pastelink.net Open in urlscan Pro
178.79.155.87 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://pastelink.net/wwr50xs3
Submission: On October 15 via manual (October 15th 2022, 9:03:51 pm UTC) from HN — Scanned from AU

Summary HTTP 282 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 47 IPs in 8 countries across 39 domains to perform 282 HTTP transactions. The main IP is 178.79.155.87, located in London, United Kingdom and belongs to LINODE-AP Linode, LLC, US. The main domain is pastelink.net. The Cisco Umbrella rank of the primary domain is 338756.
TLS certificate: Issued by R3 on September 21st 2022. Valid for: 3 months.

This is the only time pastelink.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
12	178.79.155.87 178.79.155.87	63949 (LINODE-AP...) (LINODE-AP Linode)
6	74.125.24.95 74.125.24.95	15169 (GOOGLE) (GOOGLE)
1	69.16.175.42 69.16.175.42	20446 (STACKPATH...) (STACKPATH-CDN)
1	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	104.21.93.14 104.21.93.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 9	142.251.10.105 142.251.10.105	15169 (GOOGLE) (GOOGLE)
2	142.251.10.97 142.251.10.97	15169 (GOOGLE) (GOOGLE)
8	74.125.24.94 74.125.24.94	15169 (GOOGLE) (GOOGLE)
7	142.251.12.94 142.251.12.94	15169 (GOOGLE) (GOOGLE)
16 78	142.251.12.157 142.251.12.157	15169 (GOOGLE) (GOOGLE)
3	13.33.79.24 13.33.79.24	16509 (AMAZON-02) (AMAZON-02)
5	142.251.12.100 142.251.12.100	15169 (GOOGLE) (GOOGLE)
1	13.35.17.5 13.35.17.5	16509 (AMAZON-02) (AMAZON-02)
2	142.251.12.154 142.251.12.154	15169 (GOOGLE) (GOOGLE)
1	74.125.68.154 74.125.68.154	15169 (GOOGLE) (GOOGLE)
9	172.217.194.132 172.217.194.132	15169 (GOOGLE) (GOOGLE)
1	54.192.150.68 54.192.150.68	16509 (AMAZON-02) (AMAZON-02)
1	172.67.38.106 172.67.38.106	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	141.95.98.68 141.95.98.68	16276 (OVH) (OVH)
1	141.95.98.71 141.95.98.71	16276 (OVH) (OVH)
2 13	52.46.130.91 52.46.130.91	16509 (AMAZON-02) (AMAZON-02)
48	74.125.68.132 74.125.68.132	15169 (GOOGLE) (GOOGLE)
1	13.251.228.157 13.251.228.157	16509 (AMAZON-02) (AMAZON-02)
10	172.217.194.157 172.217.194.157	15169 (GOOGLE) (GOOGLE)
4	23.36.254.7 23.36.254.7	16625 (AKAMAI-AS) (AKAMAI-AS)
1	162.19.138.82 162.19.138.82	16276 (OVH) (OVH)
13	74.125.24.148 74.125.24.148	15169 (GOOGLE) (GOOGLE)
2	172.253.118.138 172.253.118.138	15169 (GOOGLE) (GOOGLE)
12 20	139.5.84.243 139.5.84.243	27381 (CASALE-MEDIA) (CASALE-MEDIA)
12 16	104.254.150.241 104.254.150.241	29990 (ASN-APPNEX) (ASN-APPNEX)
8	142.251.10.157 142.251.10.157	15169 (GOOGLE) (GOOGLE)
4	74.125.20.94 74.125.20.94	15169 (GOOGLE) (GOOGLE)
2	74.125.109.199 74.125.109.199	15169 (GOOGLE) (GOOGLE)
1 1	13.33.88.84 13.33.88.84	16509 (AMAZON-02) (AMAZON-02)
2 2	35.213.12.39 35.213.12.39	15169 (GOOGLE) (GOOGLE)
1 1	23.36.48.24 23.36.48.24	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	70.42.32.159 70.42.32.159	13789 (INTERNAP-...) (INTERNAP-BLK3)
1 1	104.65.229.32 104.65.229.32	16625 (AKAMAI-AS) (AKAMAI-AS)
4 9	52.220.251.156 52.220.251.156	16509 (AMAZON-02) (AMAZON-02)
2	104.65.228.208 104.65.228.208	16625 (AKAMAI-AS) (AKAMAI-AS)
2	23.9.185.218 23.9.185.218	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	199.187.193.202 199.187.193.202	47043 (SMARTADSE...) (SMARTADSERVER)
2	34.149.43.113 34.149.43.113	15169 (GOOGLE) (GOOGLE)
10 10	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
5 9	69.173.158.64 69.173.158.64	26667 (RUBICONPR...) (RUBICONPROJECT)
1	103.231.98.196 103.231.98.196	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	8.43.72.97 8.43.72.97	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	185.84.60.21 185.84.60.21	198622 (ADFORM) (ADFORM)
2 2	103.229.205.243 103.229.205.243	30419 (MEDIAMATH...) (MEDIAMATH-INC)
5	103.231.98.194 103.231.98.194	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2	103.231.98.195 103.231.98.195	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	34.83.125.63 34.83.125.63	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	3.0.69.23 3.0.69.23	16509 (AMAZON-02) (AMAZON-02)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	52.94.220.185 52.94.220.185	() ()
1	142.251.10.149 142.251.10.149	15169 (GOOGLE) (GOOGLE)
282	47

12 178.79.155.87 (London, United Kingdom)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li274-87.members.linode.com

pastelink.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 74.125.24.95 (United States)

ASN15169 (GOOGLE, US)
PTR: sf-in-f95.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.16.175.42 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: tlb.hwcdn.net

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.24.14 (Shahr, Iran, Islamic Republic Of)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.21.93.14 (Shahr, Iran, Islamic Republic Of)

ASN13335 (CLOUDFLARENET, US)

cdn.adligature.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 142.251.10.105 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: sd-in-f105.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.10.97 (United States)

ASN15169 (GOOGLE, US)
PTR: sd-in-f97.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 74.125.24.94 (United States)

ASN15169 (GOOGLE, US)
PTR: sf-in-f94.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.251.12.94 (United States)

ASN15169 (GOOGLE, US)
PTR: se-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

78 142.251.12.157 (United States) 16 redirects

ASN15169 (GOOGLE, US)
PTR: se-in-f157.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.33.79.24 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-79-24.sin2.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.251.12.100 (United States)

ASN15169 (GOOGLE, US)
PTR: se-in-f100.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.17.5 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-17-5.sin5.r.cloudfront.net

aax-dtb-cf.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.12.154 (United States)

ASN15169 (GOOGLE, US)
PTR: se-in-f154.1e100.net

adservice.google.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.125.68.154 (United States)

ASN15169 (GOOGLE, US)
PTR: sc-in-f154.1e100.net

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 172.217.194.132 (United States)

ASN15169 (GOOGLE, US)
PTR: si-in-f132.1e100.net

2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.192.150.68 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-192-150-68.sin2.r.cloudfront.net

tags.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.38.106 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.95.98.68 (France)

ASN16276 (OVH, FR)
PTR: ns3216657.ip-141-95-98.eu

lb.eu-1-id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.95.98.71 (France)

ASN16276 (OVH, FR)
PTR: ns3216577.ip-141-95-98.eu

lbs.eu-1-id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 52.46.130.91 (Ashburn, United States) 2 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

48 74.125.68.132 (United States)

ASN15169 (GOOGLE, US)
PTR: sc-in-f132.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.251.228.157 (Singapore, Singapore)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-251-228-157.ap-southeast-1.compute.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 172.217.194.157 (United States)

ASN15169 (GOOGLE, US)
PTR: si-in-f157.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.36.254.7 (Singapore, Singapore)

ASN16625 (AKAMAI-AS, US)
PTR: a23-36-254-7.deploy.static.akamaitechnologies.com

cdn.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.19.138.82 (France)

ASN16276 (OVH, FR)
PTR: ns31532337.ip-162-19-138.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 74.125.24.148 (United States)

ASN15169 (GOOGLE, US)
PTR: sf-in-f148.1e100.net

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.253.118.138 (United States)

ASN15169 (GOOGLE, US)
PTR: sl-in-f138.1e100.net

mts0.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 139.5.84.243 (Canada) 12 redirects

ASN27381 (CASALE-MEDIA, CA)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 104.254.150.241 (Los Angeles, United States) 12 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.251.10.157 (United States)

ASN15169 (GOOGLE, US)
PTR: sd-in-f157.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 74.125.20.94 (United States)

ASN15169 (GOOGLE, US)
PTR: pi-in-f94.1e100.net

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 74.125.109.199 (United States)

ASN15169 (GOOGLE, US)
PTR: mel05s04-in-f7.1e100.net

rr2---sn-hxa76n7z.googlevideo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.88.84 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-33-88-84.sin2.r.cloudfront.net

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.213.12.39 (Tokyo, Japan) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 39.12.213.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.36.48.24 (Singapore, Singapore) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-36-48-24.deploy.static.akamaitechnologies.com

cs.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 70.42.32.159 (United States) 2 redirects

ASN13789 (INTERNAP-BLK3, US)
PTR: ny.outbrain.com

b1sync.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.65.229.32 (Singapore, Singapore) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-65-229-32.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 52.220.251.156 (Singapore, Singapore) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-220-251-156.ap-southeast-1.compute.amazonaws.com

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.65.228.208 (Singapore, Singapore)

ASN16625 (AKAMAI-AS, US)
PTR: a104-65-228-208.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.9.185.218 (Singapore, Singapore)

ASN16625 (AKAMAI-AS, US)
PTR: a23-9-185-218.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.187.193.202 (Canada) 1 redirects

ASN47043 (SMARTADSERVER, CA)

ssbsync-us.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.149.43.113 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 113.43.149.34.bc.googleusercontent.com

rtb0.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tps.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 3.33.220.150 (United States) 10 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 69.173.158.64 (Singapore, Singapore) 5 redirects

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 103.231.98.196 (Japan)

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.43.72.97 (United States) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel-us-east.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.84.60.21 (Denmark) 1 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 103.229.205.243 (Singapore) 2 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 103.231.98.194 (Japan)

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 103.231.98.195 (Japan)

ASN62713 (AS-PUBMATIC, US)

image4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
simage4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.83.125.63 (The Dalles, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 63.125.83.34.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.0.69.23 (Singapore, Singapore) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-0-69-23.ap-southeast-1.compute.amazonaws.com

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.94.220.185 (None, )

ASN- ()

aax-eu.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.10.149 (United States)

ASN15169 (GOOGLE, US)
PTR: sd-in-f149.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
95	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 104 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 147	1 MB
49	doubleclick.net 16 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 188 googleads.g.doubleclick.net — Cisco Umbrella Rank: 43 cm.g.doubleclick.net — Cisco Umbrella Rank: 215 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 317 ad.doubleclick.net — Cisco Umbrella Rank: 185	408 KB
20	casalemedia.com 12 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 542	16 KB
19	gstatic.com www.gstatic.com fonts.gstatic.com csi.gstatic.com	428 KB
18	amazon-adsystem.com 2 redirects c.amazon-adsystem.com — Cisco Umbrella Rank: 313 aax-dtb-cf.amazon-adsystem.com — Cisco Umbrella Rank: 534 s.amazon-adsystem.com — Cisco Umbrella Rank: 296 aax-eu.amazon-adsystem.com	59 KB
16	adnxs.com 12 redirects ib.adnxs.com — Cisco Umbrella Rank: 232	15 KB
13	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 273	560 KB
12	rubiconproject.com 6 redirects eus.rubiconproject.com — Cisco Umbrella Rank: 596 token.rubiconproject.com — Cisco Umbrella Rank: 682 pixel-us-east.rubiconproject.com — Cisco Umbrella Rank: 852 pixel.rubiconproject.com — Cisco Umbrella Rank: 347	17 KB
12	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 2 adservice.google.com — Cisco Umbrella Rank: 78 mts0.google.com — Cisco Umbrella Rank: 4659	82 KB
12	pastelink.net pastelink.net — Cisco Umbrella Rank: 338756	220 KB
11	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 193	452 KB
10	adsrvr.org 10 redirects match.adsrvr.org — Cisco Umbrella Rank: 356	5 KB
10	pubmatic.com ads.pubmatic.com — Cisco Umbrella Rank: 495 image6.pubmatic.com — Cisco Umbrella Rank: 671 simage2.pubmatic.com — Cisco Umbrella Rank: 706 image4.pubmatic.com — Cisco Umbrella Rank: 875 image2.pubmatic.com — Cisco Umbrella Rank: 894 simage4.pubmatic.com	26 KB
9	sharethrough.com 4 redirects match.sharethrough.com — Cisco Umbrella Rank: 554	3 KB
6	doubleverify.com cdn.doubleverify.com — Cisco Umbrella Rank: 482 rtb0.doubleverify.com — Cisco Umbrella Rank: 703 tps.doubleverify.com	131 KB
6	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 44	5 KB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 32	20 KB
4	adligature.com cdn.adligature.com — Cisco Umbrella Rank: 71213	185 KB
2	yahoo.com 1 redirects pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 426	1 KB
2	mathtag.com 2 redirects sync.mathtag.com — Cisco Umbrella Rank: 462	1 KB
2	adform.net 1 redirects c1.adform.net — Cisco Umbrella Rank: 627	950 B
2	zemanta.com 2 redirects b1sync.zemanta.com — Cisco Umbrella Rank: 560	1 KB
2	bidswitch.net 2 redirects x.bidswitch.net — Cisco Umbrella Rank: 303	1 KB
2	googlevideo.com rr2---sn-hxa76n7z.googlevideo.com	2 MB
2	eu-1-id5-sync.com lb.eu-1-id5-sync.com — Cisco Umbrella Rank: 1358 lbs.eu-1-id5-sync.com — Cisco Umbrella Rank: 1440	535 B
2	id5-sync.com cdn.id5-sync.com — Cisco Umbrella Rank: 1193 id5-sync.com — Cisco Umbrella Rank: 471	17 KB
2	crwdcntrl.net tags.crwdcntrl.net — Cisco Umbrella Rank: 1160 bcp.crwdcntrl.net — Cisco Umbrella Rank: 818	10 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 61	137 KB
1	linkedin.com px.ads.linkedin.com — Cisco Umbrella Rank: 375	573 B
1	simpli.fi 1 redirects um.simpli.fi — Cisco Umbrella Rank: 841	657 B
1	smartadserver.com 1 redirects ssbsync-us.smartadserver.com — Cisco Umbrella Rank: 5641	329 B
1	bluekai.com 1 redirects stags.bluekai.com — Cisco Umbrella Rank: 504	720 B
1	media.net 1 redirects cs.media.net — Cisco Umbrella Rank: 1392	665 B
1	smaato.net 1 redirects s.ad.smaato.net — Cisco Umbrella Rank: 717	531 B
1	google.com.au adservice.google.com.au — Cisco Umbrella Rank: 109731	792 B
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 216	1 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 677	30 KB
0	rlcdn.com Failed idsync.rlcdn.com — Cisco Umbrella Rank: 344 Failed
0	ip-api.com Failed pro.ip-api.com Failed
282	39

	Domain	Requested by
48	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com pastelink.net googleads.g.doubleclick.net www.gstatic.com ad.doubleclick.net pagead2.googlesyndication.com
38	pagead2.googlesyndication.com	securepubads.g.doubleclick.net 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com pastelink.net tpc.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com ad.doubleclick.net pagead2.googlesyndication.com
22	cm.g.doubleclick.net	16 redirects googleads.g.doubleclick.net eus.rubiconproject.com
20	dsum-sec.casalemedia.com	12 redirects googleads.g.doubleclick.net
16	ib.adnxs.com	12 redirects googleads.g.doubleclick.net
13	s0.2mdn.net	tpc.googlesyndication.com googleads.g.doubleclick.net pastelink.net s0.2mdn.net 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com ad.doubleclick.net
13	s.amazon-adsystem.com	2 redirects c.amazon-adsystem.com s.amazon-adsystem.com match.sharethrough.com eus.rubiconproject.com ads.pubmatic.com
12	pastelink.net	pastelink.net
11	www.googletagservices.com	2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com pastelink.net cdn.doubleverify.com www.googletagservices.com ad.doubleclick.net
10	match.adsrvr.org	10 redirects
10	googleads.g.doubleclick.net	2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com pastelink.net
9	match.sharethrough.com	4 redirects s.amazon-adsystem.com match.sharethrough.com
9	2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
9	www.google.com	1 redirects pastelink.net tpc.googlesyndication.com 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
8	googleads4.g.doubleclick.net	googleads.g.doubleclick.net pastelink.net ad.doubleclick.net
8	securepubads.g.doubleclick.net	cdn.adligature.com securepubads.g.doubleclick.net pastelink.net 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
8	www.gstatic.com	www.google.com 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
7	fonts.gstatic.com	fonts.googleapis.com
6	fonts.googleapis.com	pastelink.net 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com s0.2mdn.net
5	token.rubiconproject.com	4 redirects eus.rubiconproject.com
5	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
4	pixel.rubiconproject.com	1 redirects eus.rubiconproject.com
4	csi.gstatic.com	www.gstatic.com
4	cdn.doubleverify.com	2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com cdn.doubleverify.com pastelink.net
4	cdn.adligature.com	pastelink.net cdn.adligature.com
3	image2.pubmatic.com	ads.pubmatic.com
3	c.amazon-adsystem.com	cdn.adligature.com c.amazon-adsystem.com
2	pr-bh.ybp.yahoo.com	1 redirects ads.pubmatic.com
2	simage2.pubmatic.com	ads.pubmatic.com
2	sync.mathtag.com	2 redirects
2	c1.adform.net	1 redirects ads.pubmatic.com
2	eus.rubiconproject.com	s.amazon-adsystem.com eus.rubiconproject.com
2	ads.pubmatic.com	s.amazon-adsystem.com ads.pubmatic.com
2	b1sync.zemanta.com	2 redirects
2	x.bidswitch.net	2 redirects
2	rr2---sn-hxa76n7z.googlevideo.com	2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
2	mts0.google.com	2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
2	www.googletagmanager.com	pastelink.net www.googletagmanager.com
1	simage4.pubmatic.com	ads.pubmatic.com
1	tps.doubleverify.com	cdn.doubleverify.com
1	ad.doubleclick.net	www.googletagservices.com
1	aax-eu.amazon-adsystem.com	eus.rubiconproject.com
1	px.ads.linkedin.com	eus.rubiconproject.com
1	um.simpli.fi	1 redirects
1	image4.pubmatic.com	ads.pubmatic.com
1	pixel-us-east.rubiconproject.com	1 redirects
1	image6.pubmatic.com	ads.pubmatic.com
1	rtb0.doubleverify.com	cdn.doubleverify.com
1	ssbsync-us.smartadserver.com	1 redirects
1	stags.bluekai.com	1 redirects
1	cs.media.net	1 redirects
1	s.ad.smaato.net	1 redirects
1	id5-sync.com	cdn.id5-sync.com
1	bcp.crwdcntrl.net	tags.crwdcntrl.net
1	lbs.eu-1-id5-sync.com	cdn.id5-sync.com
1	lb.eu-1-id5-sync.com	cdn.id5-sync.com
1	cdn.id5-sync.com	pastelink.net
1	tags.crwdcntrl.net	pastelink.net
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.com.au	securepubads.g.doubleclick.net
1	aax-dtb-cf.amazon-adsystem.com	c.amazon-adsystem.com
1	cdnjs.cloudflare.com	pastelink.net
1	code.jquery.com	pastelink.net
0	idsync.rlcdn.com Failed	ads.pubmatic.com
0	pro.ip-api.com Failed	cdn.adligature.com
282	65

This site contains links to these domains. Also see Links.

