIKzyC_i9NeGGlRCj3ZdVPEEcVz3YKvYFa2nTy4Kaqi6K--r8BpQ_6pQeHymNoiVkUD5hFGiDQZpr-m1EhbF9ai5t_gDfILNu3mMDS-wlH5gOkkHG9mQhwgj6jlHw

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 I401375218344032.svg
s0.2mdn.net/sadbundle/6102345040260877775/images/ Frame 6D3B 8 KB
2 KB 23ms
22ms Image
image/svg+xml 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6102345040260877775/images/I401375218344032.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6102345040260877775/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a1b4e8f31049faa253bc03767705dc30728017d777f31a1eafa2fb344b59e41d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6102345040260877775/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 15:26:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 103039
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2103
x-xss-protection: 0
last-modified: Fri, 25 Feb 2022 01:24:16 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Mar 2023 15:26:25 GMT

GET
H3 200 I401375218344033.svg
s0.2mdn.net/sadbundle/6102345040260877775/images/ Frame 6D3B 8 KB
2 KB 24ms
24ms Image
image/svg+xml 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6102345040260877775/images/I401375218344033.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6102345040260877775/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d239327291f2627beaf65d759afb4dcffea44d76edfc6b30b6bb53668adc1f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6102345040260877775/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 22:29:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 164036
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1999
x-xss-protection: 0
last-modified: Fri, 25 Feb 2022 01:24:16 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 22:29:48 GMT

GET
H3 200 I401375218344034.svg
s0.2mdn.net/sadbundle/6102345040260877775/images/ Frame 6D3B 9 KB
2 KB 24ms
22ms Image
image/svg+xml 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6102345040260877775/images/I401375218344034.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6102345040260877775/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9461c8a01fb108c40dfd85631a6f229e70b324b53604a307fbf34095fe35e337

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6102345040260877775/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 22:29:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 164036
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2158
x-xss-protection: 0
last-modified: Fri, 25 Feb 2022 01:24:16 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 22:29:48 GMT

GET
H3 200 I401375218344035.svg
s0.2mdn.net/sadbundle/6102345040260877775/images/ Frame 6D3B 2 KB
756 B 24ms
22ms Image
image/svg+xml 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6102345040260877775/images/I401375218344035.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6102345040260877775/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

680f6c43b358f61def97cab0114452d7c6f1dd5d6801ca3df2ef8564da7478a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6102345040260877775/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 11:03:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 118834
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 719
x-xss-protection: 0
last-modified: Fri, 25 Feb 2022 01:24:16 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Mar 2023 11:03:10 GMT

GET
H3 200 I401375218344036.svg
s0.2mdn.net/sadbundle/6102345040260877775/images/ Frame 6D3B 2 KB
1 KB 25ms
23ms Image
image/svg+xml 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6102345040260877775/images/I401375218344036.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6102345040260877775/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e15229609fbe0890a77ea743005bab0c21cf690a75f515b9a7da14c3cb34d430

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6102345040260877775/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 22:29:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 164036
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1203
x-xss-protection: 0
last-modified: Fri, 25 Feb 2022 01:24:16 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 22:29:48 GMT

GET
H3 200 I401375218344037.png
s0.2mdn.net/sadbundle/6102345040260877775/images/ Frame 6D3B 86 KB
86 KB 29ms
27ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6102345040260877775/images/I401375218344037.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6102345040260877775/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

396720984e4d6555ebb2facebda18897c2a397674010997285a0ccb95b15d071

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6102345040260877775/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 15:26:25 GMT
x-content-type-options: nosniff
age: 103039
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87598
x-xss-protection: 0
last-modified: Fri, 25 Feb 2022 01:24:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 17 Mar 2023 15:26:25 GMT

GET
H3 200 I401375218344038.png
s0.2mdn.net/sadbundle/6102345040260877775/images/ Frame 6D3B 77 KB
77 KB 32ms
29ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6102345040260877775/images/I401375218344038.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6102345040260877775/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef3e8b82433a2ad49d3138a58d78efb11ebb3ccd831d147ca2b6e4bddd5f1c59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6102345040260877775/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 18:56:27 GMT
x-content-type-options: nosniff
age: 176837
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 78651
x-xss-protection: 0
last-modified: Fri, 25 Feb 2022 01:24:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Mar 2023 18:56:27 GMT

GET
H3 200 I401375218344039.png
s0.2mdn.net/sadbundle/6102345040260877775/images/ Frame 6D3B 83 KB
83 KB 31ms
28ms Image
image/png 2607:f8b0:4006:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6102345040260877775/images/I401375218344039.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6102345040260877775/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2006 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9417cdac891da693391f79324f24e2438c15aa92248490922688dd120f6892f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6102345040260877775/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 15 Mar 2022 15:18:48 GMT
x-content-type-options: nosniff
age: 276296
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 85114
x-xss-protection: 0
last-modified: Fri, 25 Feb 2022 01:24:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 15 Mar 2023 15:18:48 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 16CD 22 KB
8 KB 22ms
20ms Document
text/html 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 17 Mar 2022 23:40:21 GMT
expires: Fri, 17 Mar 2023 23:40:21 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 73403
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2222 0
20 B 45ms
43ms Image
image/gif 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BQZfrn-U0YooRx9j-BObfnMAJAAAAADgB4AQC&bg=!FRalFlLNAAba2mK92to7ACkAdvg8WuS0qp52YIWUcuH3w34BWE4n_oPwG8M4ImOnLRr3Ii_HQ9AvcQIAAAI3UgAAAARoAQeZAy4tQo2iKddhYaOoGTnd1llvPc0Jf6pQwhHdh4I9oSWGhmSdu63HZ61vKp1sSVumKqhE07OJt-9OMqzXQFOfej6AQHMx3ZXkex020hqW4sraOulJ3DGtjmBWce48CwoQWj1Y582qpN5P5R6jCWrYwBAGzg_pn94D9mLccNK2hKYXluitZJ0h7MIwVrdjFScgiKpXjE5duyvd0zMhBYspo9VzUsAS_CKnw2mpVqwhV_2fMVL_f4Pd1MK4cm9nrcitgRE8oA03TGwZ7qcrg5GDK4EPzFzExPrhEs4D4AL54H8sybj8zuXguwrLUSjdSmlqt30aUfMt22dckodIL_htv9LCSATLkGFCJWOOnkhJ76ZtKPWPex_bzu9JE7M_hfz1998Oaxs-WuSms_eZUJAyvy81EftNTgYDUSpQwiGATMUIqZk2YWCpCXmz675mQnOcwFrZw5sgD4kUOxWwDOex0FHTMtzIQl5-erriohSuG5uQ2dRFnzKA93PE3cUeglVSgosgClx4oXBVVwTyoDGHGIM-xvaYffAOcHO63GPJn1pJShG39Z86vfGBjj6Q9FuZ6pkhTEu9UY0G2kCwJwxU0XQsAPjzRFtf_qeOqNzkVx3Ef6FPqC1OqdzLILuR9tezRWlsF7lLveMuzrb_QN8Mtp1lf-Jnv1Fr6FfSipBr2BrufBU9c8hiU2XhHUqAbYmb-mtmnaEEfQY6FWwO-RSqr4W98YnRhveEJUSuzO1UPizZrAho02KpLHHazblQ4XcmdaWSTuXTBBpAErX_v9wx3hbJrSQuXbWxz89UwOO2G6t9IVS9wM6HckEicaPJU-jnjewd9IgcqQCQspPFlxXGzRtxp2URtdBsA7bhXkfPqEXi2_TSPJYe9XFbzvABcI60NoPB_ObDhjURMgkNq4HUNlKY5Hvi2aZEaGeobvg7z6f5OHJ01I3nmfylbdp9akTMs8lXcaQsA3rPas77Gmi6w0qBclL65m24woMMXVKwhCjQVC6AxfSVOX3dOE9GgrTrxFKCh8VLDT2Ra5SuLUXv-GRkErIpQfrceOJfbLjwUtKsTrqCLuMehcoSWHD8Vd1J

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame B2E7
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEHt0EII9Mqh_C_rWjO9uTVQ&google_cver=1&google_push=AYg5qPJ71MPJXGMJijiTpbX61-LEyjDqeU-gBZ-__DlWWrLRLb9S30d8ArdDFKsWxLzroyOXGSJuAUiMxiViWYU6dlQpNhOb4DST
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODA5MzY4ODk5NzIzOTkyNzE1Ng==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEHt0EII9Mqh_C_rWjO9uTVQ&google_cver=1

43 B
398 B

141ms
40ms

Image
image/gif

2620:112:f002:bbbb::21
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEHt0EII9Mqh_C_rWjO9uTVQ&google_cver=1
Protocol: H2
Server: 2620:112:f002:bbbb::21 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEHt0EII9Mqh_C_rWjO9uTVQ&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame B2E7
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESELtZDnB8HeCsaSrkQ2gu_GY&google_cver=1&google_push=AYg5qPKd-sLJPXK5yDvZh_QP16jEjHA-BRWGvcKJh_q5YBacjG9336FQ5Qz3V1bdyrp7lzn5v1cEJChh3w68NZe_YJTyXKhitJFn&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESELtZDnB8HeCsaSrkQ2gu_GY&google_cver=1&google_push=AYg5qPKd-sLJPXK5yDvZh_QP16jEjHA-BRWGvcKJh_q5YBacjG9336FQ5Qz3V1bdyrp7lzn5v1cEJChh3w68NZe_YJTyXKhitJF...