Domain
spo337.com
www.facebook.com
twitter.com
t.me
api.whatsapp.com
www.reddit.com
www.pinterest.com
www.tumblr.com
www.blogger.com
profitquery.com
www.linkedin.com
share.flipboard.com
social-plugins.line.me
www.meneame.net
diasp.org

Subject Issuer	Validity	Valid
pastelink.net R3	`2022-09-21` - `2022-12-20`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2022-05-09` - `2023-04-18`	a year	crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com Amazon	`2022-06-15` - `2023-06-15`	a year	crt.sh
*.google.com.au GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.crwdcntrl.net Go Daddy Secure Certificate Authority - G2	`2022-05-01` - `2023-06-02`	a year	crt.sh
*.eu-1-id5-sync.com R3	`2022-08-18` - `2022-11-16`	3 months	crt.sh
s.amazon-adsystem.com Amazon	`2022-05-09` - `2023-04-21`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.doubleverify.com DigiCert SHA2 Secure Server CA	`2021-12-23` - `2022-12-23`	a year	crt.sh
*.id5-sync.com R3	`2022-08-18` - `2022-11-16`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.c.docs.google.com GTS CA 1C3	`2022-09-27` - `2022-12-06`	2 months	crt.sh
*.sharethrough.com Amazon	`2021-11-25` - `2022-12-22`	a year	crt.sh
*.pubmatic.com DigiCert SHA2 Secure Server CA	`2022-02-04` - `2023-02-03`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-17` - `2023-04-04`	a year	crt.sh
track.adform.net DigiCert TLS RSA SHA256 2020 CA1	`2022-09-20` - `2023-09-20`	a year	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-06-14` - `2022-12-07`	6 months	crt.sh
aax-eu.amazon-adsystem.com Amazon	`2022-07-20` - `2023-07-19`	a year	crt.sh
*.tps.doubleverify.com Go Daddy Secure Certificate Authority - G2	`2022-09-28` - `2023-10-30`	a year	crt.sh

This page contains 40 frames:

Primary Page: https://pastelink.net/wwr50xs3
Frame ID: 1CD035B56313356816E425A592620E1D
Requests: 55 HTTP requests in this frame

Frame: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 7D5E8DE390906D5A86343668F4587204
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_n-MediaNet_smrt_n-Outbrain&dcc=t
Frame ID: 4A59146BB1D6837715023E8512C99F82
Requests: 1 HTTP requests in this frame

Frame: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: E3C7AE2785EC64EA518E65130F6F7120
Requests: 14 HTTP requests in this frame

Frame: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: AED6603D5F4931AFC7413B3D64CF0642
Requests: 15 HTTP requests in this frame

Frame: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: AED3AEFFBB75134E27D3BD2A74339EBD
Requests: 15 HTTP requests in this frame

Frame: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 467BD8FAA46D1D92FE01F489A81FD4A1
Requests: 1 HTTP requests in this frame

Frame: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 6DD66FFDBF362FB2FDEB7F5A9C64CA8A
Requests: 23 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 4CC7487AA50D94871B24B207D1664EF5
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: D22D5FFD7B6873E5F9D088342F345B2F
Requests: 2 HTTP requests in this frame

Frame: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 6A2DC10FDBF5C513E14157A9022D1C45
Requests: 8 HTTP requests in this frame

Frame: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 4A1D8DB81F691AF196DB9D30D842E4CF
Requests: 21 HTTP requests in this frame

Frame: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 2FC151AD377DA0C41A20E2A9C5F4DDDF
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKv65gIQstDN9AEYu7zx0wEwAQ&v=APEucNWJGWPc9ZM-p-_d6zZmcbWFQR-x3klw175_bjBut7QXNIDbQbNOzVjDHPkeIinr1sUqXpsyuDMTpiZRILnGODpcjDNq-A
Frame ID: C949190C2C7BBDD729E3237CDB6039F2
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNj9GhDb1sYBGJGqvNQBMAE&v=APEucNVb3ccp42Ta0kUA1sgY11L9DN97BWjSNj-YZgL8Qi_aDZ1glVCY1q0C1M456V63h-kURg1CwvUuoliVWyO1t6ZEGt6pxg
Frame ID: C0FEB53E6A74A49348645A3128257342
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BJkFGeXIRf2PDmBJQuJ172CP5gJ6xBTpMV-mJlZIjkdx2PVac__TVbXGZl2b3-gomo1DQezOJwvrF_DVJQqIK3gVuLBA&cry=1&dbm_d=AKAmf-DQEd3cxsAwCswDa7MtjdaPyWb2XcYlNFpWsBV3gV0bHaVQmxdBvP6seWsRr2Bj7LF4I7jyY-EqaiBNjhjL36LsfNTKO0COfWyawcZHyK3ewN130VRPGfh_dgJRlwXdZ7_hSXNLns15_v44nlSrWeXVKKrR0YY4xMyphY1H2SWM_6Ne-yzG5gEor9TzrRNxopE0oqyQs3sQVugFIM8GHOSboEX8Yfq6SdvsV4Hvm-FldtlkGNxvsUXj7RzXaGzLozNlJP2-W-aWx-YiFM8TlXtoRYwQbqHzNRL5Wz6bS0z5G8JwTFUY-uArF8wk7ZXe7iW72DM7u-FG6WTS5jzV1X69LksTf3y2AiSy5DKhPg5udvnxHZDlVMMIYEMLFUJiBgWuIiEbzdsypVPJnFPfxkxeQUKT20xbe4j8zu-6z2SLp68ZYJRjZXCP7E4CyQBA6cqeIvBhxTXwIaZ8ezVr6PAQPbE1Gj81CH4ZGNUkh2m5IkGI2MzLqUZoLyiVCbDm9adsVSi56LAMOBFvapU1iml0g-dTZukdXMqCLYhJ1sQfXCjQuVIOq9aevngOF6T5mUzS2sxrc3FXr9SB5rHlwDfH8XXWA3mvDlLm7bkbpqX-LhBGVEbJ64Og2fK-NtjFuvXF1FdWwQHKsu-sks6u5p412BZnVuy9ljgNXzh1a00hc_xNUg-EAhoREVybi8Iqm5jsC47lqwU6qsXvx4gqAeW2UkwvRqvCYFk6z3Fr70b0ogva6FrunmSNpxHGe9Za_lq15QFcI6ayhO901VRiQHaHNj1l6FrXj8ByhlyV6PkFeY3SIXCwfiBHi9r7f3OsqQUn8wNklk3WCopIv34_zWrVGVTS25fuZTpV_jjdrs876SW0K7LbDyCdipGSyFaa_PcweitPBCo2R6fvpxTDhysM4OKr43KgIcJ7xqd6xTHkvet6Uq3fTl40vcc_t6pHRMUTl3EIRPZWUuxbg2FUow5TdZdph80yhD0jnbCseRe_fNFTAUd8L3jFd5_ahIPMb26w_OHqadyx4m7XbS54aa0YlD7zCFqA-cyDYcDBUgiBb0UD9UsyKU342iL3oBvc5fa6OLiEF_hKYIUUXNPjblQCFIhwtruB8wFk0kM98k7oVGgEjWS0HLLURwdUkzScj9KOif-9bc16kwHRZ2DXxgMvunfEDW3G91693ywACCmIZN0044ahqGCT92pp1qwhKIZ6UMUwwyJSxpBBsclpltoNdotMmrA81jICTgslRIcF98ZQi8xP2AyfAu-jf4XnArg6DD5fZbpIkeanX_Rin3K_TtA1rsBHIV1z4eyLS711V208e0v6-v-61f_TPndiW9knOjQX857-3xk8C7ylCeE3qbjpDK5cvgqdYcKY8MrqJowAgzpVkY_DLJcFB4SaKAlG_Qmo6MNc4H1c2lCEQp2QJ1-XtwuMRo-YH0hVjhHqtSav_dwuCaj0bZv3RbNO3WAOkpfveCM06o8w3MyKwxZ_bx2G57wDV8R5BWHIdKb71eh_EJ25AKuZJpWbFsjSsu0kpEn0zaiaaUiVzhOKwwH9hdu-VYECncnIb_Cm6GpZgPGr9aXos1wdwLfORhw8ubGg5PAF6jQUjIxmhzmRKV_aHoOemBoKXFMctTHcbd7NvQ4eZbPrahCebjL7DT1Q0ie7RfRgWKsFL6mWIbc3ic-tQo9oU0bkKd-verRQ2LbQ2yK28txeTN19DCiP5QAJ1aGwFQcHFLnsgJwsu2F0hyseEyTkQE9zfg6Yk76vu7vHzecs6ltkTcMrFdpK88Zg-v3HRxVX6gP5Cd7Zl83x7vxuvGxZazDqyiH8sGGyZo0oCxPLZjhv1zce4y9gtHK0qO-S4AESDyOXDRVKDuPc6xFX3hT1zGJ8_wNDRHr4mN8hBx0D19tZsLL59x3X8a_sCTIJbv6NUbYX-xM26tBtAQ20RpAPo-dPsSfSZkdtpV4rPZ8Tj7Ml9ArlleRA3jl40LajAiVkh4T6IV1MVm3AepD6DjzS0dZDqJWRqDu7-51WACf4aOghNgjvPRtfiEFbdlq-1BwzzR98-eBxDcuet1-FRcR1saqkWC8LgA6QRqRSB2fxfbmBDn1fdXDck8ZAe3qJjXOT_xbG2KFktxGuJ1JS4wjw2quDphjB3XTSUld6tjeb4jzrTzNGjHjYGec42zA_-UfyRWMDvAWQFLf3DPsjA_RCvSaqhvTxxXkLna5CLJlZuH2okgnRN3asFksYjGcNQlYcCMLkLyKRmEUJLTY1eVTYeo3lt4PCZFmh29_gQ_llpGRnqPV4f85Q5UlJpnbIm0dT_d9Db9_Sjd5V19yzR5wBitzEB3LhSdCHVPingNy-ll4av9elvaDxh3HLAzWbymIGfb92EvGUdqeZujRriLxsI6xIZG1Vvvb9Yj0ZpkyAVT8XmdghcWnjga4GFmpkwimRaQ-_NZOXJ4yFI2islZGqilpeNoqyDI5q5FRyDQ0s8p_RtU5nLNDCqCoVZ1R0Ogt_tWZzxZisTXwglLJMfQ1-_nWQbYvMnuehhHKdMNkts04rKcCkhIf1iMcykvTI13S6wsY_dRM16hxnoPOxrAvHG65PhmLhFBcus3SW8d3oxvJ3ni58DdRTZnVFBFNaK-cy8MM81c8TTxIR0N27SOkCNSVLYd2MBor4rpgyfMwoe9ehn4LwKJIziVjf0l3FqMSDP1jPMTqUfwkWvYnH9JWR-MUJArsFX_2j3hsUWhW5KASsHR-NWHUXlglJobEvnPO88g0q2iiZCfP8k6aFGfMCUBeHMrbLyG7nq_8k6-CYrQdxh83xOcbALyjIodlnhcuyE14rM0ftfjrTBIvUBMt1F1CCtLbdSz2elJTtMbXdXnlhi9JEelvNu_kGxeQDSPv2BWofr6t6yuX6mjfjU8fDh91iHNCiFe6IhVQjscags3-xasV2MPhxjxjgb_hCfKQVPeW8Mu5jGKSJWr4MgFvxzqlq8FZEaO1LGPCeTQK38waVjNFq5d9i9674y_SjoMN9fo48WT870zBnwKbcD5Vzeezegh-K81zJISHJUPmep2mBrQEr0UjBrL6egO0Xmv_aGQ8yLnTjEI8ME3Poe2aEqgDUAqmE1ozknTtX8ga8MEDZZvZI0RtwR0q34fwm19MeFp-mkL8_mSgGzie3LfH4cyHZaIKEPoLn2F846nW3TQXnSzEfqIAonI6s4Hdv8GRW8vTKx1HRwzfIfMHhdL4Or_K8Vc803tkERYdHIGTgJDr45WQCpuWDga_7-7BMdoDU&cid=CAQSPwDq26N9Behk7C6btv9J8sd9JNxampycyNmhrHg2L5Qcigse8mfm3R8E3sV1pmeHOvWFhGDX9jw1VXH6jMQ5fxgBIA4&rfl=2%2Chttps%253A%252F%252Fpastelink.net%252F%240
Frame ID: 137E54FB19D07B3066AC859F37909C25
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKv65gIQstDN9AEYu7zx0wEwAQ&v=APEucNWy0hTV3j61PhnIwg3ZzpGh5jjhvF3U0aab0xd6zQwRBlRWYJqJJNwzmMzZaX1JbGRLsWyRsIZ4S0eYwXt5QllZmh1qtA
Frame ID: 88C69539164B55576E0D9E76A77C961A
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQi4Dw4AIYwauCvQEwAQ&v=APEucNXTbTPrNwmCo4iLnVpiFdcD99yg2u8d0yjRePEGbsDm77OfvRW2WO25PIbSwpgYmf3H7xXmU_GFyiagyG7aTgrOpiy9TA
Frame ID: 281325E73B5B62303FAF62A3B0759761
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/252410901119672947/index.html
Frame ID: 4BEB749D69DFE2C5FCE38F3809CE8E45
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: A8E463A196381B313E8E6036CD9DBCB6
Requests: 2 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_n-MediaNet_smrt_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Frame ID: 93442D0D93A507E9040144FBF131605B
Requests: 5 HTTP requests in this frame

Frame: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Frame ID: CCE4600CEF9D5B2D3EEBB0144E1A6829
Requests: 6 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Frame ID: 276063AC52701E4379B71F1A414C1176
Requests: 11 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Frame ID: C3748A5D01BCF814638CEA79AFB7E0B5
Requests: 12 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=7733999678171328375&gdpr=0&gdpr_consent=
Frame ID: 1CE200957E9829DBE86106AD4B61CA5D
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 7290459C8BE108D25FC95E2387B4A366
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js
Frame ID: ED6B7E33270F656C614105D62F55BB86
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: D558981EF67389544E94388728E28A6C
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 5340C8898B471EF4DB47CE285E7ADD60
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: D516B4498FDDE137AED44DB85B1817E6
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js
Frame ID: 8B413E43F70F12E00F6D36D71303E30E
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js
Frame ID: 085CBBF525EE5B9BC39301A5B3EBE699
Requests: 1 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/8276465137012464354/index.html
Frame ID: FDACC1BEDDD2D1C025AC03E235264473
Requests: 9 HTTP requests in this frame

Frame: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=C2E1DFFF-90AF-45E8-9817-31DBC0A6255C
Frame ID: 0EA0831A9B288FCA0C88B7D517152ABF
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:c213634b-2034-4c00-af24-bf7a9e7bdf98&gdpr=0&gdpr_consent=
Frame ID: 9154814AE120F7EC846B946537A3E71D
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UIDC2E1DFFF-90AF-45E8-9817-31DBC0A6255C
Frame ID: 48B74EBB6BC963331DD5C57528049924
Requests: 1 HTTP requests in this frame

Frame: https://ad.doubleclick.net/ddm/adi/N1395.150740DOUBLEVERIFY/B9689862.280626343;dc_ver=91.268;dc_eid=40004000;sz=160x600;u_sd=1;dc_adk=943508956;ord=q27rep;uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd;dc_rfl=1,https%3A%2F%2Fpastelink.net%2F$0;xdt=1;crlt=3cLyqGOXcq;stc=1;chaa=1;sttr=193;prcl=s
Frame ID: 97BC0B54B6958160113671FBB2F121F5
Requests: 11 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements3094.js
Frame ID: C79509E872CD0258905DCF7698095B18
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 00A4AC2FBA4C10FD437D266439B2719E
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js
Frame ID: 53FBEF81B9FC424B7A9084E987ACDBBB
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

On the internet Sports Betting instructions Tips on how to Bet Like A Champ - Pastelink.net

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

282
Requests

86 %
HTTPS

0 %
IPv6

39
Domains

65
Subdomains

47
IPs

8
Countries

6094 kB
Transfer

11131 kB
Size

61
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://spo337.com/
Title: https://spo337.com/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://pastelink.net/wwr50xs3

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=On%20the%20internet%20Sports%20Betting%20instructions%20Tips%20on%20how%20to%20Bet%20Like%20A%20Champ%20https://pastelink.net/wwr50xs3

Search URL Search Domain Scan URL

URL: https://t.me/share/url?url=On%20the%20internet%20Sports%20Betting%20instructions%20Tips%20on%20how%20to%20Bet%20Like%20A%20Champ%20%0Ahttps://pastelink.net/wwr50xs3

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=On%20the%20internet%20Sports%20Betting%20instructions%20Tips%20on%20how%20to%20Bet%20Like%20A%20Champ%20https://pastelink.net/wwr50xs3

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https://https://pastelink.net/wwr50xs3&title=On%20the%20internet%20Sports%20Betting%20instructions%20Tips%20on%20how%20to%20Bet%20Like%20A%20Champ%20

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/pin/create/button/?url=https://pastelink.net/wwr50xs3&description=On%20the%20internet%20Sports%20Betting%20instructions%20Tips%20on%20how%20to%20Bet%20Like%20A%20Champ%20&media=https://pastelink.net/assets/images/pastelink-logo-square.png

Search URL Search Domain Scan URL

URL: http://www.tumblr.com/share?v=3&u=https://pastelink.net/wwr50xs3&t=On%20the%20internet%20Sports%20Betting%20instructions%20Tips%20on%20how%20to%20Bet%20Like%20A%20Champ%20&posttype=link

Search URL Search Domain Scan URL

URL: https://www.blogger.com/blog-this.g?u=https://pastelink.net/wwr50xs3&n=On%20the%20internet%20Sports%20Betting%20instructions%20Tips%20on%20how%20to%20Bet%20Like%20A%20Champ%20

Search URL Search Domain Scan URL

URL: https://profitquery.com/add-to/livejournal/?url=https://pastelink.net/wwr50xs3&title=On%20the%20internet%20Sports%20Betting%20instructions%20Tips%20on%20how%20to%20Bet%20Like%20A%20Champ%20

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https://pastelink.net/wwr50xs3

Search URL Search Domain Scan URL

URL: https://share.flipboard.com/bookmarklet/popout?v=2&title=On%20the%20internet%20Sports%20Betting%20instructions%20Tips%20on%20how%20to%20Bet%20Like%20A%20Champ%20&url=https://pastelink.net/wwr50xs3

Search URL Search Domain Scan URL

URL: https://social-plugins.line.me/lineit/share?url=https://pastelink.net/wwr50xs3&text=On%20the%20internet%20Sports%20Betting%20instructions%20Tips%20on%20how%20to%20Bet%20Like%20A%20Champ%20

Search URL Search Domain Scan URL

URL: https://www.meneame.net/submit?url=https://pastelink.net/wwr50xs3

Search URL Search Domain Scan URL

URL: https://diasp.org/bookmarklet?url=https://pastelink.net/wwr50xs3&title=On%20the%20internet%20Sports%20Betting%20instructions%20Tips%20on%20how%20to%20Bet%20Like%20A%20Champ%20&jump=doclose

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 50

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_n-MediaNet_smrt_n-Outbrain HTTP 302
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_n-MediaNet_smrt_n-Outbrain&dcc=t

Request Chain 143

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI24y2-9wfnSBTgLiMo6k4c&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI24y2-9wfnSBTgLiMo6k4c&google_cver=1&C=1

Request Chain 144

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y0sgM7HSDSIrTzNscSUoZQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1

Request Chain 145

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEJ2_gp4BBJi1CN54BVYTt9c&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJ2_gp4BBJi1CN54BVYTt9c%26google_cver%3D1

Request Chain 146

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTY3MDQyMjAwODI3NTYxNjg4OQ%3D%3D

Request Chain 147

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI24y2-9wfnSBTgLiMo6k4c&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI24y2-9wfnSBTgLiMo6k4c&google_cver=1&C=1

Request Chain 148

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y0sgM2Q3fSISiTVypnFjZAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1

Request Chain 149

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEJ2_gp4BBJi1CN54BVYTt9c&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJ2_gp4BBJi1CN54BVYTt9c%26google_cver%3D1

Request Chain 150

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk2ODAyNTUzNDY4MjE0NzkwNg%3D%3D

Request Chain 171

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1&C=1

Request Chain 172

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y0sgM4.laeN8DbzYJ53nQAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1&google_hm=2

Request Chain 173

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEJguiJ9zw4tH2EnPNJtcjcM&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJguiJ9zw4tH2EnPNJtcjcM%26google_cver%3D1

Request Chain 174

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE3MTIyMzg0OTAyMDc5NTA5MA%3D%3D

Request Chain 175

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1&C=1

Request Chain 176

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y0sgM2Q3fSISiTVypnFjZQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1

Request Chain 177

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEJguiJ9zw4tH2EnPNJtcjcM&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJguiJ9zw4tH2EnPNJtcjcM%26google_cver%3D1

Request Chain 178

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE3MTIyMzg0OTAyMDc5NTA5MA%3D%3D

Request Chain 183

https://s.ad.smaato.net/c/?adExInit=aps&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsmaato.com%26id%3D%24UID HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=8465a01f

Request Chain 184

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24%7BBSW_UUID%7D HTTP 302
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24%7BBSW_UUID%7D HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=3233a8c9-4115-43a5-a376-c2eb49410f10

Request Chain 185

https://cs.media.net/cksync?cs=31&type=tam&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmedia.net%26id%3D%3Cvsid%3E HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3088694271535431000V10

Request Chain 186

https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__ HTTP 302
https://stags.bluekai.com/site/23178?id=yV3iT-48FA3I-PiaqFP8&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG33NEZSXQY3IMFXGOZJ5MFWWC6TPNZPXIYLNEZUWIPLZKYZWSVBNGQ4EMQJTJEWVA2LBOFDFAOA HTTP 302
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG33NEZSXQY3IMFXGOZJ5MFWWC6TPNZPXIYLNEZUWIPLZKYZWSVBNGQ4EMQJTJEWVA2LBOFDFAOA HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=yV3iT-48FA3I-PiaqFP8

Request Chain 199

https://ssbsync-us.smartadserver.com/api/sync?callerId=2 HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=7733999678171328375&gdpr=0&gdpr_consent=

Request Chain 202

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 229

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=

Request Chain 230

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=

Request Chain 231

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=

Request Chain 232

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=

Request Chain 251

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&khaos=L9AEOYPO-1-D5EB HTTP 302
https://s.amazon-adsystem.com/ecm3?id=L9AEOYPO-1-D5EB&ex=d-rubiconproject.com&status=ok

Request Chain 254

https://c1.adform.net/serving/cookie/match?party=14&cid=C2E1DFFF-90AF-45E8-9817-31DBC0A6255C HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=C2E1DFFF-90AF-45E8-9817-31DBC0A6255C

Request Chain 255

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:c213634b-2034-4c00-af24-bf7a9e7bdf98&gdpr=0&gdpr_consent=

Request Chain 257

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=wuHf_5CvReiYFzHbwKYlXA%3D%3D HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

Request Chain 258

https://idsync.rlcdn.com/420486.gif?partner_uid=C2E1DFFF-90AF-45E8-9817-31DBC0A6255C HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJEMyRTFERkZGLTkwQUYtNDVFOC05ODE3LTMxREJDMEE2MjU1QxAAGg0ItMCsmgYSBQjoBxAAQgBKAA HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=9084f82de3ade4068ee0e959fedbbfe66307c27d423a9811c874a4e99dd5b729791426b5417dce21&_=2 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA5MDg0ZjgyZGUzYWRlNDA2OGVlMGU5NTlmZWRiYmZlNjYzMDdjMjdkNDIzYTk4MTFjODc0YTRlOTlkZDViNzI5NzkxNDI2YjU0MTdkY2UyMRAAGgwItcCsmgYSBAgCEABCAEoA HTTP 302
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA5MDg0ZjgyZGUzYWRlNDA2OGVlMGU5NTlmZWRiYmZlNjYzMDdjMjdkNDIzYTk4MTFjODc0YTRlOTlkZDViNzI5NzkxNDI2YjU0MTdkY2UyMRAAGgwItcCsmgYSBAgCEABCAEoA&google_gid=CAESEGtzCH7x_8QreyTpmPnMljk&google_cver=1 HTTP 307
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3= HTTP 303
https://idsync.rlcdn.com/458249.gif?partner_uid=2a72ac6e-d2a7-4498-a830-f22ecdd611e2

Request Chain 259

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=9ef0634b-2034-4800-92e4-ddd8d7126f0a

Request Chain 260

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QzJFMURGRkYtOTBBRi00NUU4LTk4MTctMzFEQkMwQTYyNTVD&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

Request Chain 261

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECtswvNhpt0xpD3CDHlsMvQ&google_cver=1

Request Chain 262

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:95B09608F370452BA2DF4425E9B5BB5F

Request Chain 264

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=5e4858c0-d88b-4ad3-b03c-e0c31745bc26

Request Chain 265

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id= HTTP 302
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=dNFB1HmqTGa57ZcmZuE0LA&rk=usync-na HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=dNFB1HmqTGa57ZcmZuE0LA

Request Chain 266

https://match.adsrvr.org/track/cmf/rubicon HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=&expires=30

Request Chain 267

https://token.rubiconproject.com/token?pid=36584 HTTP 302
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L9AEOYPO-1-D5EB

Request Chain 268

https://token.rubiconproject.com/token?pid=25470 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDlBRU9ZUE8tMS1ENUVC

Request Chain 270

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1 HTTP 302
https://pr-bh.ybp.yahoo.com/sync/rubicon/63QbcS7-wDaPMbKJfYYoQA?csrc= HTTP 302
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=5895685174981949212

Request Chain 271

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEO2hQ8rh7iRYoYePWpWIZFc&google_cver=1

Request Chain 272

https://token.rubiconproject.com/token?pid=2249&pt=n HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MWMwYTNjODMxOTcwMTUwN2Q4ZGI2OTc3MmEwZDk5NzE3ZWU0NjgzZg

282 HTTP transactions
15 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request wwr50xs3 Show response
pastelink.net/ 28 KB
8 KB 1093ms
396ms Document
text/html 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://pastelink.net/wwr50xs3

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

8cad91e999229f2d8ccce22d7393f2f44e37fb3855978f1f0f7238c17d1ded6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 15 Oct 2022 21:03:41 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
x-frame-options: SAMEORIGIN

GET
H2 200 css2
fonts.googleapis.com/ 5 KB
773 B 519ms
177ms Stylesheet
text/css 74.125.24.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f95.1e100.net

Software

ESF /

Resource Hash

ebfd96030683611d9ed054682f1ddf8b9098bc7d10105602b338605b0ae82a9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 15 Oct 2022 21:03:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 15 Oct 2022 21:03:41 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 15 Oct 2022 21:03:41 GMT

GET
H2 200 styles.css
pastelink.net/assets/css/ 120 KB
121 KB 348ms
346ms Stylesheet
text/css 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://pastelink.net/assets/css/styles.css?q=35

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

752ff8324271233c2135a95dde8adf84e507296eacd17db421c623b0c5e5af85

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/wwr50xs3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Sat, 18 Jun 2022 18:14:09 GMT
server: nginx
etag: "62ae15f1-1e1ae"
content-type: text/css
accept-ranges: bytes
content-length: 123310

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 913ms
310ms Script
application/javascript 69.16.175.42
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: pastelink.net
URL: https://pastelink.net/wwr50xs3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.42 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: tlb.hwcdn.net
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer: https://pastelink.net/
Origin: https://pastelink.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:42 GMT
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
server: nginx
etag: W/"620cd6ff-15d9d"
vary: Accept-Encoding
x-hw: 1665867822.dop007.la3.t,1665867822.cds235.la3.hn,1665867822.cds267.la3.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30875

GET
H2 200 script.min.js Show response
pastelink.net/assets/js/ 41 KB
41 KB 347ms
347ms Script
application/javascript 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://pastelink.net/assets/js/script.min.js?q=35

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

612ac93fa7a4f369ab6549ed35e681c03fb942081d36944edeec8b9ea3a0c1e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/wwr50xs3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 08 Jun 2022 13:39:30 GMT
server: nginx
etag: "62a0a692-a20d"
content-type: application/javascript
accept-ranges: bytes
content-length: 41485

GET
H2 200 js.cookie.min.js Show response
cdnjs.cloudflare.com/ajax/libs/js-cookie/latest/ 2 KB
1 KB 277ms
93ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/js-cookie/latest/js.cookie.min.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.24.14 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b6d244a569a8befc0b901e3dca8e82f19b188e2d3e76f7c62fce96935ed6311

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:41 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 946952
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 772
last-modified: Mon, 04 May 2020 16:11:49 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec5-6d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SF%2FpmbMW4Nl7QvwMIVAJTBZ6Gg9EqDCF0dAPU%2BIDh6jewqWeznQ3ir5pLE1jx0GljHg2YcKEByasCeb2qhkyTkthuqVXXG3AAedDD1jnVLvYe%2BRb7GLf213S3Mrk1fzjWirGqEvd"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 75ab80bd3da717cc-MEL
expires: Thu, 05 Oct 2023 21:03:41 GMT

GET
H2 200 rules.js Show response
cdn.adligature.com/pl/prod/ 16 KB
5 KB 474ms
288ms Script
application/javascript 104.21.93.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adligature.com/pl/prod/rules.js
Requested by: Host: pastelink.net
URL: https://pastelink.net/wwr50xs3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.93.14 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5740ea039fa2894da5942c74ebbd622c42f128d2777881b5c654c85fe07cb66f

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:41 GMT
content-encoding: br
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=27720
x-guploader-uploadid: ADPycds31zkGkq_CjJlMNq8LIcCcG7ASyQcJ2C2F6piApCYw8W2VB8Iz-BKC08GI1o6xQJEz3a7y3PSzCR2Q8kpI6Vsl7g
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 19 Sep 2022 18:15:17 GMT
server: cloudflare
etag: W/"22235b4c92371407f3f9e461c36a0fcd"
vary: Accept-Encoding
x-goog-generation: 1663611317639170
content-type: application/javascript
x-goog-hash: crc32c=udYfmg==, md5=IiNbTJI3FAfz+eRhw2oPzQ==
cache-control: public, max-age=1800, s-maxage=600, must-revalidate
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CJyRqTrSRrYvNokTdBaIxtda8T2KQs5TqCmYpunXoz5uxCevq1O5ySuP7Dax4BOiHWmTsmCGcls4rooDt0AoQeCp8WMSKPBjeEWm7F5AeTMAtg2LS6I6lYGS%2BQ8upw%2FGQD7t%2FTQ%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 27720
cf-ray: 75ab80bd3c1d5aa0-MEL
expires: Sat, 15 Oct 2022 21:13:41 GMT

GET
H2 200 css2
fonts.googleapis.com/ 1 KB
919 B 518ms
176ms Stylesheet
text/css 74.125.24.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Karantina:wght@400&display=swap

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f95.1e100.net

Software

ESF /

Resource Hash

86ae37a750e77037da22fc68d21c68c5f60058a017466916d186bac9cd5f501b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 15 Oct 2022 21:03:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 15 Oct 2022 21:03:41 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 15 Oct 2022 21:03:41 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 906 B
985 B 515ms
175ms Script
text/javascript 142.251.10.105
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?onload=captchaLoaded

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.105 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f105.1e100.net

Software

GSE /

Resource Hash

ebbb5d4ff5173e5dc1c7627341ade76b290c077c94c78e41bbfeff8f27ee47b9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 572
x-xss-protection: 1; mode=block
expires: Sat, 15 Oct 2022 21:03:41 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 173 KB
62 KB 508ms
170ms Script
application/javascript 142.251.10.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-55WHPWQ

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

f2732b0f9327632cf190f94cfeae74e77deed8306fcc26916200d352ad0a166a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:43 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 63336
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 15 Oct 2022 21:03:43 GMT

GET
H2 200 advally-4.29.0.js Show response
cdn.adligature.com/rules.js/ 111 KB
31 KB 98ms
97ms Script
application/javascript 104.21.93.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adligature.com/rules.js/advally-4.29.0.js
Requested by: Host: cdn.adligature.com
URL: https://cdn.adligature.com/pl/prod/rules.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.93.14 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ca180607fd93a9e1b6b1d03e5ac2c4d9f661f7ce867be2b9b91ba3c3e9da926

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:42 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5394
cf-polished: origSize=183079
x-guploader-uploadid: ADPycdsc9h5zShhQH767kJAmqF4-nYgzJGbqcl-CbdNr-_lncgY9TfJQttzC1eTBrS4saAEt7EUf0Ypc0wgcH_XMGO3SAnONfabl
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Tue, 30 Aug 2022 13:22:29 GMT
server: cloudflare
etag: W/"c42683032b2dde64f4e339d2ab3f977c"
vary: Accept-Encoding
x-goog-generation: 1661865749561003
content-type: application/javascript
x-goog-hash: crc32c=/WFfgQ==, md5=xCaDAyst3mT04znSqz+XfA==
cache-control: public, max-age=7200, s-maxage=7200, must-revalidate
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UCtG%2Fwn9Cvcmd7LJvamBvTjOuPCFumdF0kxurKuOt4GILDbGeFgQUF0caePpzN0jcsZSFzaP%2FRsWhtXyJnKgvOqPCPsbknJRPovsc3ra7mQVnMoQE1c%2FZoLs%2BHsEZLeYrqpELcU%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 183079
cf-ray: 75ab80c3cce65aa0-MEL
expires: Sat, 15 Oct 2022 21:33:48 GMT

GET
H2 200 rules.css
cdn.adligature.com/pl/prod/ 294 B
705 B 285ms
283ms Stylesheet
text/css 104.21.93.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adligature.com/pl/prod/rules.css
Requested by: Host: cdn.adligature.com
URL: https://cdn.adligature.com/pl/prod/rules.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.93.14 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 328f7808cfa82581e66b87932fd28a928ce58f69a388aabe667e5154c3a9a437

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:42 GMT
content-encoding: br
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-guploader-uploadid: ADPycdtBs-K_ozFVTz7yZbReHWndXQEK1uk_8BiXZgjDeQXFoSSQINZ6df5eouQPGPVi-VTi0VpZ8NjgBIJN_HtPZ8fFug
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 19 Sep 2022 18:15:19 GMT
server: cloudflare
etag: W/"3e2d744323302df67c7f61ecc16cd570"
vary: Accept-Encoding
x-goog-hash: crc32c=6jmLUw==, md5=Pi10QyMwLfZ8f2HswWzVcA==
x-goog-generation: 1663611319473177
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T%2BbDttYBvnuRiY%2BP416%2BN%2BDc5Z2BfOzb%2BYQZutcbCgCnGLVxKCW2gqxQFKKhjKusSsjW3QG1ImSJWbfh0ddhgy2xlYDi%2B%2Bjdmg9NsbM30%2BF%2FF1ZObh3GPwBxYPzqm6p0v9Vk7dQ%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=1800, s-maxage=600, must-revalidate
x-goog-stored-content-length: 294
cf-ray: 75ab80c3cce55aa0-MEL
expires: Sat, 15 Oct 2022 21:13:42 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/vP4jQKq0YJFzU6e21-BGy3GP/ 392 KB
157 KB 521ms
174ms Script
text/javascript 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/vP4jQKq0YJFzU6e21-BGy3GP/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=captchaLoaded

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f94.1e100.net

Software

sffe /

Resource Hash

396c964c85a9b2e9a380bb18b1f6d51960f2bc7f7d4fd2bcf4754fc0ac443cd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Origin: https://pastelink.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 02:02:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 586881
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 159789
x-xss-protection: 0
last-modified: Sun, 02 Oct 2022 20:02:07 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 09 Oct 2023 02:02:22 GMT

GET
H2 200 debut_light.png
pastelink.net/assets/images/ 4 KB
4 KB 347ms
346ms Image
image/png 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/debut_light.png

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

c24ccee9a35eef9e74411eac871935bdff6bcb895cce80b754b66d3e4292a3ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 27 May 2021 10:51:09 GMT
server: nginx
etag: "60af799d-10c8"
content-type: image/png
accept-ranges: bytes
content-length: 4296

GET
H2 200 pastelink-logo.svg
pastelink.net/assets/images/logo/ 3 KB
3 KB 347ms
347ms Image
image/svg+xml 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/logo/pastelink-logo.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

01408f8061623faa6d2c0f015cd23483c3aa363c095e152f613ed94c87a5803d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 06 Oct 2021 13:37:31 GMT
server: nginx
etag: "615da69b-d3d"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 3389

GET
DATA 200
OK truncated
/ 16 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 13100cd3879e5c1385581d7c88153e60cd7c3e4b0578fe2838daa56da689769b

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 arrow-down-blue.svg
pastelink.net/assets/images/ 239 B
409 B 348ms
346ms Image
image/svg+xml 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/arrow-down-blue.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

50a60e5e5f2e8f10a2f8685031ec9849ba8faff613139f3a402e89f25ccbbabc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 29 Sep 2021 15:26:32 GMT
server: nginx
etag: "615485a8-ef"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 239

GET
H2 200 moon.svg
pastelink.net/assets/images/ 2 KB
2 KB 348ms
346ms Image
image/svg+xml 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/moon.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

ed6cd01c384db70bedbe24986aa85b0745f994ad71b7e5712f8a60e1ff457d7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Mon, 18 Apr 2022 15:53:05 GMT
server: nginx
etag: "625d8961-62e"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 1582

GET
H2 200 public-black.svg
pastelink.net/assets/images/ 578 B
748 B 349ms
347ms Image
image/svg+xml 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/public-black.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

57226adbc32c91a8cd4ec9ee08e4f155f3450e79256731c04f81709a58c4c1fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Mon, 18 Apr 2022 15:53:05 GMT
server: nginx
etag: "625d8961-242"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 578

GET
H2 200 pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 509ms
169ms Font
font/woff2 142.251.12.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f94.1e100.net

Software

sffe /

Resource Hash

7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pastelink.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 17:20:24 GMT
x-content-type-options: nosniff
age: 99799
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7884
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 17:03:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Oct 2023 17:20:24 GMT

GET
H2 200 buE0po24ccnh31GVMAB59wo6.woff2
fonts.gstatic.com/s/karantina/v11/ 15 KB
15 KB 679ms
339ms Font
font/woff2 142.251.12.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/karantina/v11/buE0po24ccnh31GVMAB59wo6.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Karantina:wght@400&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f94.1e100.net

Software

sffe /

Resource Hash

8e22e8601cb927cfcaa560470c56f4913def5cb16bc74a9ead9b072cbabe4ced

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pastelink.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 03:21:06 GMT
x-content-type-options: nosniff
age: 63757
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14920
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 14:50:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 15 Oct 2023 03:21:06 GMT

GET
H2 200 pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 525ms
185ms Font
font/woff2 142.251.12.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f94.1e100.net

Software

sffe /

Resource Hash

cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pastelink.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 10:20:30 GMT
x-content-type-options: nosniff
age: 124993
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7748
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:21:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Oct 2023 10:20:30 GMT

GET
H2 200 social-spritesheet.png
pastelink.net/assets/images/ 28 KB
28 KB 478ms
478ms Image
image/png 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/social-spritesheet.png

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

8af24d7350dbdc8eea22e4737deaa35a795b19b0560d7173113bec7e8a3effb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Fri, 05 Nov 2021 18:20:14 GMT
server: nginx
etag: "618575de-70de"
content-type: image/png
accept-ranges: bytes
content-length: 28894

GET
H2 200 logo-bg-90-tl.svg
pastelink.net/assets/images/ 2 KB
2 KB 478ms
478ms Image
image/svg+xml 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/logo-bg-90-tl.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

1c9e4c65f9d921b1c0829958cc7b2f307a3e22ac7a23e8315b6db4c0954e1107

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 25 Nov 2021 11:28:22 GMT
server: nginx
etag: "619f7356-933"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 2355

GET
H2 200 pastelink-logo-contrast.svg
pastelink.net/assets/images/logo/ 4 KB
4 KB 478ms
478ms Image
image/svg+xml 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/logo/pastelink-logo-contrast.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

3a73b36061944ebbb33696553917d393280f796e212afcd09057b441c1168606

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Mon, 18 Apr 2022 15:53:05 GMT
server: nginx
etag: "625d8961-e31"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 3633

GET
H2 200 logo-symbol-non-white-bg.svg
pastelink.net/assets/images/ 4 KB
5 KB 479ms
478ms Image
image/svg+xml 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/logo-symbol-non-white-bg.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

15f20e02ef301e62ed325d633f971c506dcf1be3458c2371b849b505bb8673dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 25 Nov 2021 11:28:22 GMT
server: nginx
etag: "619f7356-11c0"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 4544

GET
H2 200 pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 529ms
208ms Font
font/woff2 142.251.12.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f94.1e100.net

Software

sffe /

Resource Hash

9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pastelink.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 07:20:53 GMT
x-content-type-options: nosniff
age: 135770
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7816
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:11:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Oct 2023 07:20:53 GMT

GET /
pro.ip-api.com/json/ 0
0

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 80 KB
28 KB 512ms
173ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.adligature.com
URL: https://cdn.adligature.com/rules.js/advally-4.29.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

459d16c4160346aa45f0fa3e3513612a6fed9378b58c54fdd29f2b6faefddb67

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27695
x-xss-protection: 0
server: sffe
etag: "1365 / 181 of 1000 / last-modified: 1665796965"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 15 Oct 2022 21:03:43 GMT

GET
H3 200 prebid-6.29.1.js Show response
cdn.adligature.com/prebid/ 522 KB
149 KB 116ms
115ms Script
application/javascript 104.21.93.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adligature.com/prebid/prebid-6.29.1.js
Requested by: Host: cdn.adligature.com
URL: https://cdn.adligature.com/rules.js/advally-4.29.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.93.14 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c436c070b4846bddc3edcd9b1a64b2847af21d3725bf4e9e297c978db85259b6