43 B
450 B

106ms
93ms

Image
image/gif

2606:4700::6812:d05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESELtZDnB8HeCsaSrkQ2gu_GY&google_cver=1&google_push=AYg5qPKd-sLJPXK5yDvZh_QP16jEjHA-BRWGvcKJh_q5YBacjG9336FQ5Qz3V1bdyrp7lzn5v1cEJChh3w68NZe_YJTyXKhitJFn&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPKd-sLJPXK5yDvZh_QP16jEjHA-BRWGvcKJh_q5YBacjG9336FQ5Qz3V1bdyrp7lzn5v1cEJChh3w68NZe_YJTyXKhitJFn%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 2606:4700::6812:d05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6ee092ce5b62713c-YUL
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
content-type: image/gif; charset=utf-8
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 79
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6ee092cd8a75713c-YUL
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESELtZDnB8HeCsaSrkQ2gu_GY&google_cver=1&google_push=AYg5qPKd-sLJPXK5yDvZh_QP16jEjHA-BRWGvcKJh_q5YBacjG9336FQ5Qz3V1bdyrp7lzn5v1cEJChh3w68NZe_YJTyXKhitJFn&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPKd-sLJPXK5yDvZh_QP16jEjHA-BRWGvcKJh_q5YBacjG9336FQ5Qz3V1bdyrp7lzn5v1cEJChh3w68NZe_YJTyXKhitJFn%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control: no-cache, private
content-type: text/html
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B2E7
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEDSGovFEXaC6vHRJnGqTyNQ&google_cver=1&google_push=AYg5qPItBBWpznkR7sJ7EVVPdh9tT0VDy3HTpB-oJowFHoNdoSA26lVt6djI5apOQbUPxWMsU4KtOfo3lasR08qVeC3QgMEldigs
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=6D836FC997B54B02B6DC867D58AF78BA&google_push=AYg5qPItBBWpznkR7sJ7EVVPdh9tT0VDy3HTpB-oJowFHoNdoSA26lVt6djI5apOQbUPxWMsU4KtOfo3lasR08q...

170 B
188 B

36ms
35ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=6D836FC997B54B02B6DC867D58AF78BA&google_push=AYg5qPItBBWpznkR7sJ7EVVPdh9tT0VDy3HTpB-oJowFHoNdoSA26lVt6djI5apOQbUPxWMsU4KtOfo3lasR08qVeC3QgMEldigs

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 18 Mar 2022 20:03:44 GMT
x-content-type-options: nosniff
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=6D836FC997B54B02B6DC867D58AF78BA&google_push=AYg5qPItBBWpznkR7sJ7EVVPdh9tT0VDy3HTpB-oJowFHoNdoSA26lVt6djI5apOQbUPxWMsU4KtOfo3lasR08qVeC3QgMEldigs
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Thu, 17 Mar 2022 20:03:44 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B2E7
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESENaXu-sr8VQPEvaFhl7iVl0&google_cver=1&google_push=AYg5qPKp5b77O-ZrtYNwZXiNtP2XWiYp5sDgEOxWuHzCNEShJiiQJKxGWWSyqFmAtbWe25vZA8S9-Qnt...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESENaXu-sr8VQPEvaFhl7iVl0&google_cver=1&google_push=AYg5qPKp5b77O-ZrtYNwZXiNtP2XWiYp5sDgEOxWuHzCNEShJiiQJKxGWWSyqFmAtbWe25vZA8S...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTcwNDYwNjcwODEwNjQ1ODQ5&google_push=AYg5qPKp5b77O-ZrtYNwZXiNtP2XWiYp5sDgEOxWuHzCNEShJiiQJKxGWWSyqFmAtbWe25vZA8S9-Qnt...

170 B
188 B

36ms
35ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTcwNDYwNjcwODEwNjQ1ODQ5&google_push=AYg5qPKp5b77O-ZrtYNwZXiNtP2XWiYp5sDgEOxWuHzCNEShJiiQJKxGWWSyqFmAtbWe25vZA8S9-QntlombvCVjW2XNsWAWB8a1

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTcwNDYwNjcwODEwNjQ1ODQ5&google_push=AYg5qPKp5b77O-ZrtYNwZXiNtP2XWiYp5sDgEOxWuHzCNEShJiiQJKxGWWSyqFmAtbWe25vZA8S9-QntlombvCVjW2XNsWAWB8a1
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B2E7
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESELQNZ_PqjwUvKH0nEIsim6M&google_cver=1&google_push=AYg5qPKtCB2vyhGojqKYyHfI0fLKhREECYxEaIYKuW130TDvgIdlbT4xWh-_p7ctqs5d70Qf3DGgfPykrR_B3O15EnAhezppHmFB
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKtCB2vyhGojqKYyHfI0fLKhREECYxEaIYKuW130TDvgIdlbT4xWh-_p7ctqs5d70Qf3DGgfPykrR_B3O15EnAhezppHmFB&google_hm=IbEim1cThjqr8WyvczPz-Q==

170 B
188 B

37ms
36ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKtCB2vyhGojqKYyHfI0fLKhREECYxEaIYKuW130TDvgIdlbT4xWh-_p7ctqs5d70Qf3DGgfPykrR_B3O15EnAhezppHmFB&google_hm=IbEim1cThjqr8WyvczPz-Q==

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKtCB2vyhGojqKYyHfI0fLKhREECYxEaIYKuW130TDvgIdlbT4xWh-_p7ctqs5d70Qf3DGgfPykrR_B3O15EnAhezppHmFB&google_hm=IbEim1cThjqr8WyvczPz-Q==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-request-id: 1ub57q7etphrevo6ags8rno7dbj8oja7

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B2E7
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=NhxiBMG0RdSxAz6KBViFMg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

38ms
37ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=NhxiBMG0RdSxAz6KBViFMg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPL7SZEC3Bp7n3mwPz7Oy1RqTeVbco68G1m7j8_VcbvuHPPHLkCdVWV5gehGm7vWgv4aJaAY1QHKJrzuZEvLe2r9clUJYAXF

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=NhxiBMG0RdSxAz6KBViFMg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPL7SZEC3Bp7n3mwPz7Oy1RqTeVbco68G1m7j8_VcbvuHPPHLkCdVWV5gehGm7vWgv4aJaAY1QHKJrzuZEvLe2r9clUJYAXF
date: Fri, 18 Mar 2022 20:03:43 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B2E7
Redirect Chain

https://beacon.lynx.cognitivlabs.com/adx.gif?google_gid=CAESELiJBMqZmYf_Bg_hOtJudkE&google_cver=1&google_push=AYg5qPIO1E2UtWzscpie3XghZfM_QZ0y8AxP_vQ_5xQ3PD275wcXDjPQM88r6ahKG25-wTQzGRjV1JrfBsDPrr0...
https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=Ar15mXK40kCs7NQ1mXac2w&google_push=AYg5qPIO1E2UtWzscpie3XghZfM_QZ0y8AxP_vQ_5xQ3PD275wcXDjPQM88r6ahKG25-wTQzGRjV1JrfBsDPrr0avU6-BvY4dW79

170 B
188 B

36ms
36ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=Ar15mXK40kCs7NQ1mXac2w&google_push=AYg5qPIO1E2UtWzscpie3XghZfM_QZ0y8AxP_vQ_5xQ3PD275wcXDjPQM88r6ahKG25-wTQzGRjV1JrfBsDPrr0avU6-BvY4dW79

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=Ar15mXK40kCs7NQ1mXac2w&google_push=AYg5qPIO1E2UtWzscpie3XghZfM_QZ0y8AxP_vQ_5xQ3PD275wcXDjPQM88r6ahKG25-wTQzGRjV1JrfBsDPrr0avU6-BvY4dW79
date: Fri, 18 Mar 2022 20:03:44 GMT
server: Kestrel
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame B2E7 0
12 B 34ms
33ms Image
text/html 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Iqhw2rVLL-uKEWribI0qD4HKGSrg3-miKCFd8CS9WrphuiQK1mVu7wf27f8V7E90MMzw3A0A

Requested by

Host: 6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com
URL: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:44 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK dv-measurements2394.js Show response
cdn.doubleverify.com/ Frame D67F 513 KB
95 KB 20ms
19ms Script
application/javascript 2600:1400:d:58c::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements2394.js
Requested by: Host: efinancemanagement.com
URL: https://efinancemanagement.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:58c::4469 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: ddc9f0f8a5712dd54bd74954300a96084fa2ad10892ad9d92b335974244ee515

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 20:03:44 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Mar 2022 14:45:16 GMT
Server: Microsoft-IIS/10.0
ETag: "02628734439d81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 96951

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6951 0
20 B 48ms
47ms Image
image/gif 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BZR6Qn-U0YqH-BaeBoPwPsd2hqAkAAAAAOAHgBAI&bg=!PT6lPnrNAAba2mK92to7ACkAdvg8WrOYcpDI2NdOpCZkrfG8OYGi6NFfvSdGgK2CkQu82_VF93kgOwIAAAIFUgAAAAJoAQeZAzcR49HoNL74EjDUnLse_hB4KQCWBnHVX_pDmqQ9GnfCeJyB4JSJFOuCvyH_1ZOSWkvGnMKSji15M29KtJfmmf9dyOwCYIKoIhh-vEra4i1JOF4AKZpiRRw2vlhl6aWWwxuCbA_uVyjmRtYTltjQZrDUoPSSS9Y-MBEjeDYPLS4KzK-z5tBhWDU1VzlIH-HTfzsEsJ2w9oDplJkBdZvbhVAg426kiKiMAeegJdhGOUMnB52XKGtduNZTLYvXKdHSVC8asioqb5GoxFIEzUf6T2Gnxv0yil6h4vkW0u3aUYtKuBROam7fc4HMDBxfw1KAHu0gETrXX-vPwdqUeID-1G_QOU_b06T6ciXe_rOs6clpXRPsShHExDfgj9EJYglCgs8YTUm4p1pyBFjHMvrcxGds8Pmg27eEip76YduuD24JSaJbKIerhaapuxm28P9ek_jIHZr01l5yIs-Edq-RG6pIQ6fL44OEerlqGiW-B_krVRt5fOrz7zYFBFk2Gi-Ycna2EenkuoO274QidemLKVi_h9J2AIuGrMroXwZExDFcr3Mih8PI66CLnfram0vzOgDG9B0Iih7DdTWvjUSonjCVbTQP4GDbykfQNF2p4ZfBsRzG8vBpMMw3TLWm_uMEuEqi2LaN9_wxt3Enh2F2uucYZHplbXO3wo6-ifPIwJCj2hPyfyCx8aD44noGkG9aKCFB5hU-p_acW7zjlETAtSzLK1y1q2ylI51RzkurQu2ZROiqyrUtrU0NjG0h3uV9OT_5npyffwyk61hka71IMkffBjaFCeyLp9qNGnLRr-mhnaWWazaT2YF-zozSBKfTDty5PmPFgAQhSt3QO0Zj2BOYdLZrmS02pT48Kypzuv38SitLN2KL_Z-T8IVv3_v8KP7TZpd5pHUnI88FekkLrMxN4GsnryFS4lWQSrhfe7Oru2raomce7XXImbn3BbmfdqzyeaTSe_WDRM7q0KTmlaiFq_D0XuEsFaaJ7gfDYtNz9gepoZUrV1pSQqHMGYwDxBbG3PSc1-QUdK5RUl8W2FBaNQJXxlyEcbGpA29FmnvMNGlecybfc5kgKRqUGntDQ_SZMOutxM4z

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1CBA 0
23 B 44ms
44ms Ping
image/gif 142.251.35.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvde9207vw-Gpk1SavM0aeevN38CzZIq0ugn_jtkj7ltiYJhOPnJj5irIm29Pzb8IVG0joZxaJryKJ1O5ohDdR3UfRJGevHVe394h1BHqj8rZpRFWIY3lMwH90NrWSLZ4FB0I7ehoV2hDQdxVx_MAZwQGS8FOU4_0G0TuaCIl0n_45J_jUTU7FqGeaXfyqGC9BykjmzjG1uASOOCuZGjN1mv_q39XYZxq1xtnYVYWnjiNcOieFlpGm19Mh6vzhG4ZmgEFTxHcXnVQAv4TpgJXszT7yCnjVpZYgctA1OjxCLHWcvb0dYH4tbCO0me08jQLyor959_0OhSkSjpCP3KgPePS04bFNDJeUeagO3X-IOryPFWIvvCRZITTgYfZ6iGLb1oTRFkuWJJWgf5ogRCta8pSuupsoz1gTpORRP0f_eaBqo3rbV6SvN85zB9yb9TKeF1SMdZAv4JHPiqSAMSwoqDiJHk8VuoEvHkb0JIXUI054jy1Pgs-VXeHP52Ad9FI6MbAz6EfMJ1ZNVOMWyPnAToo0UXlD8GAU4ZAlPSjfaq4RNPsLedziSu-iAx-75pMOnX5NvQ4FkFu8Gc-xQburrFa0NvNAKIp9eRN06xC72w8IdRlRzO2r7icySs7TYQtT0xE8GKl-2qPf6Z6hhciCqqp9tRjN4qCVXYsq6B0Y486vsWTBSU_kL8o8RKU_f3sD1w7QknF6rjZ1BbiJ7Q8LcjAw1sOtokwq-L79nIlcPOoAc_HhnGeuvrjXP2SA5To1ZY1uIYmx9Qgbj2qMsHs77Gm-DPFz1ICQArU4wdPXFr9W45Pyy7UTUfgEmKHka29G3mMbvL2j24UAkeHdzcpjmkg1GRDFms29GVezaBrAvqM3Ke1kRBpz7i5somS9VnxaiLssqsHozzLUd6SnHh8yXnPapgBkMI1Z4iXuY3D3oCUUcaTEl1qYBel-z_P3FGAoRqK9tT24RUUNFJ0dIpR34PnNQoqJD6Shf0u-H1mAuABj25753LWqgGgja6KOcOkyhBXMQXnxgU6I4RNGzDJ0d9JQwlR-Q3pmHRJ-AWr_HKuLJ4_mDhLot4-mKIe5sMhPwQJtiWbAX-dmpMFZzk6OrhljkG6VLRgDKHetUwnrEEKSmyYkpSrHiROYo7MJB127QRunJeRn1Cu2V49WeJYbd2Qlv8uPm6CzqB_aFYHxeGfP3TqKNnVrC9Vp6Q1hYEpGnsHwiMhV3C0_wpAdf388Ryvm5TSH5hLSilspIxu2IO4nZycivQxPmVq_h4NPfi3pFXICANkSglOvTW-yoUdhtsg&sai=AMfl-YTfFBE7gz8MIdLMqTxhlVDFvvVTZcZ4BNJ3LrG5ByY9UGSJcZ_2ePb0r-eBOYD7XpL93GPQsDjWowj-6YPX5PeCsOIuvH-1p_ZGZW4_g_Dmn6zBwTZJQyxSD5tkiW_In--7SHedFMsXzfS7uhe03uyb96Mo39nZzUBesGy3ogL81ebeW9CKw_towIL5dvGaPb9Fg-hzNjjhaarG7vqXiObZ&sig=Cg0ArKJSzJVU_9StaW-9EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=469&vt=11&dtpt=244&dett=3&cstd=222&cisv=r20220316.71262&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: efinancemanagement.com
URL: https://efinancemanagement.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:44 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame D67F 1 KB
1 KB 24ms
22ms Script
text/javascript 204.154.110.85
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=106&ttfrms=10&brid=3&brver=99.0.4844.51&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTau67%3A%3F2%3F46%3E2%3F286%3E6%3FE%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTau67%3A%3F2%3F46%3E2%3F286%3E6%3FE%5D4%40%3ETar9EEADTbpTauTaue7aad7hgh355baf4a4f5_5%6063d7cfa5h%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&dfs=639&ddur=23&uid=1647633824965768&jsCallback=dvCallback_1647633824966602&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F99.0.4844.51%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=90&winw=728&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=2394&tgjsver=2394&lvvn=28&m1=13&refD=1&referrer=https%3A%2F%2F6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&fcifrms=9&brh=2&sdf=2&dvp_epl=251&noc=4&ctx=24747209&cmp=26621259&sid=6094202&plc=315951358&crt=167441742&btreg=508260644&btadsrv=doubleclick&adsrv=1&advid=9628649&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&dvp_rcp=2&dvp_htec=1&dvp_seem=2&dvp_tuk=1&dvp_sukv=1224972279078.8997&dvp_tukv=2879857145.100659&dvp_uuid=39454793.06915172&dvp_strhd=1.2000007629394531&dvpx_strhd=1.2000007629394531&dvp_tuid=1203053180632
Requested by: Host: efinancemanagement.com
URL: https://efinancemanagement.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 204.154.110.85 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS: nycp-phlb115.doubleverify.com
Software: /
Resource Hash: 9e80fc11801f5694864321b9931e663678db7adfd592e9066fd37ab0290b0dbd

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://6f225f989bdd327c2c7d0d1eb5f472d9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:44 GMT
Content-Encoding: br
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Transfer-Encoding: chunked
Expires: 03/17/2022 20:03:44

GET
H3 200 w5W1EixFGUzWFgZOi1zWjT-g-ai_4t-KN23ava9eLxA.js Show response
pagead2.googlesyndication.com/bg/ Frame 16CD 35 KB
14 KB 21ms
21ms Script
text/javascript 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/w5W1EixFGUzWFgZOi1zWjT-g-ai_4t-KN23ava9eLxA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c395b5122c45194cd616064e8b5cd68d3fa0f9a8bfe2df8a376ddabdaf5e2f10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 21:48:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 339325
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13798
x-xss-protection: 0
last-modified: Mon, 14 Mar 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 14 Mar 2023 21:48:20 GMT

GET
H/1.1 200
OK ixmatch.html Show response
js-sec.indexww.com/um/ Frame A24A 3 KB
2 KB 87ms
19ms Document
text/html 23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7c3b96f238042f73d0bedf5877fa02eb834e89649bbd122e2f10cc35238173cf

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/

Response headers

Server: Apache
Last-Modified: Fri, 18 Feb 2022 16:05:37 GMT
ETag: "e20015-b6b-5d84d0db0c30a"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Fri, 18 Mar 2022 20:03:45 GMT
Content-Length: 1388
Connection: keep-alive

GET
H3 200 pd Show response
us-u.openx.net/w/1.0/ Frame 287A 672 B
442 B 30ms
29ms Document
text/html 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-u.openx.net/w/1.0/pd?plm=6&ph=eb072722-647b-4387-849c-a8e12a214991&gdpr=0
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.2.1 /
Resource Hash: 62028d022d31d353c834c48bd1055fdc3648aae8cf15891a1e80c39461d520e7

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/

Response headers

vary: Accept, Accept-Encoding
server: OXGW/17.2.1
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Mar 2022 20:03:45 GMT
content-type: text/html
content-length: 423
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 showad.js Show response
ads.pubmatic.com/AdServer/js/ Frame BD00 38 KB
14 KB 70ms
19ms Document
text/html 23.54.68.197
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-197.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: c7cba051adb45bda78591c9b2f415a1009c62ca0301df36f7d92291bf5d423b4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/

Response headers

last-modified: Tue, 15 Mar 2022 05:35:40 GMT
etag: "1302647-96a7-5da3b2ade946f"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 13941
content-type: text/html; charset=UTF-8
cache-control: public, max-age=172557
expires: Sun, 20 Mar 2022 19:59:42 GMT
date: Fri, 18 Mar 2022 20:03:45 GMT
vary: Accept-Encoding

GET
H2 200 connectmyusers.php Show response
cdn.connectad.io/ Frame 2A67 1 KB
745 B 144ms
131ms Document
text/html 2606:4700:10::6816:36ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.connectad.io/connectmyusers.php?
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 08f0465386d9897c95370a004f5251b304dc4f94a73541cccd1ee87c02de2f60

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
content-type: text/html; charset=UTF-8
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6ee092ce6cf0715a-YUL
content-encoding: gzip
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK check.html Show response
biddr.brealtime.com/ Frame A0D7 926 B
1 KB 108ms
45ms Document
text/html 104.17.119.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://biddr.brealtime.com/check.html
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.17.119.107 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 868a78df4f3d0a21f89c48ccc709df44d3875f5fb33e22bf51ca8b5c28be4202

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/

Response headers

Date: Fri, 18 Mar 2022 20:03:45 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
x-amz-id-2: PQGJwS5mz3V310fbHk2B9l1STvvLh1KxZ0wWku/py2DIi8SYQGBl6WDsLI/VUqvbwQdTMLcVrU0=
x-amz-request-id: 01528X8FCJSZ0Q6Y
Last-Modified: Tue, 08 Sep 2020 13:51:51 GMT
CF-Cache-Status: HIT
Age: 6203
Expires: Fri, 18 Mar 2022 21:03:45 GMT
Cache-Control: public, max-age=3600
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 6ee092cebe118cec-EWR
Content-Encoding: gzip

GET
H2

200

/ Show response
de.tynt.com/deb/ Frame 8F22
Redirect Chain

https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=cHY8agyLqr67ujaKj0P0Le&gdpr_consent=undefined&us_privacy=undefined&gdpr=0
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=cHY8agyLqr67ujaKj0P0Le&gdpr_consent=undefined&us_privacy=undefined&gdpr=0
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=cHY8agyLqr67ujaKj0P0Le&gdpr_consent=undefined&us_privacy=undefined&gdpr=0&b=1