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:42 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 366
cf-polished: origSize=534394
x-guploader-uploadid: ADPycdt6_nlaYY_QG9ht9tlP48ti9hMbjPFWEwkSXnZatK8jzz06gCqDt9gBXIzd88DLITzN6tQpalPN1ueEIVmVdVgz7SK4QcSQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 07 Sep 2022 17:04:48 GMT
server: cloudflare
etag: W/"bbf0e18125fdc89f04edf74b2cd920ed"
vary: Accept-Encoding
x-goog-generation: 1662570288248743
content-language: en
content-type: application/javascript
x-goog-hash: crc32c=n4q/cA==, md5=u/DhgSX9yJ8E7fdLLNkg7Q==
cache-control: public, max-age=1800, s-maxage=600, must-revalidate
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dw7KBHla0ET95Z6QNxk5xt95c1Ddy35XWYo65cTCvCpKLWLsWku4TB%2Badz%2BFiku2yY9FJW5HVXZHB9f89YMrQotPbuS7NhCft68o6qCsfmuSol4EEslNkcrjVw9TmFyr961u7k8%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 534394
cf-ray: 75ab80c47a1b5a6d-MEL
expires: Sat, 15 Oct 2022 21:07:36 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 176 KB
44 KB 562ms
211ms Script
application/javascript 13.33.79.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.adligature.com
URL: https://cdn.adligature.com/rules.js/advally-4.29.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.79.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-79-24.sin2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e23aa41677b6c7479e9f2a46fb0e8a85c5ece6c088bb9fa8938fe970fc8493ab

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:01:35 GMT
content-encoding: gzip
via: 1.1 519f4b1ac97b08b10023540bb9e7e006.cloudfront.net (CloudFront), 1.1 2e665350ce36612d432303ac51dbf21a.cloudfront.net (CloudFront)
last-modified: Thu, 06 Oct 2022 22:15:22 GMT
server: AmazonS3
x-amz-cf-pop: SIN2-P2, SIN2-P2
age: 129
x-amz-server-side-encryption: AES256
etag: W/"4c87a00941c1aa3dcbab77fc8dc08ec0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=3600
x-amz-cf-id: F8srwMywJmWay_aM1HR67WaQx5nbtTiZGQ9u7Yz_yhPacmV6RUOdFg==

GET
H2 200 pubads_impl_2022101301.js Show response
securepubads.g.doubleclick.net/gpt/ 380 KB
128 KB 472ms
171ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022101301.js?cb=31070374

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

1af2148d7bd5e2a0c9ddc1c5b9ff072996852f4f11ebc19695ba4ee08ddb9c4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 18:29:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 182067
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131264
x-xss-protection: 0
last-modified: Thu, 13 Oct 2022 15:30:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 13 Oct 2023 18:29:16 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 73 B
97 B 509ms
171ms XHR
application/json 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=pastelink.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

c64cda3c1c7c935b57b27894caec3b370b98d70011c8e5ea2f31691be13c8fe7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 72
x-xss-protection: 0
expires: Sat, 15 Oct 2022 21:03:43 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 507ms
168ms Script
text/javascript 142.251.12.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-55WHPWQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f100.1e100.net

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 15 Oct 2022 19:37:34 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 5169
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Sat, 15 Oct 2022 21:37:34 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 215 KB
75 KB 479ms
177ms Script
application/javascript 142.251.10.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-S3DKHVPF03&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-55WHPWQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

5ee28336152adca449d6f93482f37ffbd759afee6f6e3e7e72877431a4b2548d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:43 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 76311
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 15 Oct 2022 21:03:43 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 514ms
170ms XHR
application/javascript 13.33.79.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.79.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-79-24.sin2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: YousslGi_alc9N7i1PBVBMNtdY1LkTzi
content-encoding: gzip
via: 1.1 9f6f7c775068d68476f4af0ffa848d4a.cloudfront.net (CloudFront)
date: Sat, 15 Oct 2022 10:27:20 GMT
x-amz-cf-pop: SIN2-P2
age: 38184
x-cache: Hit from cloudfront
last-modified: Thu, 06 Oct 2022 01:32:47 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: J1xOLDQkZ8BADgQkjl_PGT_LYX8ibPwI4L5B_PTrU9PUNozI9geupw==

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
204 B 471ms
169ms XHR
text/plain 142.251.12.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j98&a=1980954100&t=pageview&_s=1&dl=https%3A%2F%2Fpastelink.net%2Fwwr50xs3&ul=en-us&de=UTF-8&dt=On%20the%20internet%20Sports%20Betting%20instructions%20Tips%20on%20how%20to%20Bet%20Like%20A%20Champ%20-%20Pastelink.net&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=453890157&gjid=1013769378&cid=1495621433.1665867824&tid=UA-55088947-2&_gid=1434387865.1665867824&_r=1&gtm=2wgaa055WHPWQ&z=1985663787

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f100.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pastelink.net/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:44 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 426ms
171ms Ping
text/plain 142.251.12.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-S3DKHVPF03&gtm=2oeaa0&_p=1980954100&cid=1495621433.1665867824&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1665867824&sct=1&seg=0&dl=https%3A%2F%2Fpastelink.net%2Fwwr50xs3&dt=On%20the%20internet%20Sports%20Betting%20instructions%20Tips%20on%20how%20to%20Bet%20Like%20A%20Champ%20-%20Pastelink.net&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S3DKHVPF03&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f100.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:44 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 290ms
169ms XHR
text/plain 142.251.12.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j98&aip=1&a=1980954100&t=pageview&_s=1&dl=https%3A%2F%2Fpastelink.net%2Fwwr50xs3&ul=en-us&de=UTF-8&dt=On%20the%20internet%20Sports%20Betting%20instructions%20Tips%20on%20how%20to%20Bet%20Like%20A%20Champ%20-%20Pastelink.net&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEDAAEABAAAAACAAI~&jid=624498168&gjid=137795054&cid=1495621433.1665867824&tid=UA-197326395-9&_gid=1434387865.1665867824&_r=1&_slc=1&z=1006366085

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f100.1e100.net

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pastelink.net/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:44 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 1 KB
1 KB 171ms
171ms XHR
application/json 13.33.79.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpastelink.net&pubid=7e29cf92-dbd2-479a-865a-9cb3658a40f8
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.79.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-79-24.sin2.r.cloudfront.net
Software: Server /
Resource Hash: 59b0485c1fec4f53ce71bbf2805f19215f6651cc406e6ff66548444594eebc7b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 16:54:14 GMT
via: 1.1 2e665350ce36612d432303ac51dbf21a.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SIN2-P2
age: 14970
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://pastelink.net
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 1071
x-amz-cf-id: 88f_1bPqo9N5esnQ4GgxBDQyA3l7SrC2s0C3uFgofFHlx03NiY0Y2g==

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aa68e17fb13028f96c0d5b38fcf7006182894eb694625f9dedf5824d5066a5f0

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 bid Show response
aax-dtb-cf.amazon-adsystem.com/e/dtb/ 168 B
500 B 541ms
185ms XHR
text/javascript 13.35.17.5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aax-dtb-cf.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpastelink.net%2Fwwr50xs3&pid=Ro3TfaSjvb7pM&cb=0&ws=1600x1200&v=22.10.32118&t=1500&slots=%5B%7B%22sd%22%3A%22advally-adhesion-slot%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FBottom_adhesion_banner%22%7D%2C%7B%22sd%22%3A%22Top_leaderboard%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FTop_leaderboard%22%7D%2C%7B%22sd%22%3A%22AdvallyTag-pl-728x90-1%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FInline_banner%22%7D%2C%7B%22sd%22%3A%22AdvallyTag-pl-728x90-2%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FInline_banner%22%7D%2C%7B%22sd%22%3A%22AdvallyTag-pl-728x90-3%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FInline_banner%22%7D%2C%7B%22sd%22%3A%22AdvallyTag-pl-728x90-4%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FInline_banner%22%7D%2C%7B%22sd%22%3A%22AdvallyTag-pl-728x90-5%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FInline_banner%22%7D%2C%7B%22sd%22%3A%22Sidebar_MPU%22%2C%22s%22%3A%5B%22160x600%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FSidebar_MPU%22%7D%5D&schain=1.0%2C1!advally.com%2CP58S175%2C1%2C%2C%2C&pubid=7e29cf92-dbd2-479a-865a-9cb3658a40f8&gdprl=%7B%22status%22%3A%22no-cmp%22%2C%22cmpTimeout%22%3A2000%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.17.5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-17-5.sin5.r.cloudfront.net
Software: Server /
Resource Hash: 178996f91fcc30fcab68d58ab30fdfd3820198e3f6bd9764a71e9c5259cb7f92

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:44 GMT
via: 1.1 23632109ecb3eb8245f17822f97fa88e.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SIN5-C1
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://pastelink.net
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 168
x-amz-cf-id: m7lukm6Th-LEo37Q3Lg6IucI_lwBPRtU2U-PJBNGj_lgtcxFu6zoEA==

GET
H2 200 integrator.js Show response
adservice.google.com.au/adsid/ 107 B
792 B 518ms
174ms Script
application/javascript 142.251.12.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com.au/adsid/integrator.js?domain=pastelink.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022101301.js?cb=31070374

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f154.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 519ms
172ms Script
application/javascript 74.125.68.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=pastelink.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022101301.js?cb=31070374

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f154.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 571 KB
114 KB 781ms
781ms XHR
text/plain 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3603762764478711&correlator=534257998783129&eid=31068498%2C31070374%2C31070377%2C31069925%2C31070233%2C31061166&output=ldjh&gdfp_req=1&vrg=2022101301&ptt=17&impl=fifs&iu_parts=22405481091%2Cpastelink.net%2CBottom_adhesion_banner%2CTop_leaderboard%2CInline_banner%2CSidebar_MPU&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F3%2C%2F0%2F1%2F4%2C%2F0%2F1%2F4%2C%2F0%2F1%2F4%2C%2F0%2F1%2F4%2C%2F0%2F1%2F4%2C%2F0%2F1%2F5&prev_iu_szs=728x90%2C320x50%7C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C160x600&fluid=0%2Cheight%2C0%2C0%2C0%2C0%2C0%2C0&ifi=1&adks=3402602959%2C1666686559%2C2365527928%2C2365527929%2C2365527910%2C2365527911%2C2365527908%2C2108190548&sfv=1-0-38&fsapi=false&eri=1&cust_params=refid%3D2%26amznbid%3D0%26amznp%3D0&sc=1&cookie_enabled=1&abxe=1&dt=1665867824327&lmt=1665867824&dlt=1665867821405&idt=2844&adxs=436%2C310%2C513%2C513%2C513%2C513%2C513%2C1071&adys=1105%2C313%2C746%2C1196%2C1587%2C2071%2C2529%2C521&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C0%7C1%7C2%7C3%7C0&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fpastelink.net%2Fwwr50xs3&frm=20&vis=1&psz=728x-1%7C705x402%7C665x250%7C665x250%7C665x250%7C665x250%7C665x250%7C168x607&msz=728x-1%7C705x250%7C300x-1%7C300x-1%7C300x-1%7C300x-1%7C300x-1%7C160x-1&fws=516%2C4%2C4%2C4%2C4%2C4%2C4%2C4&ohw=1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600&ga_vid=1495621433.1665867824&ga_sid=1665867824&ga_hid=1980954100&ga_fc=true&ga_cid=1434387865.1665867824

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022101301.js?cb=31070374

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

ee9620c51f33cebb8cb9c6bce01a5569f8b49b5be3e6f66c1e3ce3c3c63fb05a

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/252410901119672947/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/252410901119672947/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKSTr5-R4_oCFYLScwEdZskAPg&gqi=&layout=/sadbundle/%24csp%253Der3%24/252410901119672947/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/252410901119672947/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/252410901119672947/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKSTr5-R4_oCFYLScwEdZskAPg&gqi=&layout=/sadbundle/%24csp%253Der3%24/252410901119672947/index.html
date: Sat, 15 Oct 2022 21:03:45 GMT
x-content-type-options: nosniff
content-encoding: br
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 117013
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1,-1,-1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1,-1,-1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 516ms
176ms XHR
application/json 142.251.12.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022101301&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022101301.js?cb=31070374

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f154.1e100.net

Software

cafe /

Resource Hash

30c16319dee7fc64b48fd737a5e7c5f0b88d0e2d25a598ed93dc7c3eb8e11020

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11170
x-xss-protection: 0

GET
H2 200 container.html Show response
2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 7D5E 6 KB
4 KB 521ms
172ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022101301.js?cb=31070374

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 21:03:44 GMT
expires: Sun, 15 Oct 2023 21:03:44 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 29 KB
9 KB 571ms
186ms Script
text/javascript 54.192.150.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: pastelink.net
URL: https://pastelink.net/wwr50xs3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.150.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-150-68.sin2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1ca7d45c26841657f394d905623d5e5c9c7f32aecc66d66ff8401388ffc43097

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:11 GMT
content-encoding: gzip
via: 1.1 a4e03b25c402f8e111eba098232bf16e.cloudfront.net (CloudFront)
last-modified: Tue, 19 Jul 2022 18:12:22 GMT
server: AmazonS3
x-amz-cf-pop: SIN2-C1
age: 33
etag: W/"979a52ecf913f8004d0123a9b7ba2a05"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age: 86400
x-amz-cf-id: s3_OMsOoBW_B5mwa27TrsH0vqQgtq43TYthl9bvZNt7w1wZ5TzJSsA==

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 56 KB
16 KB 283ms
95ms Script
text/javascript 172.67.38.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.38.106 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6f0507591c49aa88fab2433451c6c3154c5d4450636b43b749afa1ae2521fe2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:44 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 22 Sep 2022 13:13:44 GMT
server: cloudflare
x-amz-request-id: AGVQ42H585Y6XTD5
age: 315
etag: W/"68154020ef14b5881614607902c7c21b"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 75ab80d04ff25a55-MEL
x-amz-id-2: r9hllPMLzNEYnU3swJXcEwKssC39JhI8AZXWHVVaG+7VxlSjWm0FNcWZNPXHsNiMlMq1IA2cRX0=

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
327 B 1057ms
352ms XHR
application/json 141.95.98.68
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://lb.eu-1-id5-sync.com/lb/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 141.95.98.68 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3216657.ip-141-95-98.eu
Software: /
Resource Hash: 3dcf1ad00b0974c4f09cdc6e4293f650397270344eb472fc7564a36ebcf312c4

Request headers

Referer: https://pastelink.net/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://pastelink.net
date: Sat, 15 Oct 2022 21:03:45 GMT
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H/1.1 200
OK v1 Show response
lbs.eu-1-id5-sync.com/lbs/ 34 B
208 B 1050ms
348ms XHR
application/json 141.95.98.71
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://lbs.eu-1-id5-sync.com/lbs/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 141.95.98.71 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3216577.ip-141-95-98.eu
Software: /
Resource Hash: f43767361e15e0c49aa31e1957c95066b3b65caec29cc34941f4f166d9479058

Request headers

Referer: https://pastelink.net/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://pastelink.net
date: Sat, 15 Oct 2022 21:03:45 GMT
content-length: 34
vary: Origin
content-type: application/json

GET
H/1.1

200
OK

iu3 Show response
s.amazon-adsystem.com/ Frame 4A59
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_n-MediaNet_smrt_n-Outbrain
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_n-MediaNet_smrt_n-Outbrain&dcc=t

338 B
1 KB

310ms
309ms

Document
text/html

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_n-MediaNet_smrt_n-Outbrain&dcc=t

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

bf293c6ec64062426d963624d5727bf3ef92eb7c478399918c502635c0c69726

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 338
Content-Type: text/html;charset=ISO-8859-1
Date: Sat, 15 Oct 2022 21:03:46 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: WB10R56MWANACWX8ZVTE

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Sat, 15 Oct 2022 21:03:45 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_n-MediaNet_smrt_n-Outbrain&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 2EDQRBCS4P0R227RQFQN

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 517ms
174ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022101301.js?cb=31070374

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 15 Oct 2022 21:03:45 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
611 B 558ms
213ms XHR
application/json 13.251.228.157
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.251.228.157 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-251-228-157.ap-southeast-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 9de467698e6f01cefaf833467bb772c696f657197fc3c27255f2efade85bfba4

Request headers

Referer: https://pastelink.net/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:45 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://pastelink.net
cache-control: no-cache
x-server: 10.42.7.235
access-control-allow-credentials: true
content-length: 156
expires: 0

GET
H2 200 container.html Show response
2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E3C7 6 KB
3 KB 473ms
171ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022101301.js?cb=31070374

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 21:03:44 GMT
expires: Sun, 15 Oct 2023 21:03:44 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame AED6 6 KB
3 KB 444ms
171ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022101301.js?cb=31070374

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 21:03:44 GMT
expires: Sun, 15 Oct 2023 21:03:44 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame AED3 6 KB
3 KB 463ms
194ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022101301.js?cb=31070374

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 21:03:44 GMT
expires: Sun, 15 Oct 2023 21:03:44 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 467B 6 KB
3 KB 446ms
181ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022101301.js?cb=31070374

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 21:03:44 GMT
expires: Sun, 15 Oct 2023 21:03:44 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 6DD6 6 KB
3 KB 431ms
229ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022101301.js?cb=31070374

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 21:03:44 GMT
expires: Sun, 15 Oct 2023 21:03:44 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 4CC7 13 KB
5 KB 474ms
173ms Document
text/html 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 220143
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 07:54:42 GMT
expires: Fri, 13 Oct 2023 07:54:42 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame D22D 783 B
916 B 476ms
174ms Document
text/html 142.251.10.105
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.105 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f105.1e100.net

Software

GSE /

Resource Hash

4f93c0215e933b6cb432ac6fa32f7feaca61a7d967a577a05e0bcb3e6626a2a4

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-orhsjuvTt82R4aSSJ1ZyMw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-orhsjuvTt82R4aSSJ1ZyMw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 21:03:45 GMT
expires: Sat, 15 Oct 2022 21:03:45 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 container.html Show response
2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 6A2D 6 KB
3 KB 357ms
216ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022101301.js?cb=31070374

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 21:03:44 GMT
expires: Sun, 15 Oct 2023 21:03:44 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 4A1D 6 KB
3 KB 338ms
238ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022101301.js?cb=31070374

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 21:03:44 GMT
expires: Sun, 15 Oct 2023 21:03:44 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 2FC1 6 KB
3 KB 304ms
208ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022101301.js?cb=31070374

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 21:03:44 GMT
expires: Sun, 15 Oct 2023 21:03:44 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css
fonts.googleapis.com/ Frame E3C7 8 KB
991 B 476ms
176ms Stylesheet
text/css 74.125.24.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f95.1e100.net

Software

ESF /

Resource Hash

a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 15 Oct 2022 21:03:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 15 Oct 2022 19:52:29 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 15 Oct 2022 21:03:46 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/ Frame E3C7 2 KB
902 B 526ms
496ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 01:23:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70786
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 29 Oct 2022 01:23:59 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame E3C7 0
0 185ms
185ms Fetch
text/html 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CeNHtMCBLY4y0HYKlz7sP5pKD8AP88rOpbJvQhP_PEIjKluXzExABIIabpJABYKXAo4CkAaABjvDIngPIAQmpArwBYFxGzaQ-4AIAqAMByAPLBKoE6QFP0LKMv4tYjgCQMobJ8rOS1QfH_u9EFtQyvNMoQ9MaXiwSDIu03mzKcqi8jSapf8lOWGpYdK9MDgdpHmuEg1SRQW_KS-DcOS51DD5YqqXGnFPQH147KCiRLNCiELQnQb7Ja1iH7o1HS5i1c5m0Zgj3ekcMTREiox75FY12ywPbSEhGQ-EQJ_lxpBYhfi1MoiOIHaHTYq923tPnB8y9mBD4tW9xSaSsNqcDB-u4a4yx-fwq3F40OYkDH6cqz4LNl38o3EK4u1bbs3Utz4boqI3B_Lpt6S-54RRy29INx755OgiTE1ZYsHISLsAEo4DI4KIE4AQBkgUECAQYAZIFBAgFGASgBi6AB8KUmxaoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBCq_QbSCBAIiGEQARgdMgOKggE6AoBAgAoDyAsBmAz2n97mmwS4E4ME2BMO0BUBgBcBshceChwIABIUcHViLTk2MDI1MTk1MDI2MTgyNjIY-t58&sigh=s8GqPqzHmDg&uach_m=[UACH]&cid=CAQSPwDq26N9Behk7C6btv9J8sd9JNxampycyNmhrHg2L5Qcigse8mfm3R8E3sV1pmeHOvWFhGDX9jw1VXH6jMQ5fxgBIA4&template_id=515
Requested by: Host: pastelink.net
URL: https://pastelink.net/wwr50xs3
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f157.1e100.net
Software: /
Resource Hash

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/ Frame E3C7 23 KB
9 KB 238ms
210ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/abg_lite_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

733b81ca611521c0c5664701f060df9d5486014c1dba79acb22269bfc9e06d0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 01:23:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70786
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9578
x-xss-protection: 0
server: cafe
etag: 2674910403068493586
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 29 Oct 2022 01:23:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/ Frame E3C7 3 KB
1 KB 523ms
496ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/window_focus_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 23:43:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76809
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Oct 2022 23:43:36 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/ Frame E3C7 17 KB
7 KB 195ms
168ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

b7e54c08be2d3028420666e9aca9074537fb351e2ece4e32b925ffca1840ce12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 23:43:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76809
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7570
x-xss-protection: 0
server: cafe
etag: 17992891929817281641
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Oct 2022 23:43:36 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E3C7 152 KB
47 KB 173ms
172ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

18ffb82a05bcd7e430f57b9428d2a6990f127948e7ff14d66c3784a84f4330ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47415
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1665574756386403"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 15 Oct 2022 21:03:45 GMT

GET
H3 200 1d54d8cacad5994e062108e03542c880.js Show response
www.gstatic.com/mysidia/ Frame E3C7 33 KB
13 KB 859ms
518ms Script
text/javascript 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/1d54d8cacad5994e062108e03542c880.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f94.1e100.net

Software

sffe /

Resource Hash

39ea310e86ee5d4b745f48121268b8848ebbc92d2b9a1a791c36c7a03512b101

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 04:41:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 577342
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13786
x-xss-protection: 0
last-modified: Fri, 07 Oct 2022 06:02:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 07 Jan 2023 04:41:24 GMT

GET
H3 200 12477379706552569452
tpc.googlesyndication.com/simgad/ Frame E3C7 3 KB
3 KB 222ms
197ms Image
image/png 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12477379706552569452?w=100&h=100

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

02dc30d0a6224d227cb1a3988826a92d44d78cc0c53ce6ad1d092211e76aea9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 00:36:00 GMT
x-content-type-options: nosniff
age: 505665
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3372
x-xss-protection: 0
last-modified: Fri, 12 Nov 2021 02:49:47 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 10 Oct 2023 00:36:00 GMT

GET
DATA 200
OK truncated
/ Frame E3C7 336 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: be3b15b1e68cf3e9278293d3b50491fe16c985e0ee5968852cac4fc062a7134e

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C949 624 B
559 B 519ms
176ms Document
text/html 172.217.194.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKv65gIQstDN9AEYu7zx0wEwAQ&v=APEucNWJGWPc9ZM-p-_d6zZmcbWFQR-x3klw175_bjBut7QXNIDbQbNOzVjDHPkeIinr1sUqXpsyuDMTpiZRILnGODpcjDNq-A

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f157.1e100.net

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 21:03:46 GMT
expires: Sat, 15 Oct 2022 21:03:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame AED6 68 KB
30 KB 543ms
201ms Script
text/javascript 172.217.194.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BpUxHwPVp83Xiq5IB3crKDMTUl_aPltepf3JBhD98xVGdWI9GHOhp7enoJfvqP5G8hRU8MtK-FAO8q-EKiTb5HOuQd4A&cry=1&dbm_d=AKAmf-D8RNLsnmHx0QtQFhUB6Vv0M-ajWfwJoyU12SFggepMrejAFn1GuOTvn-BIJT5vAFxa4JZMNQa14YZgQbeurcYuIokz0yBb1H6zMQ-ahsZVjLnSZC-6dtdiZOEAYx8sdE4tlrpqWNoEdZfs-fJLtqL5UlbiEikHmjSUdQBWZcV2TpHIpDg0fcNIC18azQ0-Z-FxiXkoZHp17QQo0TRnkzNw8pw0k2eOCN6eCZi8Vk3SuCJSR9MpLwh21VCp_4fR5Hop3Z38NwTNl_1nhglaYvGmSHVMeOnlCVaPkls5C1qidB7RUo0TVtOx4hSucIFhCCxqvdVVgy9-P4d9SAXs_8G1e0nL65gLYLRe-Vw1wJI3Q8Mc7cJzYjIIIYBL3vlEqINMjKn9kmsvJEJGKwqFBqWEE8ePyOBAMUqpKyC4jsbSlnfIFmOKSgA9pIzRs6jw2OLfdzHD8mBiYdQqtckiK_go9qVRp6E2xGim5M8Grt1PevHzq_veQZRYK8UrTFpdpXj5HQF-Xk13Zo80GTCtozyIkjrtQzyzAhYigh-rVxpj0cNXGaqXXxsN7G3csgmqrUypvqfJxE9kvs2LophPOO1Gthcjq-lGnAA7nC1c7fpgsiFi6EdLpyjoF4K7m2U5m3RB__crI4oqr8333fW0arbnHgAu8ucrk9-3iF8wNuA15p_vFEKr6tyQMimpUDTpgVTE7jtt1QFzOsN9jVh-hik5dml1sBHeEonlVoKW3mqI9zcDhDAaD2HNKeVu0vWMtfBM4I9lNXk0hrYoBL48eDORcGyyYpbJp8X4twP8bEmXQy-k_7egiKjd-I6TZvbT4TV0w6lsIypR3T9L8QMNVDT_p8bFT0OfH0A823tQ4SKEzAvje1Jacwg-gBhviib7IzcXYu-2ELKyQT71zViahMklZQ2GeqZiFrFDH5HxezYX2eQ1BXj0mzpEA0s8JFQp4XNsVXfCFlKBzR9rKUGbgea5qJCWNA5fzS9DyC2eXTPZFyI8tJAeF4jNwIkZ1emTvw9jsccGgbc_IzuTagEsNiHUJdBmLJnD1ZuY8UCudczzvMhKQBWi6IeY0cP4HZExay6vbdVz91tfMjRixDiIrlB2BF7TY7KleofTVAuYGcecNQQhNGB4u3YruHadsHGDrlzoQzN2qX6AmQMotoNGnSewMYzUGcbXSPhIeA128kCeUarfVz6Mk4iFvG_yCE6k64dFF4GM_p94ggVaRnj_IqAY7x8VKZD9qW7vpLwVH0o_svZGZMKQ2KPq2CLUIoAmaGuY4YMXxuxPSfDL2-3UwF9q64CCvTcOQXE26EkSI_JETk-Fyy-qPAhJ9pchUAs4EviPjrCQRfNDqEO9LBPFHzuI0tkb0kXx6OkVX4M9olhPB1D5_cR3cUSfrknhGO5TfoqFuEpYFauH0PkfHge49Wj8vdm-yOnxTFCyp_VIgh2zmyOntMvCTmzSdQ1NtDwFryAQRPdfR1PrXrCkqF7fOi3RpQgpojA1sZhnDs-GDAJAU2lLssYdLpxvWLBwTRDDsTJE0kDoy524A1nKCFbiwrrwHyY8ntn1_EI2CxUwUCcVUYn0wLvXbcE0Cn9I3Xwv1G3x1vPANW8EKFUMCl-cv00HIyEtg_hX9Zv7u4-y7dPAbJW5VeA0o6lHI7hkLgGdLCT2ANFfZwaJhV9n73G1YmylMKcaKxP2IpU2rjuEIp7fWbfXdw5A-YrUVKwfN2TEl8-o0BjVt1ZXjElsE6Bg9rUeIqac0hEyn_sEkhuhIPB-toZXOzJV5qpjo9bpEeVfe8rMNeCFrvSj3Stp5TfnV5N6TOGn9mnhs5bL0RxR-ul9928PYtFwHbx89RWvEQWtRp1KVtg_aYTaIWS2rQH02Q9WsSvf_vvJ8Z08_tzwLNK-1HZ9NBG3e4_-mq8ZR-lSjOzejdUVe-2e75cUv0Sof5cmGCZZEW4VwEFgv55beuCqYQ0EaqYaxEqV2On4B2HXtVY0wmH7NJLiIxEyQaasRf_z-1FkFJOiLHpclGsvbXZshw-u8XHsyAnxY9FOJMm7iVuAh8Bx1i61hthV9xbn6uIUSteHEpLZwFa0ODS9YgNFPEFA-zMVGI0xWP2tBPR-Rd5qxeuWxIuW3NWH_qK011Nb_nA4EDDjnA3AgeSoytNQtJFsysQE3wbcosW8OeszH7TZVYJes9CgXlBnryx71ngCe4q9JBaoTiT6-WAhftysslYyykAl33Vyp_LkhZmSNhF-CKYDh3DIhAJsbg0IXDLQMVbO9yXwS5UZHh99-gXjrmkDj-zLbqhwQ84e4kiB5V1N0yjA5bAtJ4GL15Aj9XHk0wWfitAnJ1WX8GwrGyc2PKd6H_cUYFsumAfTDfZOb6WB7OFKxIo5qqPEaY06zS3nRc8DYe8igvH3NIpHWf2AMNezP9sn0BpUylVB1uaQRo7NVWrtaJeqVV6JBpHXJVCIeADIHq0vUzDTBSnbaVZ30jqn_IfPV8RnRmZWfhdQF-6xKeUb57N_xsCb-Z-m74mgQxZ0I6gJUOULfjSJ5-ZRF1CU-M6Dp3R_z-Nd__6NgSaq-zx7agD6MgdgLyXaiJeVpDPxoO3rC4FaStpQn2Dtqk9qolr2TCbkPtcv4Xxd3a5xVfpOL7h41Z0SFfYknr3nMXfrkJFd-12yMJTFCTs22XnpxtEjBvpxKtOINSMJxBk6__wR7lXoPi7MtmrMu1fRqechuKfTM8BcXqORrEf2SFq839JJYK0M3QkRVER0rmzpzbjdu3c0IyoavWeVSy7TSVFr7TbYqXg25KSDx50eUV0eTaHOSdT6zhCuNwArJiizXFQ8m76wejv8nv3Yb2IagbNEB_V4gY_-F3qjADrN8cvofMMJg8EI2V3FaJKlatAP14sNDtkbEkd2L1R-YZw1GXQ0ZS3SfuDp27WKj_X-Q5C7eN0h_F-4_q4SckIpXygD_MJNTHWm2awvKt9f4D8kxINs6OmVVrmcu06YrLu2chOQL3eCSYwQ8SIt6QLAztNFATJJjsl4IK9ZjlhHviTHmYUd9AQofVi74mE67g3TNpWylT80-KD5yVIWoKVWRtjqGPmN0EThpvY_2V3cs32DP7pWR7-T7xNLmACdNGQ6D61NfXr1tka81ewBKFngKjkMEB8ZtoZ3MZvM-CYF-8n68KSNHnX4SveVrZgb5NCwjYn8iAmVh8xL8fSab_y5_d_N_H1szEG8qu_a70Lt40RT3Jt9rF4X-seajPCJVh4QK3QToIw1atmwPxKSKrBOIQREBZ5dqQxtdZZHluVbujq26tcSaoXKD3JOpDnPv78vhdYZJGPGaNYzdPMARqdAYLzBCPMq&cid=CAQSPwDq26N9Behk7C6btv9J8sd9JNxampycyNmhrHg2L5Qcigse8mfm3R8E3sV1pmeHOvWFhGDX9jw1VXH6jMQ5fxgBIA4&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f157.1e100.net

Software

cafe /

Resource Hash

b388e642374740ae32a6fbc88dc2708c26e810443b2d9b2bd6974a0b43cfd04e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:46 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30778
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame AED6 42 B
63 B 173ms
172ms Image
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BF0bZbG5CrZcDlBKpxobY-JL298LDDrlOsblKWV-lcwBFbgXCDw9t4t6-K5J75J9RdjVE_hZIDEZAxprOsYgN_VFuA-o-pPyyX8TWxZnbolFPlHAo

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/ Frame AED6 3 KB
1 KB 497ms
496ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/window_focus_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 23:43:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76809
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Oct 2022 23:43:36 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/ Frame AED6 17 KB
7 KB 243ms
242ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

b7e54c08be2d3028420666e9aca9074537fb351e2ece4e32b925ffca1840ce12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 23:43:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76809
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7570
x-xss-protection: 0
server: cafe
etag: 17992891929817281641
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Oct 2022 23:43:36 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame AED6 0
0 218ms
217ms Image
text/html 142.251.10.105
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSqRSCd6kSH2LpcoWiz3N12OyFNSzAPIc5Z-RbCniw37cdsipPy1n7tUxyxJiWbOMuYrTp-DiSgxQ2ddN_O7daabiSkzQ
Requested by: Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f105.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AED6 152 KB
46 KB 188ms
187ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

18ffb82a05bcd7e430f57b9428d2a6990f127948e7ff14d66c3784a84f4330ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47415
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1665574756386403"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 15 Oct 2022 21:03:45 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C0FE 624 B
976 B 497ms
174ms Document
text/html 172.217.194.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNj9GhDb1sYBGJGqvNQBMAE&v=APEucNVb3ccp42Ta0kUA1sgY11L9DN97BWjSNj-YZgL8Qi_aDZ1glVCY1q0C1M456V63h-kURg1CwvUuoliVWyO1t6ZEGt6pxg

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f157.1e100.net

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 21:03:46 GMT
expires: Sat, 15 Oct 2022 21:03:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 137E 80 KB
34 KB 714ms
391ms Script
text/javascript 172.217.194.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BJkFGeXIRf2PDmBJQuJ172CP5gJ6xBTpMV-mJlZIjkdx2PVac__TVbXGZl2b3-gomo1DQezOJwvrF_DVJQqIK3gVuLBA&cry=1&dbm_d=AKAmf-DQEd3cxsAwCswDa7MtjdaPyWb2XcYlNFpWsBV3gV0bHaVQmxdBvP6seWsRr2Bj7LF4I7jyY-EqaiBNjhjL36LsfNTKO0COfWyawcZHyK3ewN130VRPGfh_dgJRlwXdZ7_hSXNLns15_v44nlSrWeXVKKrR0YY4xMyphY1H2SWM_6Ne-yzG5gEor9TzrRNxopE0oqyQs3sQVugFIM8GHOSboEX8Yfq6SdvsV4Hvm-FldtlkGNxvsUXj7RzXaGzLozNlJP2-W-aWx-YiFM8TlXtoRYwQbqHzNRL5Wz6bS0z5G8JwTFUY-uArF8wk7ZXe7iW72DM7u-FG6WTS5jzV1X69LksTf3y2AiSy5DKhPg5udvnxHZDlVMMIYEMLFUJiBgWuIiEbzdsypVPJnFPfxkxeQUKT20xbe4j8zu-6z2SLp68ZYJRjZXCP7E4CyQBA6cqeIvBhxTXwIaZ8ezVr6PAQPbE1Gj81CH4ZGNUkh2m5IkGI2MzLqUZoLyiVCbDm9adsVSi56LAMOBFvapU1iml0g-dTZukdXMqCLYhJ1sQfXCjQuVIOq9aevngOF6T5mUzS2sxrc3FXr9SB5rHlwDfH8XXWA3mvDlLm7bkbpqX-LhBGVEbJ64Og2fK-NtjFuvXF1FdWwQHKsu-sks6u5p412BZnVuy9ljgNXzh1a00hc_xNUg-EAhoREVybi8Iqm5jsC47lqwU6qsXvx4gqAeW2UkwvRqvCYFk6z3Fr70b0ogva6FrunmSNpxHGe9Za_lq15QFcI6ayhO901VRiQHaHNj1l6FrXj8ByhlyV6PkFeY3SIXCwfiBHi9r7f3OsqQUn8wNklk3WCopIv34_zWrVGVTS25fuZTpV_jjdrs876SW0K7LbDyCdipGSyFaa_PcweitPBCo2R6fvpxTDhysM4OKr43KgIcJ7xqd6xTHkvet6Uq3fTl40vcc_t6pHRMUTl3EIRPZWUuxbg2FUow5TdZdph80yhD0jnbCseRe_fNFTAUd8L3jFd5_ahIPMb26w_OHqadyx4m7XbS54aa0YlD7zCFqA-cyDYcDBUgiBb0UD9UsyKU342iL3oBvc5fa6OLiEF_hKYIUUXNPjblQCFIhwtruB8wFk0kM98k7oVGgEjWS0HLLURwdUkzScj9KOif-9bc16kwHRZ2DXxgMvunfEDW3G91693ywACCmIZN0044ahqGCT92pp1qwhKIZ6UMUwwyJSxpBBsclpltoNdotMmrA81jICTgslRIcF98ZQi8xP2AyfAu-jf4XnArg6DD5fZbpIkeanX_Rin3K_TtA1rsBHIV1z4eyLS711V208e0v6-v-61f_TPndiW9knOjQX857-3xk8C7ylCeE3qbjpDK5cvgqdYcKY8MrqJowAgzpVkY_DLJcFB4SaKAlG_Qmo6MNc4H1c2lCEQp2QJ1-XtwuMRo-YH0hVjhHqtSav_dwuCaj0bZv3RbNO3WAOkpfveCM06o8w3MyKwxZ_bx2G57wDV8R5BWHIdKb71eh_EJ25AKuZJpWbFsjSsu0kpEn0zaiaaUiVzhOKwwH9hdu-VYECncnIb_Cm6GpZgPGr9aXos1wdwLfORhw8ubGg5PAF6jQUjIxmhzmRKV_aHoOemBoKXFMctTHcbd7NvQ4eZbPrahCebjL7DT1Q0ie7RfRgWKsFL6mWIbc3ic-tQo9oU0bkKd-verRQ2LbQ2yK28txeTN19DCiP5QAJ1aGwFQcHFLnsgJwsu2F0hyseEyTkQE9zfg6Yk76vu7vHzecs6ltkTcMrFdpK88Zg-v3HRxVX6gP5Cd7Zl83x7vxuvGxZazDqyiH8sGGyZo0oCxPLZjhv1zce4y9gtHK0qO-S4AESDyOXDRVKDuPc6xFX3hT1zGJ8_wNDRHr4mN8hBx0D19tZsLL59x3X8a_sCTIJbv6NUbYX-xM26tBtAQ20RpAPo-dPsSfSZkdtpV4rPZ8Tj7Ml9ArlleRA3jl40LajAiVkh4T6IV1MVm3AepD6DjzS0dZDqJWRqDu7-51WACf4aOghNgjvPRtfiEFbdlq-1BwzzR98-eBxDcuet1-FRcR1saqkWC8LgA6QRqRSB2fxfbmBDn1fdXDck8ZAe3qJjXOT_xbG2KFktxGuJ1JS4wjw2quDphjB3XTSUld6tjeb4jzrTzNGjHjYGec42zA_-UfyRWMDvAWQFLf3DPsjA_RCvSaqhvTxxXkLna5CLJlZuH2okgnRN3asFksYjGcNQlYcCMLkLyKRmEUJLTY1eVTYeo3lt4PCZFmh29_gQ_llpGRnqPV4f85Q5UlJpnbIm0dT_d9Db9_Sjd5V19yzR5wBitzEB3LhSdCHVPingNy-ll4av9elvaDxh3HLAzWbymIGfb92EvGUdqeZujRriLxsI6xIZG1Vvvb9Yj0ZpkyAVT8XmdghcWnjga4GFmpkwimRaQ-_NZOXJ4yFI2islZGqilpeNoqyDI5q5FRyDQ0s8p_RtU5nLNDCqCoVZ1R0Ogt_tWZzxZisTXwglLJMfQ1-_nWQbYvMnuehhHKdMNkts04rKcCkhIf1iMcykvTI13S6wsY_dRM16hxnoPOxrAvHG65PhmLhFBcus3SW8d3oxvJ3ni58DdRTZnVFBFNaK-cy8MM81c8TTxIR0N27SOkCNSVLYd2MBor4rpgyfMwoe9ehn4LwKJIziVjf0l3FqMSDP1jPMTqUfwkWvYnH9JWR-MUJArsFX_2j3hsUWhW5KASsHR-NWHUXlglJobEvnPO88g0q2iiZCfP8k6aFGfMCUBeHMrbLyG7nq_8k6-CYrQdxh83xOcbALyjIodlnhcuyE14rM0ftfjrTBIvUBMt1F1CCtLbdSz2elJTtMbXdXnlhi9JEelvNu_kGxeQDSPv2BWofr6t6yuX6mjfjU8fDh91iHNCiFe6IhVQjscags3-xasV2MPhxjxjgb_hCfKQVPeW8Mu5jGKSJWr4MgFvxzqlq8FZEaO1LGPCeTQK38waVjNFq5d9i9674y_SjoMN9fo48WT870zBnwKbcD5Vzeezegh-K81zJISHJUPmep2mBrQEr0UjBrL6egO0Xmv_aGQ8yLnTjEI8ME3Poe2aEqgDUAqmE1ozknTtX8ga8MEDZZvZI0RtwR0q34fwm19MeFp-mkL8_mSgGzie3LfH4cyHZaIKEPoLn2F846nW3TQXnSzEfqIAonI6s4Hdv8GRW8vTKx1HRwzfIfMHhdL4Or_K8Vc803tkERYdHIGTgJDr45WQCpuWDga_7-7BMdoDU&cid=CAQSPwDq26N9Behk7C6btv9J8sd9JNxampycyNmhrHg2L5Qcigse8mfm3R8E3sV1pmeHOvWFhGDX9jw1VXH6jMQ5fxgBIA4&rfl=2%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f157.1e100.net