1 KB
2 KB

37ms
34ms

Document
text/html

67.202.105.33
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=cHY8agyLqr67ujaKj0P0Le&gdpr_consent=undefined&us_privacy=undefined&gdpr=0&b=1
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.33 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip33.67-202-105.static.steadfastdns.net
Software: /
Resource Hash: 6e511fc17fb255774d4640720ff2c5b61c7e4d09a547682f20d30b6f5794486e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/

Response headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
expires: Sat, 26 Jul 1997 05:00:00 GMT
referrer-policy: unsafe-url
content-type: text/html
content-length: 1333
date: Fri, 18 Mar 2022 20:03:44 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

Redirect headers

location: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=cHY8agyLqr67ujaKj0P0Le&gdpr_consent=undefined&us_privacy=undefined&gdpr=0&b=1
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
expires: Sat, 26 Jul 1997 05:00:00 GMT
referrer-policy: unsafe-url
content-length: 0
date: Fri, 18 Mar 2022 20:03:45 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

GET
H2

200

sync Show response
eb2.3lift.com/ Frame 99FE
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

1 KB
1 KB

25ms
25ms

Document
text/html

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: c2e4180d25cc8009425675cf23fc6849f72ed52e1fe337e46aca85b0089cfc43

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
content-type: text/html; charset=utf-8
content-length: 462
content-encoding: gzip
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate

Redirect headers

date: Fri, 18 Mar 2022 20:03:45 GMT
content-length: 0
location: /sync?&ld=1
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 9B51 52 KB
17 KB 47ms
10ms Document
text/html 151.101.1.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.fuseplatform.net
URL: https://cdn.fuseplatform.net/publift/tags/2/2300/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.18.0 (Ubuntu)
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Mon, 07 Mar 2022 06:18:19 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Fri, 18 Mar 2022 20:03:45 GMT
Age: 49478
X-Served-By: cache-lga21933-LGA, cache-yul12827-YUL
X-Cache: HIT, HIT
X-Cache-Hits: 220438, 215240
X-Timer: S1647633825.057191,VS0,VE0
Vary: Accept-Encoding

GET
H2

204

yahoo
prebid.a-mo.net/setuid/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58570/occ?gdpr=0&gdpr_consent=&uid=b8d8e51c-3ade-4912-8f74-1b9785868363
https://ups.analytics.yahoo.com/ups/58570/occ?gdpr=0&gdpr_consent=&uid=b8d8e51c-3ade-4912-8f74-1b9785868363&verify=true
https://prebid.a-mo.net/setuid/yahoo?uid=y-rDuhmi1E2uFvU9r9jkD9K85uAXlFcn2C3Tt5DGw-~A&gdpr=0&gdpr_consent=

0
112 B

21ms
20ms

Image
text/plain

147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/yahoo?uid=y-rDuhmi1E2uFvU9r9jkD9K85uAXlFcn2C3Tt5DGw-~A&gdpr=0&gdpr_consent=
Protocol: H2
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:44 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid/yahoo?uid=y-rDuhmi1E2uFvU9r9jkD9K85uAXlFcn2C3Tt5DGw-~A&gdpr=0&gdpr_consent=
date: Fri, 18 Mar 2022 20:03:45 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

verizon_video
prebid.a-mo.net/setuid/
Redirect Chain

https://pixel.advertising.com/ups/58474/sync?redir=true&gdpr=0&gdpr_consent=&uid=b8d8e51c-3ade-4912-8f74-1b9785868363
https://pixel.advertising.com/ups/58474/sync?redir=true&gdpr=0&gdpr_consent=&uid=b8d8e51c-3ade-4912-8f74-1b9785868363&verify=true
https://ups.analytics.yahoo.com/ups/58474/sync?redir=true&gdpr=0&gdpr_consent=&uid=b8d8e51c-3ade-4912-8f74-1b9785868363&apid=UP84262240-a6f6-11ec-8ca3-0e9024a78271
https://prebid.a-mo.net/setuid/verizon_video?uid=UP84262240-a6f6-11ec-8ca3-0e9024a78271&gdpr=0&gdpr_consent=

0
112 B

19ms
18ms

Image
text/plain

147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/verizon_video?uid=UP84262240-a6f6-11ec-8ca3-0e9024a78271&gdpr=0&gdpr_consent=
Protocol: H2
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:44 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid/verizon_video?uid=UP84262240-a6f6-11ec-8ca3-0e9024a78271&gdpr=0&gdpr_consent=
date: Fri, 18 Mar 2022 20:03:45 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

magnite
prebid.a-mo.net/setuid/
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&gdpr=0&gdpr_consent=&us_privacy=1---
https://prebid.a-mo.net/setuid/magnite?uid=L0WUMZWW-24-HR4I&gdpr=0&us_privacy=1---

0
124 B

20ms
19ms

Image
text/plain

147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/magnite?uid=L0WUMZWW-24-HR4I&gdpr=0&us_privacy=1---
Protocol: H2
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:44 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://prebid.a-mo.net/setuid/magnite?uid=L0WUMZWW-24-HR4I&gdpr=0&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 0190a17a18f2299b1b85aeb1793e601c
Expires: 0

GET
H2

200

ImgSync
image8.pubmatic.com/AdServer/
Redirect Chain

https://prebid.a-mo.net/cchain?gdpr=0&gdpr_consent=&us_privacy=1---
https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F0%2F108%3FA%3Db8d8e51c-3ade-4912-8f74-1b9785868363%26bidder%3Dappnexus%26cbx%3D%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---...
https://prebid.a-mo.net/cchain/0/108?A=b8d8e51c-3ade-4912-8f74-1b9785868363&bidder=appnexus&cbx=&gdpr=0&gdpr_consent=&us_privacy=1---&uid=265726122044543864
https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=1&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fprebid.a-mo....

0
42 B

89ms
23ms

Image
text/plain

8.28.7.82
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=1&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fprebid.a-mo.net%252Fcchain%252F2%252F108%253FA%253Db8d8e51c-3ade-4912-8f74-1b9785868363%2526bidder%253Dpubmatic%2526cbx%253D%2526gdpr%253D0%2526gdpr_consent%253D%2526us_privacy%253D1---%2526uid%253D%2523PMUID
Protocol: H2
Server: 8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://efinancemanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:44 GMT
content-length: 0

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=1&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fprebid.a-mo.net%252Fcchain%252F2%252F108%253FA%253Db8d8e51c-3ade-4912-8f74-1b9785868363%2526bidder%253Dpubmatic%2526cbx%253D%2526gdpr%253D0%2526gdpr_consent%253D%2526us_privacy%253D1---%2526uid%253D%2523PMUID
date: Fri, 18 Mar 2022 20:03:45 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
content-length: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 287A
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=2474041087211680116&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

28ms
28ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=2474041087211680116&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=6&ph=eb072722-647b-4387-849c-a8e12a214991&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.2.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
via: 1.1 google
server: OXGW/17.2.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=2474041087211680116&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 287A
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=YjTloQAB1WfvyQA-
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YjTloQAB1WfvyQA-&_test=YjTloQAB1WfvyQA-

43 B
61 B

29ms
28ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537148856&val=YjTloQAB1WfvyQA-&_test=YjTloQAB1WfvyQA-
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=6&ph=eb072722-647b-4387-849c-a8e12a214991&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.2.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
via: 1.1 google
server: OXGW/17.2.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1647633825.190452,VS0,VE0
x-served-by: cache-yul12820-YUL
x-cache: HIT
location: https://us-u.openx.net/w/1.0/sd?id=537148856&val=YjTloQAB1WfvyQA-&_test=YjTloQAB1WfvyQA-
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 6a20cee3-6e39-ad5d-7c52-36ed5f7d040a
pr-bh.ybp.yahoo.com/sync/openx/ Frame 287A 43 B
991 B 81ms
28ms Image
image/gif 2600:1f18:4e9:5a02:46a:34b7:83ca:e02c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/6a20cee3-6e39-ad5d-7c52-36ed5f7d040a?gdpr=0

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=6&ph=eb072722-647b-4387-849c-a8e12a214991&gdpr=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:46a:34b7:83ca:e02c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 287A
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=fee7a8a7-fe95-3f14-4d85-2018a02ac943&gdpr=0
https://match.adsrvr.org/track/cmb/openx?oxid=fee7a8a7-fe95-3f14-4d85-2018a02ac943&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=cc85c5f5-27f2-438a-8840-da4eeded31cf&ttd_puid=fee7a8a7-fe95-3f14-4d85-2018a02ac943&gdpr=0&gdpr_consent=

43 B
62 B

42ms
41ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=cc85c5f5-27f2-438a-8840-da4eeded31cf&ttd_puid=fee7a8a7-fe95-3f14-4d85-2018a02ac943&gdpr=0&gdpr_consent=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=6&ph=eb072722-647b-4387-849c-a8e12a214991&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.2.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
via: 1.1 google
server: OXGW/17.2.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=cc85c5f5-27f2-438a-8840-da4eeded31cf&ttd_puid=fee7a8a7-fe95-3f14-4d85-2018a02ac943&gdpr=0&gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 335

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 287A 170 B
188 B 39ms
37ms Image
image/png 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZDI4ODdiNmQtMzdlMi02MWIwLTU4NjUtN2FhMTZhYzgwNzIz

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=6&ph=eb072722-647b-4387-849c-a8e12a214991&gdpr=0

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 287A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP7qu-1-_hNPsGtB-Xcx4rY&google_cver=1

43 B
61 B

27ms
27ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP7qu-1-_hNPsGtB-Xcx4rY&google_cver=1
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=6&ph=eb072722-647b-4387-849c-a8e12a214991&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.2.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
via: 1.1 google
server: OXGW/17.2.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP7qu-1-_hNPsGtB-Xcx4rY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 99FE
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=3658&xuid=cc85c5f5-27f2-438a-8840-da4eeded31cf&dongle=0cfd

37 B
354 B

26ms
25ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=cc85c5f5-27f2-438a-8840-da4eeded31cf&dongle=0cfd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://eb2.3lift.com/xuid?mid=3658&xuid=cc85c5f5-27f2-438a-8840-da4eeded31cf&dongle=0cfd
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 209

GET
H2

200

ebda
eb2.3lift.com/ Frame 99FE
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&cmp_cs=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjkzNzcwODc0MTc2MTM3MjQxMDQ2MQ%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

33ms
23ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 248
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 99FE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEBKQ5hL_mje_KLwOL_jPh5o&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
354 B

29ms
25ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEBKQ5hL_mje_KLwOL_jPh5o&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEBKQ5hL_mje_KLwOL_jPh5o&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 332
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 99FE
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjkzNzcwODc0MTc2MTM3MjQxMDQ2MQ%3D%3D

170 B
188 B

41ms
39ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjkzNzcwODc0MTc2MTM3MjQxMDQ2MQ%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjkzNzcwODc0MTc2MTM3MjQxMDQ2MQ%3D%3D
date: Fri, 18 Mar 2022 20:03:45 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

/
p.adsymptotic.com/d/px/ Frame 99FE
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=2937708741761372410461&dbredirect=true&gdpr=0&consent=
https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=2937708741761372410461&dbredirect=true&gdpr=0&consent=&cookiesTest=true
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=7f5a9b64-7565-487d-93f2-4a4083975246&_noobservation=1
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=7f5a9b64-7565-487d-93f2-4a4083975246&_noobservation=1&_expected_cookie=ad93136...