Software

cafe /

Resource Hash

b09446027180b67167594e89d0330395fb4f31e09db5cd0a7c94bea6ce34a7e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:46 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34287
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/ Frame 137E 3 KB
1 KB 479ms
477ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/window_focus_fy2021.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 23:43:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76809
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Oct 2022 23:43:36 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/ Frame 137E 17 KB
7 KB 252ms
250ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

b7e54c08be2d3028420666e9aca9074537fb351e2ece4e32b925ffca1840ce12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 23:43:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76809
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7570
x-xss-protection: 0
server: cafe
etag: 17992891929817281641
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Oct 2022 23:43:36 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 137E 0
0 239ms
238ms Image
text/html 142.251.10.105
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTH2t7u7YqGSRb_IqinysdnOLCEnRhMiq0g6ie8PE_v40imFpogCN4ZNR43wzRboxmLLVzqRGlBhFsygxN9avTSdCbVTA
Requested by: Host: pastelink.net
URL: https://pastelink.net/wwr50xs3
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f105.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 137E 152 KB
46 KB 214ms
212ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

18ffb82a05bcd7e430f57b9428d2a6990f127948e7ff14d66c3784a84f4330ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47415
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1665574756386403"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 15 Oct 2022 21:03:45 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 137E 42 B
63 B 173ms
171ms Image
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DbFEvEi0dn17BJZSlsJTa8iUIBKgspvIFJNezdLQ0xYaPZ7gq2b9veu6n13cEPDJelp509Bll2Wx68zyFHFZ-thMUXsYcot6QG0twlqbYxcB6ZXXw

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 88C6 624 B
559 B 814ms
510ms Document
text/html 172.217.194.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKv65gIQstDN9AEYu7zx0wEwAQ&v=APEucNWy0hTV3j61PhnIwg3ZzpGh5jjhvF3U0aab0xd6zQwRBlRWYJqJJNwzmMzZaX1JbGRLsWyRsIZ4S0eYwXt5QllZmh1qtA

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f157.1e100.net

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 21:03:46 GMT
expires: Sat, 15 Oct 2022 21:03:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame AED3 68 KB
30 KB 836ms
533ms Script
text/javascript 172.217.194.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BdFMX3ZQ5LADfqwSPmqeXRsBhs2CwvtH4TF7BR4zPJO2PDdjvi9TNP1xiOabYl4ZnPRuq-ktUB3TPFsEpk6ydAVMhd2A&cry=1&dbm_d=AKAmf-A3iALSqAs_-anxzXJIivJNnJ1M3kSCB2N7UQ2vBj1UktdWj5sKgbl3FLvFmtPizRq-Y0m4MIwoLls1LQLA1mX7yGynVwHNdNVSBiXI1Z-N2GF6IpFtiRbsdH1uBlNpXwRwJAsO_vRtxGz39iOeHFv43Kk3xgkrUOi586lwh9Ac9LsZfHblIjpwea66gTrY1ThFFZlMJgl4ue3QWD3hFPDjYEge_cRqgA_TBL22HCfF9HMQ5V5mtpeEUU_-WuBOVTD97cKReIodRxEHobmFs923yMrbk0L6yTbCdC5NeH7iM49CQH3XZj6MnuttZXeV24lGz6t2r9b-HbsAtX6jUVNAGiLVRNzO7Fxq7TF_IKYlBbuIeQ32hoIloh75eTbTIWyp542v7gEqo_eNFrcoeFdD_ZOTBOFXa7P4JNK6FX0mJxv2qV5NUqqQIIYU4hfh4nDtuEfqnLJfkeczqC9uWDMXeNYVLz0vwn6tagWbDHB1U0Ws4ezbSRw7TrC-aRB78gmROl26_St4VXbWU3qi4Rh3SKs5PATWHTAjR1qTrALir-VzS13jw1A0NkJpb4RYhQ-Ous7rOLhF4l4E2QgjMuzU_3ZdKEBglVxzmvtG2uN23cHwdwtW8lNu1QvNxyN4xDU-mh5sqIn1Hl4goq6Nq7sEUPUnmfFMUbW6gWMEnEysjsiNCEee9Qj8aoNn79pQroz5DCN9kuXQrVNr9w_vqWClN4_Ep_Oc9VVadu_dtbTFkegmrhXKcclDWgjTwAoBePAZY2fD0sb6Usnnb8k2rIFojYtsR79mZ399PhPzCL70xOZAhnyDmZKtHvKy3vyew4SVhcH13NkNmFJJa0PpEwg7Fn1CWP-knLF6C3urZMEnoE6CfR1usKS0pAjxXZI_x28hVY-NJ29Jz2sYQYPavaHUflkw9jsMfb0cEfTNcBxpxwl_xasWP31N_TbsQdv-mcuboLRoaq-l2pN-29a0GOld4lkOcxUp2Kz2hAzCC0w0NZOnfmdfPFx4kkpR8P20SMz5Nx2jkbCeC2TV1SWU-v98AVZxiihx1kX9B5QjfYEKG-kDH_YoS8iK5IagzOP-OL0uiOHCLKqLX4m8bZx9zvc85dYCjfRh8g68zx90lag0I7NVIw1YcdTeRghr6UtVUr5XrwkQtCI8R9OQD9mhmC7j-v-jVwKsgWJEdNJVFqO6YSgj7tBtuQ2CAN2MDasw7mos8rkOj4zkCax2TdYseoa59coaBz3nAyWIl9J6kGOsTVyXkj3eOC8EtaBhj6W4YQihdZa_QNUy1mg4N9gnDTaJoMea9GgQKcXUBS4Hxy1A13lt8OaefbUa6tbwboxvK_ib6k-TWC6cpC2ZFml48k6QVnGH5YlZ594ZxOdSwiYP6HL5xYUXzzJLDm2qhGJZ7iOohe-QZF20ys2GHCYMu0Sge-rQuL-rKPK2LSlAqWaB3gu_Uac-RT3w095D6-o6YGlmyWzibGGJH0GlOKWgG_avJmz-3ZlwV885Yg-tYBVoK47resTE4kVhaCEsnKg1iMvJBsgCo-gWxVULUoJGXyhVCT7e1NPu2eNLaL4fBeLwiqMO2gBkON7uOS1VkEK4NZeIh4wOqwElvX3HgQ-zAE223W_ecxureep47ISfGCPk4zCRj8CrHLyqwEphBkBYI8QMMYqb7YDdGj61-BoVdq1zAlqqpuoetNCAjynXqs3UNHFYfAhWkiw4czjrkKM607Xjn0l217iuM_sEuPR_hrC5UpZIa67M9gVfh_zyXJDFRrnJNRSwtaWxo-U3mvGVlvSGjlgBMQn85ZwAL5TI-4QvAH-ki1o7eRV2mCS0dVZZYkvZlBxP1iEbqWkzwVL6PRDx8E25BbyPKwM_MFz4U1TWrEFOlT3vNaJ_YHH36ts8HS0u31Rys4sJfve3LALPwn4twB44-3vtZj10MfJiCCep1sFygwjimGgG9d9xjuxnhoTfZM__PirNpLRBc4uGcBbypX01cDcXfsAIBGrygoDqCh-QnN9NsqOOex-mpV3IiI5ZIY6v3-Fdj3zZdOqFVONTXKywd3fxEQRioh_j5ACcg6q7QsTan-hF-i_OhoQy6YcPSFrN1C61IfmD1Y6Aj6KkTakMyJDizejAI3juyQiEuEluNPvcBDeq-okpEtqLOPkzny_EccXFdH1OsQ24zqrLI7G6iXmBhHPKc5mntIf-gkexNcuLoounqGRtnvsvW39uNw5OAtyKxdDY8SB4aY8FLKjXGMILjPTVuV3L15wkBtXH1pBNKW2LfKNoMsFmcNmeNIp5zsOouiridprS7kohL9o9S3lSHn7WxvcOIHdQDxdTZZvjYbjLdP4eWj4QHF1ZH97P0-CpOdNAcUsDhOVZtXdHSr8x4rAc8zgTsroBcr4j-gUWZqVvEkBqwLKqm4nVmP4bovTyhvKr7kXkL5S3SG_E--_aXpP-wImngzYcqCDUpf19HW7Zjs2nn5UhZm2DlDvkIxABHHtC5qtt3DP7cRbhezqH1xLGZFh3qBwPuxUvMS4ceKpX_gVaBB-GzGZMjvufLNmmEaUJtBGIpudivNG8yKGek5TDae5Yzqs1YRB5a9DodZi9uRVUhJS99sx6_S_GerUWxZ-t0sJ_efqUFUuHDQeOGW2sOEuYOEt9jyzv05LVylNJ3xKoQhn9lhsREBw-QnlCKLBvH54M1iypstRT7oD6DvE9Wvf5QR5hm0O8CN9RgCCqwprgzB1ZwbiJM1DVFna7U6GBKPsX0mqn6aZ2RC6JxOp91LyTNn5z0R4t7yGoEiI6W6K4Jfih03nA-JxIa_fHUya7BTx9MQ1NGrSE8emu1nJvaJGD1oyJx8_O8B2iEf4L7mIKnblc294Ru9EZSkiRj1W56EG4i98KiH8xMjBaHXF6fOqgkZVsIJkEF8z6wGy1PHi_ifTXowT3x4rbLjGAEQLdz9RLoMagpDLtVEL7QvbClxC92eKTYsL_XfliBNbBhBX5C3xP42dlt7Hm4sTAxx14Ne92WTs7n1CS--A7llt2TxBX3uzgOHMCGa22WCVtSJcQgNaXKIW7asE4SFujYogb1vFS1IQTAMVa4LfyOusOlH9xD3ihacjtBZJYmdxWT-jS97m_5F_I1GnyTGJcyQ4T8-0nZKi0ETJeK3rEOwXYKOAeemiIkKSLGvkmr3JXfocUC4yA_OXKHPmywtkB96L0jzHl7c-FzdLH9tPDM6XZ9ub7naqjGIWO4cHq6MlE-TCS6sqWG-MfCO5in-ctYqNjyaMPu2EwHT6xEb2K_FyG9nKxtxVBNw9TYgbhecuEZnMH7T3wCja3aobtubv0a4uRPWg07wZLvs10&cid=CAQSPwDq26N9Behk7C6btv9J8sd9JNxampycyNmhrHg2L5Qcigse8mfm3R8E3sV1pmeHOvWFhGDX9jw1VXH6jMQ5fxgBIA4&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f157.1e100.net

Software

cafe /

Resource Hash

a84d94b0dcd047bad60cb8d5b672102121205720bab6b0a429832b5cef59356e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:46 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30846
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame AED3 42 B
63 B 173ms
171ms Image
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Dr5P78k-aRSC8LOz14QeAedGILNN5sw21GrG5Puf33JzJe4RQbSm5bafN621W1cQZGAKgh-7vWKnMHaG6Z3hiLfFSuhlFLHsMgceXcpRCm0FLKdkQ

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/ Frame AED3 3 KB
1 KB 483ms
482ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/window_focus_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 23:43:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76809
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Oct 2022 23:43:36 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/ Frame AED3 17 KB
7 KB 250ms
249ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

b7e54c08be2d3028420666e9aca9074537fb351e2ece4e32b925ffca1840ce12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 23:43:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76809
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7570
x-xss-protection: 0
server: cafe
etag: 17992891929817281641
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Oct 2022 23:43:36 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame AED3 0
0 230ms
229ms Image
text/html 142.251.10.105
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSOLnqocGyqx7SRIOGnXqv_iN5Os5Q4j1pshsvF8hgmjfCTHK9VCoZedZStqryq-DuNeDQEk2xuFf7eR6223Dcz0kU3ww
Requested by: Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f105.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AED3 152 KB
46 KB 239ms
238ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

18ffb82a05bcd7e430f57b9428d2a6990f127948e7ff14d66c3784a84f4330ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47415
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1665574756386403"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 15 Oct 2022 21:03:45 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 2813 624 B
560 B 765ms
507ms Document
text/html 172.217.194.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQi4Dw4AIYwauCvQEwAQ&v=APEucNXTbTPrNwmCo4iLnVpiFdcD99yg2u8d0yjRePEGbsDm77OfvRW2WO25PIbSwpgYmf3H7xXmU_GFyiagyG7aTgrOpiy9TA

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f157.1e100.net

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 21:03:46 GMT
expires: Sat, 15 Oct 2022 21:03:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2FC1 15 KB
11 KB 769ms
511ms Script
text/javascript 172.217.194.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D13fsxc_dslYp6h5qYYyS3kk1qmqx10FvBKmptVT1dVyi_IXRfQoQp2hO3qHSMIY8oywJhheeJRUHJXxkSVbUACoUow7juX1TxKmn-3bB2vI9YTS0j9bOsBk8BIZyBy7Z2wiyllTQj7l-JG7PT3A16O8JOFjVM3QFUDZzc91z9b-VdHkU&cry=1&dbm_d=AKAmf-B-fp_GuCMoxWtXHqY6o2s8fy3ns7K5GqDtXlmtbqVzjeARpxR2xNLV1etkZSXfd6KotfaAoTFSIBZoCq54b2DiNUIL2TrlUvcLiK9KrlIPMEF1KbDsHRFB68zV5-n00I00eN7hQjEGleocw0H96JQwolesCIcBp_OeENCR4PZOFPhDd2gSV-vSMcB-bnReaLHi_pXNeNO_nJIDbCqpM2cfblYd27XCe9ZJ7r71xMqCFYBmOmE146GFp-2y9XBpdaCxz7dU_Q0yefs7As_xPWhGocfkwzdSTDYG-XQUtQRqvC8ATMyUOnSV9IjdxUEltGLaADqYWsSTwLxT2k_WnR170DyvaSRQ3Ve-03HEJNHZ-B2dCs6-dmaYsf1jb_37YTVaWuG_7wS4t4iSbHa_iO8WzUNOfOeYcVoh4_L8O8fZFCLFdkvjA2i-YsAlf2Tu5s164WULG3CoIpOLpkm5C4onGWlag0gMmdNDffvDB3K6wgZvlQViY0DWwEow_8qKR6n19SNp7NJheZAVyzQSwLfsGrT4TcAEWjgwqhU4K5pZaE9xcJ6pCuNBi0IIgUddQTl51GAcP-KCaamaVbZGveldvvV-k-17SwkweRS-c7dfULEIBrByASpyPNmD4IRblTUOIXnNFnAgOayP5QaFVgPJmxD6ejAUElhKOKSkXV4chXr0aZRFqiAfuDiGVI0AfB6xsxY3vogd9LAJhoh1pmdUJ-uQwGQJ0wKy7cWNun6yDr9IW9LmqCYH0tnzgDWElwExaLlu4q_KlJshoW2YODlGVQ7Cq4X0nskxFscCs2mHmeaKy8UUOa8LEoqFqpCAnld-y8KSTAWD3sqo8gUyMVvfslkSv-b9rKZ9oIXfyBmD_8H7brUl9b_NB-BVA_qTsKOh6tEeSfHtC7rPXvPGQz92F2pwjGkliJoS2NekjDOOzEN0ax3FsHcjmMP6XZHdOEri3ORwpX-7TDH1VFmS40kUYXikZGhrEgQrHqXfiQ3UyFIcRYgnMpF6Y_AyHz_mtFpSWPN8326m7287Fgin81mul7ek2_lnDNeLoAx3VWdbDzITBP7kBpmIyABXKmj--dYdLnaV8ER3rluI8rgomO1-kO9HuH70_7RGsNP76iAvm9RNfcPvkUJ5THhLUSINlupH2c8oGn4HCv6MfXZS-YNUPp5WImrKJgoOUkLBAPBKqLdMJH-VdclEfOqckPkjdSOvGfwkPrxgJCSbWvo1zsbPDtTsZWprqfRc9AuSEQf6AMF4PS1hcFn070LZlUyQHMFlSODv8nkhxUYnX0mmAi9Gwv5KLQ1rineqF-3QiwOhpDQ86-oul7xPqX98bWIX6PvGpDULisEVkClpb9tQ9KEXDbFnZwkyD4KJvj43UwMXoUR7RPEwE8oNleoNf_W2-ZdP0nzL8En6XoF-chgk-AtSjhLVAsKvyB0dEp2bgh05Ae8N7QVzZddS2Ytbmzs3eaqxJ0Li4nByLGo_3s-28qynK_PbxMj359vLZIe_oTVXOj6CfGnXHsPr1wtqru7Ym4zt3cto_mgVP4GVM764o7XDmtNdkk-igWN5hY8nxEsI-AvD8gq38-AKfY1MDiLGwnlrh6RVLxFS7ppljC630ltZRfb1mG9dlSD5U6LWjpZsvCu4x4eOVCZMdt-OFm8exdRhhWdosvKZbFyEVqSxbZDvYnVTt7f0qTl0Y67OVVjgOouZ-PYwK7o1xcWKXQv1kUpIETZV66fgAA6Wenw8JEiDwzVLlebdvVXwZWTSKiDl_1r9L__mMo1ODMcLNPsi4lJYQU7GjU0diu3zKGutW6dlt38i-HyqMH2H5CMt0AS30ykGUEW_oMTk7zhFPJ4lb88NKVGy4QlvXwRvwxdGWzMcj5pmnG_Jp9MPkDqYKB88a8-uRNs1HpV6xS3IDBSVd5DULVdGV5ueJy9gfUeGX5LJG1gnpWXEzgCPTlrn8MeZlktUDWLoIxCsKsEa1ykX8ZCe-a2qfX5o48bgJF9l6a2opt0Loh1NIjVVWGFOv7ksLxAFOasrUcY4idkOfzaEZgceVgWdHLSqDXFN0V7oqGeD8JXNiJOeMwovPakzO1WNE4-c_hzcnu4Ea00qdzKgLxb3ol0fm9SJ-3bX6QVgBcCU_NqLVf2TADonnVVhLXTfJaS3O9lHPhVx-M7iyr0oBoJlnGTlxjKvF3hc1TC7AZrUeDjSL4hZXusNWl9PYmsagRTt30fsT-jw2K_LqJ7fMDZRFzgLg0y402WIMG43g5FBK60e7ViMjljc0l84trvMlHXKSxxwLlLOqSvYCD4J4-9B90Qfcc8D5TXCMIK6eHN_TJfhboAPrcZtXSgcrHSyImPOoS553Bkdn-stU5nWAkcgU43FcuncHtQgyApmcs6DT4jxnQyvD7CGNLsO141SvW8CW1y5d62f2yvYSW_dm6WTsH0bpNdxI4UAqBljR4X6SkmLU9I0F4RmuxtyBCGk1s3qZ-aVGDp0A2mqVnEr2KiYeuqfDURgsh4rjCkOlRMdqRmwSij7imEJ7SrZNKK2jgl7xGB7Avd2wQyeH8nK6zmjOVJc8T1lybrh1g8vCBxFYql-i3pUMva116LAYqSyChFFPZ156rIaj3dUY9Dnxmpz4fgOAiLWnJju3GgQeMO7S6Ty_6o0dOB_3cuNIpBAqNZVkOf2e5oaSAlmlHESXDtO4c2bx9p65XOgQ0BX8UqMG5u1Z1tHaVnEvFHVuVU_22ZSNERlZlS1-CzMqiXuHevRlkmYOnP26dJHQkgIYUY9a_QakpTo9JqaGdj7s1M5W3E7j-a6nv7flBQDtfYKojQynVkPAX6QyRajZjfeAfgFYgqb3qm-fuEtXzuME6UpRaete8IubxAZCyixLMaywk5fkGeawZaUVGXyP92n1WPbfkyXpoM_rI5DEmp3ZPKdB8iMSv0SfG2L6mmBQlm9lK4kz0bMdlyXlyv3jI2GbCnSSa4GLGHGKMvhvRD0nJwAksmbD9aqalaihD2RcrhRyuPqyO4U5O0roqlSh7jp-5Fs814CpQHp7Jfb13iLJ10EcHBGmNC5Ute7ghr5ZLBkDkC9Z0OyeXlRckzYyIKn1Y_sF9ESCT0BUFvbldJqTFEKbPMhlksjMviCDw7KH5o1phsftvPXcyINkrJE4t8qzvkACW1c9XdMmymRAGTXc-FXYzwdBGmbSR36UiU1YpWqj4bV543b__4tjduIOc2sbxI4SUqZRpUOqmxMzNj7ejeUNB9dhSb0DpiLJUvSW6-HdaYUEwUnAAgYTWg3M0ODDeG56id4xlXGbC5i-iIOBPtv0Z0HZSOGGlnYxkNFLmIhO6ninZpj&cid=CAQSPwDq26N9Behk7C6btv9J8sd9JNxampycyNmhrHg2L5Qcigse8mfm3R8E3sV1pmeHOvWFhGDX9jw1VXH6jMQ5fxgBIA4&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f157.1e100.net