43 B
142 B

46ms
44ms

Image
image/gif

104.18.99.194
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=7f5a9b64-7565-487d-93f2-4a4083975246&_noobservation=1&_expected_cookie=ad9313636b58ee785f6dd888c914fb3f
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 104.18.99.194 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6ee092d178d75473-YYZ
p3p: CP='NON DSP COR CONi OUR BUS CNT'
content-type: image/gif
content-length: 43

Redirect headers

location: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=7f5a9b64-7565-487d-93f2-4a4083975246&_noobservation=1&_expected_cookie=ad9313636b58ee785f6dd888c914fb3f
date: Fri, 18 Mar 2022 20:03:45 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 6ee092d0e8055473-YYZ
content-length: 0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"

GET
H2

200

xuid
eb2.3lift.com/ Frame 99FE
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/2937708741761372410461?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-uxbtQCdE2oSsQqAwhw01X1buP25XV2z6HBOc5uRNpg--~A&dongle=0883

37 B
354 B

25ms
25ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-uxbtQCdE2oSsQqAwhw01X1buP25XV2z6HBOc5uRNpg--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Fri, 18 Mar 2022 20:03:45 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-uxbtQCdE2oSsQqAwhw01X1buP25XV2z6HBOc5uRNpg--~A&dongle=0883
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H2

200

xuid
eb2.3lift.com/ Frame 99FE
Redirect Chain

https://x.bidswitch.net/sync?ssp=triplelift&user_id=2937708741761372410461&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=triplelift&user_id=2937708741761372410461&gdpr=0&gdpr_consent=
https://m.fg8dgt.com/sync?ssp=bidswitch&bidswitch_ssp_id=triplelift&ssp_uuid=fd24b213-00f8-4941-8689-d6f04bba813c
https://m.fg8dgt.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=triplelift&ssp_uuid=fd24b213-00f8-4941-8689-d6f04bba813c
https://x.bidswitch.net/sync?dsp_id=108&expires=14&ssp=triplelift&user_id=eafaf387-34d3-49c4-b87d-52052aa37605
https://eb2.3lift.com/xuid?mid=2409&xuid=fd24b213-00f8-4941-8689-d6f04bba813c&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=

37 B
354 B

25ms
25ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2409&xuid=fd24b213-00f8-4941-8689-d6f04bba813c&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location: //eb2.3lift.com/xuid?mid=2409&xuid=fd24b213-00f8-4941-8689-d6f04bba813c&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Date: Fri, 18 Mar 2022 20:03:45 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2 200 c.gif
c.bing.com/ Frame 99FE 42 B
666 B 91ms
33ms Image
image/gif 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=2937708741761372410461&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
etag: "84ab6ebff3ad81:0"
last-modified: Fri, 18 Mar 2022 19:39:45 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6D59A3B25AFD4267B0D41092B15EBBE0 Ref B: YTO01EDGE0710 Ref C: 2022-03-18T20:03:45Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/ Frame 99FE
Redirect Chain

https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=0&gdpr_consent=&uid=2937708741761372410461
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=0&gdpr_consent=&uid=2937708741761372410461&dcc=t

0
0

47ms
47ms

Image
text/html

209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=0&gdpr_consent=&uid=2937708741761372410461&dcc=t
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: HTTP/1.1
Server: 209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:45 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 65DQ91THX7HF8BSE6JTY
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=0&gdpr_consent=&uid=2937708741761372410461&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 99FE
Redirect Chain

https://b1sync.zemanta.com/usersync/triplelift?gdpr=0&gdpr_consent=
https://stags.bluekai.com/site/23178?id=pO0qakLSKGz_pGLtBgDu&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLE...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLEMJQTQJTFPBRWQYLOM5ST25DSNFYGYZLMNFTHIJTHMRYHEPJQEZWWSZB5GI2DMMBGPB2WSZB5OBHTA4LBNNGFG...
https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=pO0qakLSKGz_pGLtBgDu

37 B
354 B

27ms
27ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=pO0qakLSKGz_pGLtBgDu
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:45 GMT
P3p: CP="We do not support P3P header."
Location: https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=pO0qakLSKGz_pGLtBgDu
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 115
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 9B51 0
744 B 28ms
26ms Script
text/html 68.67.161.207
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.161.207 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:45 GMT
X-Proxy-Origin: 149.56.153.180; 149.56.153.180; 802.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: d8cddf39-10d0-4c2a-9d7d-d2591510225e
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame BD00 3 KB
3 KB 19ms
19ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=53995553&p=156762&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 2b9b97384f510fc9051beff5dca30ce7716a768df12ea9a346a06c0d6c9f4abd

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 1 Show response
sync-eu.connectad.io/syncer/ Frame E10F 5 KB
1 KB 53ms
37ms Document
text/html 2606:4700:10::6816:36ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-eu.connectad.io/syncer/1
Requested by: Host: cdn.connectad.io
URL: https://cdn.connectad.io/connectmyusers.php?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 816f6806c0a60451a988e4d5863b27a1ce8459a54780c2bb529064da2dcd3207

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.connectad.io/

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
cache-control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
access-control-allow-origin: *
access-control-allow-credentials: true
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
via: 1.1 google
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6ee092cfef49715a-YUL
content-encoding: gzip

GET
H2 200 match Show response
c1.adform.net/serving/cookie/ Frame 0696 35 B
467 B 20ms
19ms Document
image/gif 185.167.164.39
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?party=14&cid=361C6204-C1B4-45D4-B103-3E8A05588532

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.39 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Fri, 18 Mar 2022 20:03:45 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 3EBD
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YjTloQAB1WfvyQA-&gdpr=0&gdpr_consent=

1 B
547 B

114ms
22ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YjTloQAB1WfvyQA-&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Fri, 18 Mar 2022 20:03:45 GMT
content-type: text/html; charset=utf-8
content-length: 1
x-lat: va1pug002:0:320
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

server: Varnish
retry-after: 0
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YjTloQAB1WfvyQA-&gdpr=0&gdpr_consent=
accept-ranges: bytes
date: Fri, 18 Mar 2022 20:03:45 GMT
via: 1.1 varnish
x-served-by: cache-yul12820-YUL
x-cache: HIT
x-cache-hits: 0
x-timer: S1647633825.281021,VS0,VE0
cache-control: no-cache
pragma: no-cache
content-length: 0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame F360
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:a0836234-e5a1-4800-80d3-c26d8024035f&gdpr=0&gdpr_consent=

42 B
340 B

25ms
24ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:a0836234-e5a1-4800-80d3-c26d8024035f&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Fri, 18 Mar 2022 20:03:45 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: va1pug003:0:1767
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

Date: Fri, 18 Mar 2022 20:03:45 GMT
Content-Type: image/gif
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=360
Access-Control-Allow-Origin: *
Server: MT3 4256 109297d master ord-pixel-x2 config:1.0.0
Cache-Control: no-cache
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:a0836234-e5a1-4800-80d3-c26d8024035f&gdpr=0&gdpr_consent=
Expires: Fri, 18 Mar 2022 20:03:44 GMT

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 50E2
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFBMzdrN0VhY3NBQURDODFrNWtNUQ&bee_sync_partners=sas%2Csyn%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&...
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Csyn%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAA37k7EacsAADC81k5kMQ&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dsyn%252Cpp%252Cpm%26bee_sy...
https://match.prod.bidr.io/cookie-sync?bee_sync_partners=syn%2Cpp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=8070208081641870233
https://sync.technoratimedia.com/services?srv=cs&pid=73&uid=AAA37k7EacsAADC81k5kMQ&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fuserid%3D8070208081641870233%26bee_sync_partners%3Dpp%252Cpm%2...
https://match.prod.bidr.io/cookie-sync?userid=8070208081641870233&bee_sync_partners=pp,pm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=3
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAA37k7EacsAADC81k5kMQ

42 B
215 B

20ms
19ms

Document
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAA37k7EacsAADC81k5kMQ
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Fri, 18 Mar 2022 20:03:45 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: njrpug003:0:590
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

Date: Fri, 18 Mar 2022 20:03:45 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAA37k7EacsAADC81k5kMQ
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
Content-Length: 0
Connection: keep-alive

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 1282
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=

42 B
204 B

36ms
23ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Fri, 18 Mar 2022 10:50:01 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: va2pug002:0:393
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

date: Fri, 18 Mar 2022 20:03:44 GMT
server: Kestrel
content-length: 0
cache-control: no-cache
pragma: no-cache
expires: Fri, 18 Mar 2022 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
x-errorlevel: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1165311
strict-transport-security: max-age=31536000; preload;

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame F62D 0
222 B 83ms
23ms Document
image/gif 169.197.150.8
DEEPINTENT

General

Check archive.org

Show headers Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.8 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: b /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
content-type: image/gif
content-length: 0
date: Fri, 18 Mar 2022 20:03:44 GMT
server: b

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame BD00
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=NhxiBMG0RdSxAz6KBViFMg%3D%3D
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

15 KB
15 KB

20ms
20ms

Image
text/html

23.54.68.197
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Protocol: H2
Server: 23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-197.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
content-encoding: gzip
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
server: Apache/2.2.15 (CentOS)
etag: "1300708-3de4-5d6ef246ef4cf"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=131549
accept-ranges: bytes
content-type: text/html; charset=UTF-8
content-length: 5549
expires: Sun, 20 Mar 2022 08:36:14 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 272
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

458249.gif
idsync.rlcdn.com/ Frame BD00
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=361C6204-C1B4-45D4-B103-3E8A05588532
https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJDM2MUM2MjA0LUMxQjQtNDVENC1CMTAzLTNFOEEwNTU4ODUzMhAAGg0IocvTkQYSBQjoBxAAQgBKAA
https://pippio.com/api/sync?pid=5324&it=1&iv=89f5957f1e9f7d0c97110078a429636567f674be66a841f64a80932ab0c0af4b791426b5417dce21&_=2
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA4OWY1OTU3ZjFlOWY3ZDBjOTcxMTAwNzhhNDI5NjM2NTY3ZjY3NGJlNjZhODQxZjY0YTgwOTMyYWIwYzBhZjRiNzkxNDI2YjU...
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA4OWY1OTU3ZjFlOWY3ZDBjOTcxMTAwNzhhNDI5NjM2NTY3ZjY3NGJlNjZhODQxZjY0YTgwOTMyYWIwYzBhZjRiNzkxNDI2YjU0MTdkY2UyMRAAGgwIocvTkQYSBAgCEABCAEoA&goog...
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
https://idsync.rlcdn.com/458249.gif?partner_uid=25336e16-4213-40b9-8433-e6effaf70987

42 B
60 B

42ms
41ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/458249.gif?partner_uid=25336e16-4213-40b9-8433-e6effaf70987
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:45 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/458249.gif?partner_uid=25336e16-4213-40b9-8433-e6effaf70987
date: Fri, 18 Mar 2022 20:03:45 GMT
via: 1.1 google
x-samesite: secure
alt-svc: clear
content-length: 111
content-type: text/html; charset=utf-8

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame BD00
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=b9f26234-e5a1-4700-8017-e147b9ecd394

0
48 B

59ms
21ms

Image
text/plain

104.36.115.114
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=b9f26234-e5a1-4700-8017-e147b9ecd394
Protocol: H2
Server: 104.36.115.114 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:44 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Fri, 18 Mar 2022 20:03:45 GMT
Server: MT3 4256 109297d master ord-pixel-x27 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=b9f26234-e5a1-4700-8017-e147b9ecd394
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 18 Mar 2022 20:03:44 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame BD00
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MzYxQzYyMDQtQzFCNC00NUQ0LUIxMDMtM0U4QTA1NTg4NTMy&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
188 B

77ms
20ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug018:0:389
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame BD00
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEFpxhXiL6yJDJOuUzAvzClg&google_cver=1

42 B
596 B

74ms
18ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEFpxhXiL6yJDJOuUzAvzClg&google_cver=1
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 14:49:33 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug030:0:361
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEFpxhXiL6yJDJOuUzAvzClg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame BD00
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:6D836FC997B54B02B6DC867D58AF78BA

42 B
383 B

56ms
20ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:6D836FC997B54B02B6DC867D58AF78BA
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 14:45:59 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug028:0:461
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date: Fri, 18 Mar 2022 20:03:45 GMT
x-content-type-options: nosniff
server: nginx
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:6D836FC997B54B02B6DC867D58AF78BA
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Thu, 17 Mar 2022 20:03:45 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame BD00
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2474041087211680116&gdpr=0&gdpr_consent=&us_privacy=

1 B
162 B

77ms
24ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2474041087211680116&gdpr=0&gdpr_consent=&us_privacy=
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
cache-control: no-store, no-cache, private
x-lat: 10:0:528
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2474041087211680116&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Fri, 18 Mar 2022 20:03:44 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame BD00
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=cc85c5f5-27f2-438a-8840-da4eeded31cf

42 B
293 B

83ms
24ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=cc85c5f5-27f2-438a-8840-da4eeded31cf
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
cache-control: no-store, no-cache, private
x-lat: va1pug001:0:503
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=cc85c5f5-27f2-438a-8840-da4eeded31cf
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 313

GET
H2 200 361C6204-C1B4-45D4-B103-3E8A05588532
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame BD00 43 B
990 B 39ms
23ms Image
image/gif 2600:1f18:4e9:5a02:46a:34b7:83ca:e02c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/361C6204-C1B4-45D4-B103-3E8A05588532?gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:46a:34b7:83ca:e02c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame BD00
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=361C6204-C1B4-45D4-B103-3E8A05588532&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-2f3UTmNE2uWTJcPhLNzlD6RahMnOerk-~A&gdpr=0&gdpr_consent=

0
260 B

116ms
20ms

Image
text/plain

104.36.115.114
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-2f3UTmNE2uWTJcPhLNzlD6RahMnOerk-~A&gdpr=0&gdpr_consent=
Protocol: H2
Server: 104.36.115.114 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:44 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-2f3UTmNE2uWTJcPhLNzlD6RahMnOerk-~A&gdpr=0&gdpr_consent=
date: Fri, 18 Mar 2022 20:03:45 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame BD00
Redirect Chain

https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=265726122044543864&gdpr=0&gdpr_consent=

42 B
390 B

88ms
19ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=265726122044543864&gdpr=0&gdpr_consent=
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 18:50:54 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug029:0:284
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:45 GMT
X-Proxy-Origin: 149.56.153.180; 149.56.153.180; 802.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 2bee0d97-07c0-4312-b233-e03bf9b53fa7
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=265726122044543864&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame BD00
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=361C6204-C1B4-45D4-B103-3E8A05588532&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=d3b4ad817de08ec&is_secure=true&networkId=17100&version=1&nuid=361C6204-C1B4-45D4-B103-3E8A05588532&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAADK9Fkp2XPHQN3jV_cAAAAAAA&expiration=1647720225&nuid=361C6204-C1B4-45D4-B103-3E8A05588532&...

42 B
361 B

23ms
23ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAADK9Fkp2XPHQN3jV_cAAAAAAA&expiration=1647720225&nuid=361C6204-C1B4-45D4-B103-3E8A05588532&is_secure=true&gdpr_consent=&gdpr=0
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 10:50:01 GMT
cache-control: no-store, no-cache, private
x-lat: va2pug002:0:464
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAADK9Fkp2XPHQN3jV_cAAAAAAA&expiration=1647720225&nuid=361C6204-C1B4-45D4-B103-3E8A05588532&is_secure=true&gdpr_consent=&gdpr=0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame BD00
Redirect Chain

https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=XaPE-g6klv9GpJH4CfPar1n1xf1Gocb2WKT--lvo

42 B
390 B

20ms
20ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=XaPE-g6klv9GpJH4CfPar1n1xf1Gocb2WKT--lvo
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug015:0:623
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=XaPE-g6klv9GpJH4CfPar1n1xf1Gocb2WKT--lvo
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 794F
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy=
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

281 B
554 B

68ms
18ms

Document
text/html

104.127.172.242
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=cHY8agyLqr67ujaKj0P0Le&gdpr_consent=undefined&us_privacy=undefined&gdpr=0&b=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-127-172-242.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: about:blank

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
ETag: "402b2-119-5d32342a551c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 18 Mar 2022 20:03:45 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

server: AkamaiGHost
content-length: 0
location: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
date: Fri, 18 Mar 2022 20:03:45 GMT
access-control-allow-credentials: true
access-control-allow-origin: *

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 8F22
Redirect Chain

https://x.bidswitch.net/sync?ssp=the33across&us_privacy=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch&ttd_tpi=1&ttd_puid=the33across&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=93&user_id=cc85c5f5-27f2-438a-8840-da4eeded31cf&expires=30&ssp=the33across&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_21}
https://ssc-cms.33across.com/ps/?gdpr_consent=&ri=10&ru=https%3A%2F%2Fcms-xch.33across.com%2Fmatch%3Fgdpr_58%3D%24gdpr_58%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26bidder_id%3...
https://cms-xch.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=fd24b213-00f8-4941-8689-d6f04bba813c
https://cms-xch-chicago.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=fd24b213-00f8-4941-8689-d6f04bba813c

68 B
127 B

28ms
28ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=fd24b213-00f8-4941-8689-d6f04bba813c
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=cHY8agyLqr67ujaKj0P0Le&gdpr_consent=undefined&us_privacy=undefined&gdpr=0&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=cHY8agyLqr67ujaKj0P0Le&gdpr_consent=undefined&us_privacy=undefined&gdpr=0&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

location: https://cms-xch-chicago.33across.com:443/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=fd24b213-00f8-4941-8689-d6f04bba813c
date: Fri, 18 Mar 2022 20:03:45 GMT
server: awselb/2.0
content-length: 134
content-type: text/html

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 8F22
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1647633825269.3&ri=1&ru=https%3A%2F%2Fsync.mathtag.com%2Fsync%2Fimg%3Fus_privacy%3D%24%7BUS_PRIVACY%7D%26mt_exid%3D73%26redir%3Dhttps%253A%252F%252Fc...
https://sync.mathtag.com/sync/img?us_privacy=&mt_exid=73&redir=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D1%26external_user_id%3D%5BMM_UUID%5D
https://cms-xch-chicago.33across.com/match?liv=g&us_privacy=&bidder_id=1&external_user_id=a0836234-e5a1-4800-80d3-c26d8024035f

68 B
127 B

148ms
118ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?liv=g&us_privacy=&bidder_id=1&external_user_id=a0836234-e5a1-4800-80d3-c26d8024035f
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=cHY8agyLqr67ujaKj0P0Le&gdpr_consent=undefined&us_privacy=undefined&gdpr=0&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=cHY8agyLqr67ujaKj0P0Le&gdpr_consent=undefined&us_privacy=undefined&gdpr=0&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

Date: Fri, 18 Mar 2022 20:03:45 GMT
Server: MT3 4256 109297d master ord-pixel-x52 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cms-xch-chicago.33across.com/match?liv=g&us_privacy=&bidder_id=1&external_user_id=a0836234-e5a1-4800-80d3-c26d8024035f
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 18 Mar 2022 20:03:44 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 8F22
Redirect Chain

https://ups.analytics.yahoo.com/ups/58350/sync?redir=true
https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-BhVg8PZE2uGjHV8Wdh_zxlbAhO_7N1.m~A
https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-BhVg8PZE2uGjHV8Wdh_zxlbAhO_7N1.m%7EA&ts=1647633825&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
127 B