Software

cafe /

Resource Hash

cb7a3056d385c2fe63ac184dba2b7a8ba742f6807c5186cd4ff26baa39307872

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:46 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11374
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2FC1 42 B
63 B 173ms
171ms Image
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Brd5KmDQotHNZkenh7w90V4nJT6SDc7h9K5K155rEPtzhaOEzVlvxfPDKwdq3mu-VhndPpXhmAvhmq7v4MOiMHWogCI2xFbXczQ9Bki3EM-7uX8RQ

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ Frame 2FC1 2 KB
1 KB 528ms
170ms Script
application/javascript 23.36.254.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=1828362&cmp=115751&plc=4166890&sid=18330&dvregion=0&unit=160x600&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&prr=1&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0gMAbPlYc8NvEzL0hZ18-hA&DVP_DBM_1=3060631&DVP_DBM_2=24867964&DVP_DBM_3=15215462632&DVP_DBM_4=396400065&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=201491245482&turl=https://pastelink.net/wwr50xs3&DVP_PP_BUNDLE_ID=
Requested by: Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.254.7 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-254-7.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: b42f035c593881359488262fdaf928acd4b9e6129051810120cc361c2a9688dd

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 15 Oct 2022 21:03:46 GMT
Content-Encoding: gzip
Last-Modified: Mon, 29 Aug 2022 13:19:47 GMT
Server: Microsoft-IIS/10.0
ETag: "f128ce2aabbd81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 1170

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 2FC1 8 KB
4 KB 529ms
171ms Script
application/javascript 23.36.254.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&advid=3398311&adsrv=0&btreg=&btadsrv=&tagtype=&dvtagver=6.1.src&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVPX_PP_IMP_ID=ABAjH0gMAbPlYc8NvEzL0hZ18-hA&DVP_DBM_1=3060631&DVP_DBM_2=24867964&DVP_DBM_3=15215462632&DVP_DBM_4=396400065&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=201491245482&turl=https://pastelink.net/wwr50xs3&DVP_PP_BUNDLE_ID=
Requested by: Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.254.7 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-254-7.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 9dc99a92f9d68c0bb47cf55e03971e0f068090465859bd483c97bf9c6fdd32e3

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 15 Oct 2022 21:03:46 GMT
Content-Encoding: gzip
Last-Modified: Mon, 19 Sep 2022 15:59:20 GMT
Server: Microsoft-IIS/10.0
ETag: "0fc3bc740ccd81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3314

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/ Frame 2FC1 3 KB
1 KB 440ms
439ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/window_focus_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 23:43:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76809
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Oct 2022 23:43:36 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/ Frame 2FC1 17 KB
7 KB 241ms
239ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

b7e54c08be2d3028420666e9aca9074537fb351e2ece4e32b925ffca1840ce12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 23:43:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76809
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7570
x-xss-protection: 0
server: cafe
etag: 17992891929817281641
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Oct 2022 23:43:36 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 2FC1 0
0 214ms
213ms Image
text/html 142.251.10.105
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSG3GKMRM34NNXrZoORQg-aCMU7wSQoOOVAd4mpnyH_uEP_fvA_ITUiDm2QomntLHRJIVAFYXw_U75flMGTX-piyrML-w
Requested by: Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f105.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2FC1 152 KB
46 KB 238ms
237ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

18ffb82a05bcd7e430f57b9428d2a6990f127948e7ff14d66c3784a84f4330ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47415
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1665574756386403"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 15 Oct 2022 21:03:45 GMT

GET
H3 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/252410901119672947/ Frame 4BEB 3 KB
1 KB 206ms
205ms Document
text/html 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/252410901119672947/index.html

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

b47a72d5930339dc0b34855fce20ec85d6b785a21ce76d79bbbf345771e51ab1

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1327
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 21:03:45 GMT
expires: Sun, 15 Oct 2023 21:03:45 GMT
last-modified: Sun, 04 Sep 2022 15:04:40 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 6A2D 0
0 181ms
181ms Fetch
text/html 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Ct3l4MCBLY6S7HYKlz7sP5pKD8AP5vN-Ha_eOuuT-EMCNtwEQASCJi8RQYKXAo4CkAaABusvX1SjIAQmpArwBYFxGzaQ-4AIAqAMByANIqgTiAU_Q0jazxY2uqw_6OPi6Y2BlNYfkxVC-Rq8nrVdI6wcCLs-6kUcujdV7LbyBm9SU5WlqVcKWxwmxp2ctA41eNOyl5kBAE2qltiTR_NQ1cwCqwaYonwQWyzUl3qZs1xPp2isDZCUHjFWVQRmtgxVGqHyq1biq8do-cGKyXLdI1WcNTbCi91_CXF0ZAJIhpiVIbNkBFsuHCosMj13fmJYDAMECDC4KSHXrDLfRvQ_kgLzpAaOJ7znuemcVJZSEw0LWFr542q9QKrvHl-z4taXiT83Gx1-xqeUN8c6kCX8W5fYcblLABLL234uLBOAEAZIFBAgEGAGSBQQIBRgEoAYugAe6g6i1A6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcDEJA10ggQCIhhEAEYHTIDioIBOgKAQIAKAcgLAdgTCtAVAYAXAbIXHgocCAASFHB1Yi0xNzUwODU2MjM5MjA0NDE0GPrefA&sigh=w_MaCaT0P4U&uach_m=[UACH]&cid=CAQSPwDq26N9Behk7C6btv9J8sd9JNxampycyNmhrHg2L5Qcigse8mfm3R8E3sV1pmeHOvWFhGDX9jw1VXH6jMQ5fxgBIA4&template_id=419
Requested by: Host: pastelink.net
URL: https://pastelink.net/wwr50xs3
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f157.1e100.net
Software: /
Resource Hash

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/ Frame 6A2D 23 KB
9 KB 254ms
253ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/abg_lite_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

733b81ca611521c0c5664701f060df9d5486014c1dba79acb22269bfc9e06d0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 01:23:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70786
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9578
x-xss-protection: 0
server: cafe
etag: 2674910403068493586
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 29 Oct 2022 01:23:59 GMT

POST
H/1.1 200 1102.json Show response
id5-sync.com/g/v2/ 457 B
1 KB 1014ms
332ms XHR
application/json 162.19.138.82
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/1102.json

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.82 , France, ASN16276 (OVH, FR),

Reverse DNS

ns31532337.ip-162-19-138.eu

Software

Resource Hash

6f2c1aeade82fc5c824cf9f349adcc0ad46d16e4322b9cbc442644e26902f8c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://pastelink.net/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 15 Oct 2022 21:03:46 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://pastelink.net
p3p: CP="CAO PSA OUR"
access-control-allow-credentials: true

GET
H3 200 cc2fa6f05f6b7ab36f626f2501931c3a.js Show response
www.gstatic.com/mysidia/ Frame 6DD6 10 KB
4 KB 353ms
171ms Script
text/javascript 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/cc2fa6f05f6b7ab36f626f2501931c3a.js?tag=client_fast_engine_2019

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f94.1e100.net

Software

sffe /

Resource Hash

b5b7440eb01b4db530c8b12650e39b4a3bfb1b49b7518c76b08bb6e8b8434a2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 13:31:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 459112
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4312
x-xss-protection: 0
last-modified: Fri, 07 Oct 2022 06:02:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 08 Jan 2023 13:31:54 GMT

GET
H3 200 66a8e2f1e23e39b4cd24e41f6fd8475d.js Show response
www.gstatic.com/mysidia/ Frame 6DD6 135 KB
50 KB 449ms
267ms Script
text/javascript 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/66a8e2f1e23e39b4cd24e41f6fd8475d.js?tag=video_location/web_och

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f94.1e100.net

Software

sffe /

Resource Hash

1c5ea13fb089a755e1ac11d873fbeb94f272578656800f74407829c19d025af1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 10:47:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36970
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51438
x-xss-protection: 0
last-modified: Mon, 10 Oct 2022 20:37:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 13 Jan 2023 10:47:36 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 6DD6 8 KB
895 B 353ms
181ms Stylesheet
text/css 74.125.24.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f95.1e100.net

Software

ESF /

Resource Hash

a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 15 Oct 2022 21:03:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 15 Oct 2022 20:13:51 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 15 Oct 2022 21:03:46 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/ Frame 6DD6 2 KB
902 B 168ms
168ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 01:23:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70787
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 29 Oct 2022 01:23:59 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/ Frame 6DD6 23 KB
9 KB 276ms
275ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/abg_lite_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

733b81ca611521c0c5664701f060df9d5486014c1dba79acb22269bfc9e06d0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 01:23:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70786
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9578
x-xss-protection: 0
server: cafe
etag: 2674910403068493586
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 29 Oct 2022 01:23:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/ Frame 6DD6 3 KB
1 KB 169ms
168ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/window_focus_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 23:43:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76810
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Oct 2022 23:43:36 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/ Frame 6DD6 17 KB
7 KB 308ms
307ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

b7e54c08be2d3028420666e9aca9074537fb351e2ece4e32b925ffca1840ce12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 23:43:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76809
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7570
x-xss-protection: 0
server: cafe
etag: 17992891929817281641
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Oct 2022 23:43:36 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 6DD6 0
0 217ms
217ms Image
text/html 142.251.10.105
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSnMY0K8c-4f9sPzoJPm_baPCtIR36UKP3_yTGgaseitKop5sTmzgpb5CLLsND281xFlKEeDG--_hOvLz-tdaWPe6D2PA
Requested by: Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f105.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6DD6 152 KB
46 KB 234ms
233ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

18ffb82a05bcd7e430f57b9428d2a6990f127948e7ff14d66c3784a84f4330ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47415
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1665574756386403"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 15 Oct 2022 21:03:45 GMT

GET
H3 200 1d54d8cacad5994e062108e03542c880.js Show response
www.gstatic.com/mysidia/ Frame 6DD6 33 KB
13 KB 351ms
351ms Script
text/javascript 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/1d54d8cacad5994e062108e03542c880.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f94.1e100.net

Software

sffe /

Resource Hash

39ea310e86ee5d4b745f48121268b8848ebbc92d2b9a1a791c36c7a03512b101

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 04:41:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 577342
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13786
x-xss-protection: 0
last-modified: Fri, 07 Oct 2022 06:02:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 07 Jan 2023 04:41:24 GMT

GET
H3 200 cc2fa6f05f6b7ab36f626f2501931c3a.js Show response
www.gstatic.com/mysidia/ Frame 4A1D 10 KB
4 KB 429ms
253ms Script
text/javascript 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/cc2fa6f05f6b7ab36f626f2501931c3a.js?tag=client_fast_engine_2019

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f94.1e100.net

Software

sffe /

Resource Hash

b5b7440eb01b4db530c8b12650e39b4a3bfb1b49b7518c76b08bb6e8b8434a2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 13:31:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 459112
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4312
x-xss-protection: 0
last-modified: Fri, 07 Oct 2022 06:02:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 08 Jan 2023 13:31:54 GMT

GET
H3 200 66a8e2f1e23e39b4cd24e41f6fd8475d.js Show response
www.gstatic.com/mysidia/ Frame 4A1D 135 KB
50 KB 365ms
189ms Script
text/javascript 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/66a8e2f1e23e39b4cd24e41f6fd8475d.js?tag=video_location/web_och

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f94.1e100.net

Software

sffe /

Resource Hash

1c5ea13fb089a755e1ac11d873fbeb94f272578656800f74407829c19d025af1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 10:47:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36970
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51438
x-xss-protection: 0
last-modified: Mon, 10 Oct 2022 20:37:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 13 Jan 2023 10:47:36 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 4A1D 8 KB
895 B 341ms
175ms Stylesheet
text/css 74.125.24.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f95.1e100.net

Software

ESF /

Resource Hash

a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 15 Oct 2022 21:03:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 15 Oct 2022 19:12:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 15 Oct 2022 21:03:46 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/ Frame 4A1D 2 KB
902 B 186ms
185ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 01:23:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70787
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 29 Oct 2022 01:23:59 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/ Frame 4A1D 23 KB
9 KB 324ms
324ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/abg_lite_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

733b81ca611521c0c5664701f060df9d5486014c1dba79acb22269bfc9e06d0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 01:23:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70786
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9578
x-xss-protection: 0
server: cafe
etag: 2674910403068493586
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 29 Oct 2022 01:23:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/ Frame 4A1D 3 KB
1 KB 181ms
181ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/window_focus_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 23:43:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76810
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Oct 2022 23:43:36 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/ Frame 4A1D 17 KB
7 KB 342ms
341ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

b7e54c08be2d3028420666e9aca9074537fb351e2ece4e32b925ffca1840ce12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 23:43:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76809
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7570
x-xss-protection: 0
server: cafe
etag: 17992891929817281641
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Oct 2022 23:43:36 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4A1D 152 KB
46 KB 273ms
272ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

18ffb82a05bcd7e430f57b9428d2a6990f127948e7ff14d66c3784a84f4330ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47415
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1665574756386403"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 15 Oct 2022 21:03:45 GMT

GET
H3 200 1d54d8cacad5994e062108e03542c880.js Show response
www.gstatic.com/mysidia/ Frame 4A1D 33 KB
13 KB 276ms
275ms Script
text/javascript 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/1d54d8cacad5994e062108e03542c880.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f94.1e100.net

Software

sffe /

Resource Hash

39ea310e86ee5d4b745f48121268b8848ebbc92d2b9a1a791c36c7a03512b101

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 04:41:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 577342
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13786
x-xss-protection: 0
last-modified: Fri, 07 Oct 2022 06:02:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 07 Jan 2023 04:41:24 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame D22D 0
0 172ms
172ms Image
text/html 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022101301&jk=3603762764478711&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f157.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js Show response
pagead2.googlesyndication.com/bg/ Frame 4CC7 36 KB
16 KB 171ms
170ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

71f2940ec78bc4c5ff54c23fb9aa3faead0c28e69e0ab83c1998d21719a8b46f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 19:19:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 265430
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 11 Oct 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 12 Oct 2023 19:19:56 GMT

GET
DATA 200
OK truncated
/ Frame E3C7 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 77a0b11cd5e0c806337bf397bafdbb909d2d5b35a69258dc5e59697711da6a15

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 4BEB 6 KB
3 KB 172ms
171ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/252410901119672947/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

6f4813e4fe6dd891838e421479bf603f6d3f0d2a55b90517b875a77050471d4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 19:27:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5786
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2655
x-xss-protection: 0
server: cafe
etag: 4618035238173732404
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 16 Oct 2022 19:27:20 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 4BEB 34 KB
13 KB 176ms
175ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/252410901119672947/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 07:36:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48426
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13035
x-xss-protection: 0
server: cafe
etag: 2319883687766034370
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 16 Oct 2022 07:36:40 GMT

GET
H2 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 4BEB 236 KB
63 KB 512ms
172ms Script
text/javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/252410901119672947/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f148.1e100.net

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 15 Oct 2022 21:03:46 GMT

GET
H3 200 300x250.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/252410901119672947/ Frame 4BEB 40 KB
10 KB 199ms
198ms Script
application/x-javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/252410901119672947/300x250.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/252410901119672947/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

0508a8a5a368a4ae1f86a156d4723c734cd3b1d22cf3d45d0c69afd6d2bacbd3

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Sat, 15 Oct 2022 21:03:46 GMT
x-content-type-options: nosniff
content-encoding: gzip
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 04 Sep 2022 15:04:40 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 15 Oct 2023 21:03:46 GMT

GET
H2 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A8E4 143 B
223 B 424ms
423ms Document
text/html 172.217.194.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f157.1e100.net

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

age: 87
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 21:02:19 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/ Frame 6A2D 3 KB
1 KB 170ms
168ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/window_focus_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 23:43:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76810
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Oct 2022 23:43:36 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/ Frame 6A2D 17 KB
7 KB 172ms
171ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221012/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

cafe /

Resource Hash

b7e54c08be2d3028420666e9aca9074537fb351e2ece4e32b925ffca1840ce12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 23:43:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76810
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7570
x-xss-protection: 0
server: cafe
etag: 17992891929817281641
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 28 Oct 2022 23:43:36 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 4CC7 0
10 B 168ms
168ms Image
text/plain 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?0EGl0Q
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.68.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sc-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:46 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame E3C7 28 KB
28 KB 469ms
169ms Font
font/woff2 142.251.12.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f94.1e100.net

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 01:25:02 GMT
x-content-type-options: nosniff
age: 70724
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 15 Oct 2023 01:25:02 GMT

GET
H3 200 5540749736361901974
tpc.googlesyndication.com/simgad/ Frame 6DD6 214 KB
214 KB 185ms
184ms Image
image/jpeg 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5540749736361901974

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

78892a8608e0798b07121b16c98885ea085971616c5ea6ad5f49d08303d9d0be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:46 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 218912
x-xss-protection: 0
last-modified: Fri, 11 Dec 2020 06:48:52 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 15 Oct 2023 21:03:46 GMT

GET
H3 200 6006733543120028532
tpc.googlesyndication.com/simgad/ Frame 6DD6 6 KB
6 KB 213ms
212ms Image
image/png 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6006733543120028532?w=100&h=100

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

a49a524dd26fd6b8a3275b692a00ebf28019503006efdcab7ae5e9c0d6833376

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:46 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5721
x-xss-protection: 0
last-modified: Fri, 11 Dec 2020 06:48:52 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 15 Oct 2023 21:03:46 GMT

GET
H2 200 data=U9piFnl_6YDMFmiltb65VjPVmd1nGQ2AlPFs8fFuJRxAr_gAHRb4smtHsFN_xpRbmoXT2RBJGwymljdrQw
mts0.google.com/vt/ Frame 6DD6 40 KB
40 KB 742ms
396ms Image
image/png 172.253.118.138
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mts0.google.com/vt/data=U9piFnl_6YDMFmiltb65VjPVmd1nGQ2AlPFs8fFuJRxAr_gAHRb4smtHsFN_xpRbmoXT2RBJGwymljdrQw

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sl-in-f138.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

4902d0b50b7aaf4ddba3726bbcaa748c7c2e6f4092d1fd15193cdaca2c2fa724

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'; base-uri 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'; base-uri 'none'
date: Sat, 15 Oct 2022 21:03:46 GMT
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
server-timing: gfet4t7; dur=4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40621
x-xss-protection: 0
x-server-version-bin: CggIBBCghZ+aBg==
server: scaffolding on HTTPServer2
etag: 0816318f831d9ca43
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=430
expires: Sat, 15 Oct 2022 21:10:56 GMT

GET
DATA 200
OK truncated
/ Frame 6DD6 301 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 651fc5051db295a80ef0ec8faf17ab61562ea6e220be33a1a127263e3681a491

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 6DD6 418 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ebd902c796e15c5ea443dff52f3581b7b0076a00fcf4acce32983a48d27d877f

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C0FE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI24y2-9wfnSBTgLiMo6k4c&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI24y2-9wfnSBTgLiMo6k4c&google_cver=1&C=1

43 B
766 B

366ms
282ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI24y2-9wfnSBTgLiMo6k4c&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNj9GhDb1sYBGJGqvNQBMAE&v=APEucNVb3ccp42Ta0kUA1sgY11L9DN97BWjSNj-YZgL8Qi_aDZ1glVCY1q0C1M456V63h-kURg1CwvUuoliVWyO1t6ZEGt6pxg
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEI24y2-9wfnSBTgLiMo6k4c&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C0FE
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y0sgM7HSDSIrTzNscSUoZQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1

43 B
894 B

299ms
299ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNj9GhDb1sYBGJGqvNQBMAE&v=APEucNVb3ccp42Ta0kUA1sgY11L9DN97BWjSNj-YZgL8Qi_aDZ1glVCY1q0C1M456V63h-kURg1CwvUuoliVWyO1t6ZEGt6pxg
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame C0FE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEJ2_gp4BBJi1CN54BVYTt9c&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJ2_gp4BBJi1CN54BVYTt9c%26google_cver%3D1

43 B
1 KB

280ms
233ms

Image
image/gif

104.254.150.241
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJ2_gp4BBJi1CN54BVYTt9c%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNj9GhDb1sYBGJGqvNQBMAE&v=APEucNVb3ccp42Ta0kUA1sgY11L9DN97BWjSNj-YZgL8Qi_aDZ1glVCY1q0C1M456V63h-kURg1CwvUuoliVWyO1t6ZEGt6pxg

Protocol

HTTP/1.1

Server

104.254.150.241 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
AN-X-Request-Uuid: 37dd8bd2-6db4-4429-983b-f7498d3aa6ea
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 103.209.254.58; 103.209.254.58; 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
AN-X-Request-Uuid: 46c835f5-008c-4697-bbbd-1dfb416732ac
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJ2_gp4BBJi1CN54BVYTt9c%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 103.209.254.58; 103.209.254.58; 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C0FE
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTY3MDQyMjAwODI3NTYxNjg4OQ%3D%3D

170 B
188 B

175ms
174ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTY3MDQyMjAwODI3NTYxNjg4OQ%3D%3D

Requested by

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
AN-X-Request-Uuid: c58021b9-80a8-4c4d-a982-727d199cc1fc
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTY3MDQyMjAwODI3NTYxNjg4OQ%3D%3D
Connection: keep-alive
X-Proxy-Origin: 103.209.254.58; 103.209.254.58; 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C949
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI24y2-9wfnSBTgLiMo6k4c&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI24y2-9wfnSBTgLiMo6k4c&google_cver=1&C=1

43 B
766 B

350ms
297ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI24y2-9wfnSBTgLiMo6k4c&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKv65gIQstDN9AEYu7zx0wEwAQ&v=APEucNWJGWPc9ZM-p-_d6zZmcbWFQR-x3klw175_bjBut7QXNIDbQbNOzVjDHPkeIinr1sUqXpsyuDMTpiZRILnGODpcjDNq-A
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEI24y2-9wfnSBTgLiMo6k4c&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C949
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y0sgM2Q3fSISiTVypnFjZAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1

43 B
766 B

281ms
281ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKv65gIQstDN9AEYu7zx0wEwAQ&v=APEucNWJGWPc9ZM-p-_d6zZmcbWFQR-x3klw175_bjBut7QXNIDbQbNOzVjDHPkeIinr1sUqXpsyuDMTpiZRILnGODpcjDNq-A
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame C949
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEJ2_gp4BBJi1CN54BVYTt9c&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJ2_gp4BBJi1CN54BVYTt9c%26google_cver%3D1

43 B
1 KB

275ms
229ms

Image
image/gif

104.254.150.241
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJ2_gp4BBJi1CN54BVYTt9c%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKv65gIQstDN9AEYu7zx0wEwAQ&v=APEucNWJGWPc9ZM-p-_d6zZmcbWFQR-x3klw175_bjBut7QXNIDbQbNOzVjDHPkeIinr1sUqXpsyuDMTpiZRILnGODpcjDNq-A

Protocol

HTTP/1.1

Server

104.254.150.241 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
AN-X-Request-Uuid: e9adaa46-f5e2-41dd-a219-19e6e959655f
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 103.209.254.58; 103.209.254.58; 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
AN-X-Request-Uuid: c82681bc-54b1-466e-ace1-6e8bffe73f58
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJ2_gp4BBJi1CN54BVYTt9c%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 103.209.254.58; 103.209.254.58; 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C949
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk2ODAyNTUzNDY4MjE0NzkwNg%3D%3D

170 B
188 B

175ms
175ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk2ODAyNTUzNDY4MjE0NzkwNg%3D%3D

Requested by

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
AN-X-Request-Uuid: 3e253686-f1eb-4ea7-a5f8-bf3ad3ba7915
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk2ODAyNTUzNDY4MjE0NzkwNg%3D%3D
Connection: keep-alive
X-Proxy-Origin: 103.209.254.58; 103.209.254.58; 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK pr Show response
s.amazon-adsystem.com/v3/ Frame 9344 2 KB
2 KB 293ms
293ms Document
text/html 52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_n-MediaNet_smrt_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_n-MediaNet_smrt_n-Outbrain&dcc=t

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

924aa05b323d36b5b38f14ed476b6194cebb043ab792f4160b77bf0234addb45

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_n-MediaNet_smrt_n-Outbrain&dcc=t
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 1788
Content-Type: text/html;charset=ISO-8859-1
Date: Sat, 15 Oct 2022 21:03:46 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: P0YW4TRSQQNJHY8HGS7W

GET
H3 200 5540749736361901974
tpc.googlesyndication.com/simgad/ Frame 4A1D 214 KB
214 KB 179ms
179ms Image
image/jpeg 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5540749736361901974

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

78892a8608e0798b07121b16c98885ea085971616c5ea6ad5f49d08303d9d0be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:46 GMT
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 218912
x-xss-protection: 0
last-modified: Fri, 11 Dec 2020 06:48:52 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 15 Oct 2023 21:03:46 GMT

GET
H3 200 6006733543120028532
tpc.googlesyndication.com/simgad/ Frame 4A1D 6 KB
6 KB 202ms
201ms Image
image/png 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6006733543120028532?w=100&h=100

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

a49a524dd26fd6b8a3275b692a00ebf28019503006efdcab7ae5e9c0d6833376

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:46 GMT
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5721
x-xss-protection: 0
last-modified: Fri, 11 Dec 2020 06:48:52 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 15 Oct 2023 21:03:46 GMT

GET
H2 200 data=U9piFnl_6YDMFmiltb65VjPVmd1nGQ2AlPFs8fFuJRxAr_gAHRb4smtHsFN_xpRbmoXT2RBJGwymljdrQw
mts0.google.com/vt/ Frame 4A1D 40 KB
40 KB 438ms
175ms Image
image/png 172.253.118.138
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mts0.google.com/vt/data=U9piFnl_6YDMFmiltb65VjPVmd1nGQ2AlPFs8fFuJRxAr_gAHRb4smtHsFN_xpRbmoXT2RBJGwymljdrQw

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sl-in-f138.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

4902d0b50b7aaf4ddba3726bbcaa748c7c2e6f4092d1fd15193cdaca2c2fa724

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'; base-uri 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:46 GMT
content-security-policy: script-src 'none'; object-src 'none'; base-uri 'none'
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
server-timing: gfet4t7; dur=2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40621
x-xss-protection: 0
x-server-version-bin: CggIBBCghZ+aBg==
server: scaffolding on HTTPServer2
etag: 0816318f831d9ca43
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=430
expires: Sat, 15 Oct 2022 21:10:56 GMT

GET
DATA 200
OK truncated
/ Frame 4A1D 301 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 651fc5051db295a80ef0ec8faf17ab61562ea6e220be33a1a127263e3681a491

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 4A1D 418 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ebd902c796e15c5ea443dff52f3581b7b0076a00fcf4acce32983a48d27d877f

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 204 l
www.google.com/ads/measurement/ Frame 6A2D 0
0 213ms
213ms Image
text/html 142.251.10.105
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRrMglZyg1kTXXHVpCcjS3w82CBPANJVwzQJ6tV09GX5SRihJk1d0ksK1J2lbAVVeRqocRhZXSXttHsfoC4aQycxB2D1w
Requested by: Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f105.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6A2D 152 KB
46 KB 173ms
173ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

18ffb82a05bcd7e430f57b9428d2a6990f127948e7ff14d66c3784a84f4330ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47415
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1665574756386403"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 15 Oct 2022 21:03:46 GMT

GET
DATA 200
OK truncated
/ Frame 6A2D 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 92f53b235a9efd9f918702ebf2635f389c7838d2c38f3c36c85804fa7f339b5e

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/ Frame AED6 30 KB
11 KB 170ms
170ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BpUxHwPVp83Xiq5IB3crKDMTUl_aPltepf3JBhD98xVGdWI9GHOhp7enoJfvqP5G8hRU8MtK-FAO8q-EKiTb5HOuQd4A&cry=1&dbm_d=AKAmf-D8RNLsnmHx0QtQFhUB6Vv0M-ajWfwJoyU12SFggepMrejAFn1GuOTvn-BIJT5vAFxa4JZMNQa14YZgQbeurcYuIokz0yBb1H6zMQ-ahsZVjLnSZC-6dtdiZOEAYx8sdE4tlrpqWNoEdZfs-fJLtqL5UlbiEikHmjSUdQBWZcV2TpHIpDg0fcNIC18azQ0-Z-FxiXkoZHp17QQo0TRnkzNw8pw0k2eOCN6eCZi8Vk3SuCJSR9MpLwh21VCp_4fR5Hop3Z38NwTNl_1nhglaYvGmSHVMeOnlCVaPkls5C1qidB7RUo0TVtOx4hSucIFhCCxqvdVVgy9-P4d9SAXs_8G1e0nL65gLYLRe-Vw1wJI3Q8Mc7cJzYjIIIYBL3vlEqINMjKn9kmsvJEJGKwqFBqWEE8ePyOBAMUqpKyC4jsbSlnfIFmOKSgA9pIzRs6jw2OLfdzHD8mBiYdQqtckiK_go9qVRp6E2xGim5M8Grt1PevHzq_veQZRYK8UrTFpdpXj5HQF-Xk13Zo80GTCtozyIkjrtQzyzAhYigh-rVxpj0cNXGaqXXxsN7G3csgmqrUypvqfJxE9kvs2LophPOO1Gthcjq-lGnAA7nC1c7fpgsiFi6EdLpyjoF4K7m2U5m3RB__crI4oqr8333fW0arbnHgAu8ucrk9-3iF8wNuA15p_vFEKr6tyQMimpUDTpgVTE7jtt1QFzOsN9jVh-hik5dml1sBHeEonlVoKW3mqI9zcDhDAaD2HNKeVu0vWMtfBM4I9lNXk0hrYoBL48eDORcGyyYpbJp8X4twP8bEmXQy-k_7egiKjd-I6TZvbT4TV0w6lsIypR3T9L8QMNVDT_p8bFT0OfH0A823tQ4SKEzAvje1Jacwg-gBhviib7IzcXYu-2ELKyQT71zViahMklZQ2GeqZiFrFDH5HxezYX2eQ1BXj0mzpEA0s8JFQp4XNsVXfCFlKBzR9rKUGbgea5qJCWNA5fzS9DyC2eXTPZFyI8tJAeF4jNwIkZ1emTvw9jsccGgbc_IzuTagEsNiHUJdBmLJnD1ZuY8UCudczzvMhKQBWi6IeY0cP4HZExay6vbdVz91tfMjRixDiIrlB2BF7TY7KleofTVAuYGcecNQQhNGB4u3YruHadsHGDrlzoQzN2qX6AmQMotoNGnSewMYzUGcbXSPhIeA128kCeUarfVz6Mk4iFvG_yCE6k64dFF4GM_p94ggVaRnj_IqAY7x8VKZD9qW7vpLwVH0o_svZGZMKQ2KPq2CLUIoAmaGuY4YMXxuxPSfDL2-3UwF9q64CCvTcOQXE26EkSI_JETk-Fyy-qPAhJ9pchUAs4EviPjrCQRfNDqEO9LBPFHzuI0tkb0kXx6OkVX4M9olhPB1D5_cR3cUSfrknhGO5TfoqFuEpYFauH0PkfHge49Wj8vdm-yOnxTFCyp_VIgh2zmyOntMvCTmzSdQ1NtDwFryAQRPdfR1PrXrCkqF7fOi3RpQgpojA1sZhnDs-GDAJAU2lLssYdLpxvWLBwTRDDsTJE0kDoy524A1nKCFbiwrrwHyY8ntn1_EI2CxUwUCcVUYn0wLvXbcE0Cn9I3Xwv1G3x1vPANW8EKFUMCl-cv00HIyEtg_hX9Zv7u4-y7dPAbJW5VeA0o6lHI7hkLgGdLCT2ANFfZwaJhV9n73G1YmylMKcaKxP2IpU2rjuEIp7fWbfXdw5A-YrUVKwfN2TEl8-o0BjVt1ZXjElsE6Bg9rUeIqac0hEyn_sEkhuhIPB-toZXOzJV5qpjo9bpEeVfe8rMNeCFrvSj3Stp5TfnV5N6TOGn9mnhs5bL0RxR-ul9928PYtFwHbx89RWvEQWtRp1KVtg_aYTaIWS2rQH02Q9WsSvf_vvJ8Z08_tzwLNK-1HZ9NBG3e4_-mq8ZR-lSjOzejdUVe-2e75cUv0Sof5cmGCZZEW4VwEFgv55beuCqYQ0EaqYaxEqV2On4B2HXtVY0wmH7NJLiIxEyQaasRf_z-1FkFJOiLHpclGsvbXZshw-u8XHsyAnxY9FOJMm7iVuAh8Bx1i61hthV9xbn6uIUSteHEpLZwFa0ODS9YgNFPEFA-zMVGI0xWP2tBPR-Rd5qxeuWxIuW3NWH_qK011Nb_nA4EDDjnA3AgeSoytNQtJFsysQE3wbcosW8OeszH7TZVYJes9CgXlBnryx71ngCe4q9JBaoTiT6-WAhftysslYyykAl33Vyp_LkhZmSNhF-CKYDh3DIhAJsbg0IXDLQMVbO9yXwS5UZHh99-gXjrmkDj-zLbqhwQ84e4kiB5V1N0yjA5bAtJ4GL15Aj9XHk0wWfitAnJ1WX8GwrGyc2PKd6H_cUYFsumAfTDfZOb6WB7OFKxIo5qqPEaY06zS3nRc8DYe8igvH3NIpHWf2AMNezP9sn0BpUylVB1uaQRo7NVWrtaJeqVV6JBpHXJVCIeADIHq0vUzDTBSnbaVZ30jqn_IfPV8RnRmZWfhdQF-6xKeUb57N_xsCb-Z-m74mgQxZ0I6gJUOULfjSJ5-ZRF1CU-M6Dp3R_z-Nd__6NgSaq-zx7agD6MgdgLyXaiJeVpDPxoO3rC4FaStpQn2Dtqk9qolr2TCbkPtcv4Xxd3a5xVfpOL7h41Z0SFfYknr3nMXfrkJFd-12yMJTFCTs22XnpxtEjBvpxKtOINSMJxBk6__wR7lXoPi7MtmrMu1fRqechuKfTM8BcXqORrEf2SFq839JJYK0M3QkRVER0rmzpzbjdu3c0IyoavWeVSy7TSVFr7TbYqXg25KSDx50eUV0eTaHOSdT6zhCuNwArJiizXFQ8m76wejv8nv3Yb2IagbNEB_V4gY_-F3qjADrN8cvofMMJg8EI2V3FaJKlatAP14sNDtkbEkd2L1R-YZw1GXQ0ZS3SfuDp27WKj_X-Q5C7eN0h_F-4_q4SckIpXygD_MJNTHWm2awvKt9f4D8kxINs6OmVVrmcu06YrLu2chOQL3eCSYwQ8SIt6QLAztNFATJJjsl4IK9ZjlhHviTHmYUd9AQofVi74mE67g3TNpWylT80-KD5yVIWoKVWRtjqGPmN0EThpvY_2V3cs32DP7pWR7-T7xNLmACdNGQ6D61NfXr1tka81ewBKFngKjkMEB8ZtoZ3MZvM-CYF-8n68KSNHnX4SveVrZgb5NCwjYn8iAmVh8xL8fSab_y5_d_N_H1szEG8qu_a70Lt40RT3Jt9rF4X-seajPCJVh4QK3QToIw1atmwPxKSKrBOIQREBZ5dqQxtdZZHluVbujq26tcSaoXKD3JOpDnPv78vhdYZJGPGaNYzdPMARqdAYLzBCPMq&cid=CAQSPwDq26N9Behk7C6btv9J8sd9JNxampycyNmhrHg2L5Qcigse8mfm3R8E3sV1pmeHOvWFhGDX9jw1VXH6jMQ5fxgBIA4&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

b3c218f921126409f2f4a82b74458117039037330ffb76b30df5c6062b353a90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 18:51:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7915
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11730
x-xss-protection: 0
server: cafe
etag: 9319256901541695429
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 29 Oct 2022 18:51:51 GMT

GET
H2 200 10341777395138636941
s0.2mdn.net/simgad/ Frame AED6 43 KB
43 KB 400ms
399ms Image
image/jpeg 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10341777395138636941

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f148.1e100.net

Software

sffe /

Resource Hash

277c2feef0a479fec8d6dff68ec2bf47b1a74e3fe07fff001039f6f802fd6222

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:46 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43718
x-xss-protection: 0
last-modified: Wed, 21 Sep 2022 09:01:15 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 15 Oct 2023 21:03:46 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/elements/html/ Frame AED6 8 KB
3 KB 182ms
182ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 18:51:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7915
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 29 Oct 2022 18:51:51 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame AED6 0
622 B 522ms
183ms Ping
image/gif 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssN3JwJ0-I2qac1z4GgsRjE27KLR_NGky0uesv8rwJtf_gxzEELH5BhIuqPMyr9O8TOglX2RbeZOytyVHse0UwADRlEM5tJZlrxFZd5OOtq-DVFyfrcEDk2rPY9KazKlQjAhuPvDSKX6jhkkT05HIbTezd3ZBD9Ae4pOe5xBnygpHm7KBl0aj4xpzSwdpfaaBrQDT_mYCBNm1sCIDxuJU3rEgfFSDbwglX680t2NhKQYcMAko-8a4S4epSoAGF7Delx-xbpKbeMXbe8OllL8HRZQhVs_E5dBBh3__IO_e23PPlZtmPrjvavYpsB-TZfZ_fvEswq-OVF5DYCOSD4uXqXT9MGVLcor7Y3bUwmf8D8f_n7PIujiGlrp6iKA54EFuQLQR2Y0l6JSDroxVaQOxedybWVP3m0lVY_lgV7G-WR3musT_iRHv9Bfr5ABgPsXi_zQk5ldC3obqFriAeyxkL90QsTF4U8CHTse1YysA2EN10061LPdaufEht4UbyPh4XYaS_vPdQ9kbt3KTDtmfFymedTRuF9xcYZkuX4HFv_jNjlrfsuffMPI7Kz5Ei-35IiRVQjFcrLoNpH3nDLf9NZxRqnckiNJvHhUWFSwAGAW3P_XQCe0Fizm4N4RtDyB_VD6A_6zQBlhwPjvT0QXGEafiJ4AWoF19PDO60OeSMY87ZGdBy_gGgEt6g9RN0oBeCshkuEfaE0zEm-AD3LZ0ERF6WyQM5uLtcvzaKYxwYgNcBy-eBWbQX6SpDF32By4mpf47CUNzMzUf0koNZ9QLmaDE1ZJzVSue8FmUJzuL8urW1PAJ9KZWBAeHy8RUVbS_6MEvgJPyNc5H8EuUwE9R29HuU8772GVmHzA8wxp69Y4oUkItefY3C96SZ0fznYBiK6xPgpT1FwTLB7T-ZICjdJJ8OO4t8O-uYF1X-jRJQKHeCyKpMo3vuiujty1Ngm0S7PUp8Hpfp8J5MrDmCi5Kl8ZeSrws5Wr9l8MVACaxLG9C4MEgF2UbrCO8SlpCTeFKHJM7_N7CFoUrlGjMmiOdLwkjBOn6Sq0QfkVzdGecizaFx4pRPB_e20icFNKD0yHIAE7LA8ZbPcdG8N_Lw36J4nUO5dSqw_el3QpkAHUpD8TIWWW5T7Wmr77yXHhS6J0iC1s1j3Dx8-fAVLVotG0rJm0UMZJSQnj1p2f5Lxj-qQKOGHrlwcchKJVyp4mic&sai=AMfl-YS0xdiSSM3vR7hNG-T83YdMuDJDxdmxJlzwR08GOHr-Bq7QdUlcFvR9eOoGgu_HVrXxZxjzmO66QrQ3NEw6Amn6--q0ixvp4UK9JYvX84AeOiZ_fRR6WQ0RS75MPyGzAvG2LTBxSI6iRvYns7MdPKEytghQOTeXk0VKTpzfj6sJIT4YuuQ8tht91Isjw5Hy72hmiQZ_H-QFMvy68x5DM4-ChTZQpmhYgCO3dHvMayaGcbEnl6nDUi9