197ms
166ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-BhVg8PZE2uGjHV8Wdh_zxlbAhO_7N1.m%7EA&ts=1647633825&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=cHY8agyLqr67ujaKj0P0Le&gdpr_consent=undefined&us_privacy=undefined&gdpr=0&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=cHY8agyLqr67ujaKj0P0Le&gdpr_consent=undefined&us_privacy=undefined&gdpr=0&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
referrer-policy: unsafe-url
server: 33XP002
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-BhVg8PZE2uGjHV8Wdh_zxlbAhO_7N1.m%7EA&ts=1647633825&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 8F22
Redirect Chain

https://33across-match.dotomi.com/match/bounce/current?networkId=78390&version=1&us_privacy=
https://33across-match.dotomi.com/match/bounce/current?DotomiTest=3c773451e8a08ee&is_secure=true&networkId=78390&version=1&us_privacy=
https://ssc-cms.33across.com/ps?xi=64&xu=AAADLCxXt6NFwgMu1cHdAAAAAAA&expiration=1647720225&is_secure=true&us_privacy=
https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAADLCxXt6NFwgMu1cHdAAAAAAA&ts=1647633825&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
127 B

28ms
28ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAADLCxXt6NFwgMu1cHdAAAAAAA&ts=1647633825&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=cHY8agyLqr67ujaKj0P0Le&gdpr_consent=undefined&us_privacy=undefined&gdpr=0&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=cHY8agyLqr67ujaKj0P0Le&gdpr_consent=undefined&us_privacy=undefined&gdpr=0&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
referrer-policy: unsafe-url
server: 33XP004
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAADLCxXt6NFwgMu1cHdAAAAAAA&ts=1647633825&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 8F22
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=f0v35ew&ttd_tpi=1&us_privacy=
https://ssc-cms.33across.com/ps/?ri=102&ru=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fbidder_id%3D102%26ttl%3D1650225825%26external_user_id%3Dcc85c5f5-27f2-438a-8840-da4eeded31cf
https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1650225825&external_user_id=cc85c5f5-27f2-438a-8840-da4eeded31cf

68 B
213 B

59ms
27ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1650225825&external_user_id=cc85c5f5-27f2-438a-8840-da4eeded31cf
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=cHY8agyLqr67ujaKj0P0Le&gdpr_consent=undefined&us_privacy=undefined&gdpr=0&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=cHY8agyLqr67ujaKj0P0Le&gdpr_consent=undefined&us_privacy=undefined&gdpr=0&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
referrer-policy: unsafe-url
server: 33XP005
x-33x-status: 40000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1650225825&external_user_id=cc85c5f5-27f2-438a-8840-da4eeded31cf
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame FED9 15 KB
6 KB 20ms
19ms Document
text/html 23.54.68.197
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156077&predirect=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata1%26uuid%3D
Requested by: Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-197.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://sync-eu.connectad.io/

Response headers

last-modified: Tue, 01 Feb 2022 06:38:00 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5549
content-type: text/html; charset=UTF-8
cache-control: max-age=131549
expires: Sun, 20 Mar 2022 08:36:14 GMT
date: Fri, 18 Mar 2022 20:03:45 GMT
vary: Accept-Encoding

GET
H3

204

1
sync-eu.connectad.io/pixel/ Frame D125
Redirect Chain

https://x.bidswitch.net/sync?ssp=rtaplus&user_id=ZzwpnToZAXL13J0rzhWqXQHUqXIwyGXJgizjAmdY&gdpr=0
https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=rtaplus
https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=rtaplus
https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=d9c0c200-b54c-475c-b1c5-17c072192a29&ssp=rtaplus
https://sync-eu.connectad.io/pixel/1?dataid=data3&uuid=fd24b213-00f8-4941-8689-d6f04bba813c

0
0

37ms
36ms

Document
text/plain

2606:4700:10::6816:36ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-eu.connectad.io/pixel/1?dataid=data3&uuid=fd24b213-00f8-4941-8689-d6f04bba813c
Requested by: Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://sync-eu.connectad.io/

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
cache-control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
via: 1.1 google
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6ee092d24fb97148-YUL

Redirect headers

Server: nginx
Date: Fri, 18 Mar 2022 20:03:45 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-cache, no-store, must-revalidate
Location: //sync-eu.connectad.io/pixel/1?dataid=data3&uuid=fd24b213-00f8-4941-8689-d6f04bba813c

GET
H3

204

1
sync.connectad.io/umatch/ Frame 4CCB
Redirect Chain

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Dadform%26dataid%3Ddata4%26uuid%3D%24UID
https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=170460670810645849

0
0

43ms
43ms

Document
text/plain

2606:4700:10::6816:36ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=170460670810645849
Requested by: Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://sync-eu.connectad.io/

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
cache-control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
via: 1.1 google
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6ee092d2b8477148-YUL

Redirect headers

server: nginx
date: Fri, 18 Mar 2022 20:03:45 GMT
content-type: text/plain
content-length: 0
location: https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=170460670810645849

GET
H2

204

1
sync.connectad.io/umatch/ Frame E21C
Redirect Chain

https://rtb.openx.net/sync/prebid?r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%24%7BUID%7D
https://sync.connectad.io/umatch/1?dataid=data5&uuid=c7392768-470a-0cfd-2609-e00d21710bce

0
0

55ms
44ms

Document
text/plain

2606:4700:10::6816:36ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.connectad.io/umatch/1?dataid=data5&uuid=c7392768-470a-0cfd-2609-e00d21710bce
Requested by: Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://sync-eu.connectad.io/

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
cache-control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
via: 1.1 google
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6ee092d0f916715a-YUL

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
content-length: 0
date: Fri, 18 Mar 2022 20:03:45 GMT
location: https://sync.connectad.io/umatch/1?dataid=data5&uuid=c7392768-470a-0cfd-2609-e00d21710bce
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
server: Cowboy
vary: Origin
x-request-id: alb9k08mvej5k95g9ip91enknp0ia4u9
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

204

1
sync.connectad.io/umatch/ Frame 46D2
Redirect Chain

https://creativecdn.com/cm-notify?pi=connectad
https://creativecdn.com/cm-notify?pi=connectad&tc=1
https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=0h4dj993aOwHQrZrkuws&pi=connectad&tc=1

0
0

62ms
61ms

Document
text/plain

2606:4700:10::6816:36ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=0h4dj993aOwHQrZrkuws&pi=connectad&tc=1
Requested by: Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://sync-eu.connectad.io/

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
cache-control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
via: 1.1 google
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6ee092d2f8987148-YUL

Redirect headers

date: Fri, 18 Mar 2022 20:03:45 GMT Fri, 18 Mar 2022 20:03:45 GMT
location: https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=0h4dj993aOwHQrZrkuws&pi=connectad&tc=1
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
content-length: 0

GET
H2

204

1
sync.connectad.io/umatch/ Frame EFA9
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Dappnexus%26dataid%3Ddata11%26uuid%3D%24UID
https://sync.connectad.io/umatch/1?bidder=appnexus&dataid=data11&uuid=265726122044543864

0
0

64ms
63ms

Document
text/plain

2606:4700:10::6816:36ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.connectad.io/umatch/1?bidder=appnexus&dataid=data11&uuid=265726122044543864
Requested by: Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://sync-eu.connectad.io/

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
cache-control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
via: 1.1 google
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6ee092d12951715a-YUL

Redirect headers

Server: nginx/1.21.3
Date: Fri, 18 Mar 2022 20:03:45 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Location: https://sync.connectad.io/umatch/1?bidder=appnexus&dataid=data11&uuid=265726122044543864
AN-X-Request-Uuid: 3e7949c8-f3b3-4c9b-b537-4829d79bf0b9
X-Proxy-Origin: 149.56.153.180; 149.56.153.180; 802.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

GET
H3

204

1
sync.connectad.io/umatch/ Frame 6D8D
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Dsovrn%26dataid%3Ddata12%26uuid%3D%24UID
https://ap.lijit.com/pixel?redir=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Dsovrn%26dataid%3Ddata12%26uuid%3D%24UID&sovrn_retry=true
https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=9540f535a226170d94e0b751

0
0

56ms
56ms

Document
text/plain

2606:4700:10::6816:36ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=9540f535a226170d94e0b751
Requested by: Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://sync-eu.connectad.io/

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
cache-control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
via: 1.1 google
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6ee092d19ebd7148-YUL

Redirect headers

Connection: close
Date: Fri, 18 Mar 2022 20:03:45 GMT
Location: https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=9540f535a226170d94e0b751
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type
X-Sovrn-Pod: ad_ap2dca1

GET
H/1.1 200
OK usermatch Show response
ssum.casalemedia.com/ Frame 37A6 2 KB
3 KB 110ms
39ms Document
text/html 23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Requested by: Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 2ecade6cbe09bea3038193907637d960bc3284c1a109d5fdda2d84e2fc8170da

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://sync-eu.connectad.io/

Response headers

Server: Apache
Content-Type: text/html
Dropped-Udsids: 39|230|241|73|17|57|88|130
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary: Is-Traffic-Usersync
Expires: Fri, 18 Mar 2022 20:03:45 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:45 GMT
Content-Length: 1547
Connection: keep-alive

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 163E 2 KB
814 B 40ms
10ms Document
text/html 51.222.39.186
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=5d4e109247a89f6

Requested by

Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.186 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ip186.ip-51-222-39.net

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://sync-eu.connectad.io/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 16CD 0
20 B 48ms
45ms Image
image/gif 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BetE4oOU0YtX3EYX5zgWCyJfACQAAAAA4AeAEAg&bg=!Q0ClQATNAAba2mK92to7ACkAdvg8WgOqUsLG5n7lgqasveFFAnyyc80M-JeJKvfxfNtN8PKx75NOKQIAAAENUgAAAAFoAQeZAzZBkLmTRZh85mZDXy7-cAj_00oTbR8G7J0QGYOQveN4Ql533bmEiG9KmsKgqlyGfNr_gnRjHUbBCnPN5X_e6QlsMyHyXPxkTmrbN3YWiOYI2kyFF7QE7agOo-0dXACg4tqJpiEdPy2p_1FTyQ4rfSW5fvaVJbHRynJKLr6R8Amz-gqyqg9BNxVcJ7dWqQp4bjfG-obkyC8OdiFPIue6l2vH4f70Tq2uXRXfzBPGji2Ch05_m1INj0ENXckQeWw81sbNpM8iuIC51ABvtwD2vjGmQcPHAxxKCoSK994DfTeneQyE2F9jCgM2eFGYvYpESOc4lajhOtqY0b6S_G2MjZz6Ug904PFR0sjmUXA1BaNXhG9s3agLXC-UcvnqpY5lEbGNGJl6E3Z9Vg5SrhMlsrKVEin19DW6taWSdMSqHd7FYAIOXapwD75iW_-oT531U5J3cjNAHgJA_ybbaIEt1LOvVZxAAz5vmqskps07KMBSyj07z9VQNTKKjuf1KcnXg0XDbzXnllb6RG1wS55hPMtTGoMpFtAhCauPHR8K-aElV4vsESOWoMA1a2eyyWUPdXab2DduJxzdknBnpn-eccbRDGyLOjyNiQx5MXCSx4VPxA_pC293EgEGvGERRvUaigUiuoEozi6c997nySq9W7wddApZREiNXNGg4FUEmiDXrmmcQFSfy4udnTq4eLirND2KWr3WI5_7WJuIo9OCOLHR8onssK7oDcOIGQw3qut53u4cviFkIC3Qg85GFVRnT2aYnGFr6272YDtUqBHXyf7CdHk6lrCF5EHKvcZesaprALpwP4THe-miRcUPDUeN4TDS5SxpySj_W_x5KRSIYR-FvF_SReSHGmPrXH94Wd5vyitvCXIdFjnbcsmSQASRDyTeSDWqtYbT61zey5Fimgmhk0zEKqRLk_6oxmXO-jlJ8Zi2gX1qDXYFt-Vyg0mEbmr9JxtwXddpp3cEKnDXKUtG-5oWxWh4w4_a1DouuAI6eMflsRSAv54EgbZoUtcKjbZBOLEd9_TmKK7cP3eyPTXkQQeJSg0kJXNQBaInCyYVmEOui5H9QlwjkSz-NJDuJNsklNrZsww

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 37A6
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=cc85c5f5-27f2-438a-8840-da4eeded31cf&expiration=1650225825&gdpr=0&gdpr_consent=

43 B
1 KB

36ms
34ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=cc85c5f5-27f2-438a-8840-da4eeded31cf&expiration=1650225825&gdpr=0&gdpr_consent=
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:45 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 18 Mar 2022 20:03:45 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=cc85c5f5-27f2-438a-8840-da4eeded31cf&expiration=1650225825&gdpr=0&gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 323

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame 37A6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YjTln7BTEjh5UmV6guFeIQAAAB4AAAAB&gdpr_consent=&us_privacy=&gdpr=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEFBKs0IZwojKHW1AMgnXSjQ&google_cver=1

43 B
315 B

84ms
26ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEFBKs0IZwojKHW1AMgnXSjQ&google_cver=1
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:45 GMT
Server: Apache
Vary: Is-Traffic-Usersync
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 43
Expires: Fri, 18 Mar 2022 20:03:45 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEFBKs0IZwojKHW1AMgnXSjQ&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 342
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 37A6 43 B
932 B 76ms
30ms Image
image/gif 209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=YjTln7BTEjh5UmV6guFeIQAAAB4AAAAB

Requested by

Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:45 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: JGFQX4ZCH7N3926BNS6N
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 YjTln7BTEjh5UmV6guFeIQAAAB4AAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 37A6 43 B
990 B 35ms
32ms Image
image/gif 2600:1f18:4e9:5a02:46a:34b7:83ca:e02c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/YjTln7BTEjh5UmV6guFeIQAAAB4AAAAB?gdpr_consent=&us_privacy=&gdpr=

Requested by

Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:46a:34b7:83ca:e02c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 37A6
Redirect Chain

https://b1sync.zemanta.com/usersync/index/?us_privacy=&gdpr=&gdpr_consent=
https://stags.bluekai.com/site/23178?id=pO0qakLSKGz_pGLtBgDu&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZDTOVWS243FMMXGGYLTMFWGK3LFMRUWCLTDN5WS6Y3S...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZDTOVWS243FMMXGGYLTMFWGK3LFMRUWCLTDN5WS6Y3SOVWT6Y3NL5SHG4C7NFSD2MJXEZSXQY3IMFXGOZJ5NFXGIZLYEZSXQ5DFOJXGC3C7OVZWK4S7NFSD24CPGBYWC...
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=pO0qakLSKGz_pGLtBgDu

43 B
1 KB

29ms
29ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=pO0qakLSKGz_pGLtBgDu
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:45 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 18 Mar 2022 20:03:45 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:45 GMT
P3p: CP="We do not support P3P header."
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=pO0qakLSKGz_pGLtBgDu
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 115
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 37A6
Redirect Chain

https://p.rfihub.com/cm?in=1&pub=2079
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=978758877515360359

43 B
1 KB

27ms
26ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=978758877515360359
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:45 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 18 Mar 2022 20:03:45 GMT

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=978758877515360359
Date: Fri, 18 Mar 2022 20:03:45 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 37A6
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YjTloQAB1WfvyQA-

43 B
1 KB

27ms
27ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YjTloQAB1WfvyQA-
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:45 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 18 Mar 2022 20:03:45 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1647633826.508203,VS0,VE0
x-served-by: cache-yul12820-YUL
x-cache: HIT
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YjTloQAB1WfvyQA-
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 37A6
Redirect Chain

https://match.prod.bidr.io/cookie-sync/ie
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAA37k7EacsAADC81k5kMQ&expiration=1648843425

43 B
1 KB

28ms
27ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAA37k7EacsAADC81k5kMQ&expiration=1648843425
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 20:03:45 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 18 Mar 2022 20:03:45 GMT

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAA37k7EacsAADC81k5kMQ&expiration=1648843425
Date: Fri, 18 Mar 2022 20:03:45 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=2592000; includeSubDomains

GET
H3 204 1
sync.connectad.io/umatch/ Frame 37A6 0
786 B 75ms
57ms Image
text/plain 2606:4700:10::6816:36ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.connectad.io/umatch/1?bidder=idx&dataid=data13&uuid=YjTln7BTEjh5UmV6guFeIQAA%26030
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cache-control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-ray: 6ee092d18ebb7148-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 794F 32 KB
10 KB 18ms
18ms Script
text/html 104.127.172.242
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-127-172-242.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: ff6231c5c90125a37a34594af0e60eb5e0859fb1ce97e66d3c052ceee84468a6

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 20:03:45 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Mar 2022 16:28:01 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=60852
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9539
Expires: Sat, 19 Mar 2022 12:57:57 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 794F
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy=&gdpr_consent=undefined&gdpr=0&khaos=L0WUMZWW-24-HR4I
https://ssc-cms.33across.com/ps/?xi=1&xu=L0WUMZWW-24-HR4I&gdpr=0&gdpr_consent=undefined
https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=L0WUMZWW-24-HR4I&ts=1647633825&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
127 B

189ms
189ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=L0WUMZWW-24-HR4I&ts=1647633825&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
referrer-policy: unsafe-url
server: 33XP005
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=L0WUMZWW-24-HR4I&ts=1647633825&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 794F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&gdpr=0
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESENIbTlB2__LvpUNu7X9rNYA&google_cver=1

42 B
807 B

45ms
24ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESENIbTlB2__LvpUNu7X9rNYA&google_cver=1
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: f69a50991384d09413b97a37bb74928b
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESENIbTlB2__LvpUNu7X9rNYA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 337
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

204

v1
ads.yahoo.com/cms/ Frame 794F
Redirect Chain

https://token.rubiconproject.com/token?pid=26594&gdpr=0
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L0WUMZWW-24-HR4I&sigv=1&esig=2~0e56b86a377a5ceb4ed01cfa494fbcd171039a1e&gdpr=0

0
194 B

100ms
30ms

Image
text/plain

2001:4998:14:800::1000
YAHOO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L0WUMZWW-24-HR4I&sigv=1&esig=2~0e56b86a377a5ceb4ed01cfa494fbcd171039a1e&gdpr=0

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

Protocol

Server

2001:4998:14:800::1000 , United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L0WUMZWW-24-HR4I&sigv=1&esig=2~0e56b86a377a5ceb4ed01cfa494fbcd171039a1e&gdpr=0
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 83041abbe8494cb29eff3083edd6dff6
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 794F
Redirect Chain

https://token.rubiconproject.com/token?pid=36584&gdpr=0
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L0WUMZWW-24-HR4I&gdpr=0

0
143 B

52ms
51ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L0WUMZWW-24-HR4I&gdpr=0
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 20:03:45 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 075ED9E9C2664C6FB1601B87755F6452 Ref B: YTO01EDGE0717 Ref C: 2022-03-18T20:03:45Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXag6TnoQZMEI3XHyHbdw==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L0WUMZWW-24-HR4I&gdpr=0
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 29af2665c43893332e84c235bac366c1
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 794F
Redirect Chain

https://token.rubiconproject.com/token?pid=25470&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBXVU1aV1ctMjQtSFI0SQ==&gdpr=0

170 B
188 B

37ms
36ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBXVU1aV1ctMjQtSFI0SQ==&gdpr=0

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBXVU1aV1ctMjQtSFI0SQ==&gdpr=0
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 19c1ac3b9706c83a73951eba4d239689
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 794F
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=cc85c5f5-27f2-438a-8840-da4eeded31cf&gdpr=0&gdpr_consent=&expires=30

42 B
807 B

25ms
25ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=cc85c5f5-27f2-438a-8840-da4eeded31cf&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: c3b5432477546c086cd062707f625a76
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 20:03:45 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=cc85c5f5-27f2-438a-8840-da4eeded31cf&gdpr=0&gdpr_consent=&expires=30
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 289

GET
H2 200 709414.gif
id.rlcdn.com/ Frame 794F 42 B
317 B 54ms
42ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/709414.gif?gdpr=0
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 20:03:45 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 794F
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NjlmNmUxNzY5OWQ5OTU4NTI4MzdkOTczNjUxODRiZjQ2ZWYzYTdiZQ&gdpr=0

170 B
188 B

36ms
36ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NjlmNmUxNzY5OWQ5OTU4NTI4MzdkOTczNjUxODRiZjQ2ZWYzYTdiZQ&gdpr=0

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS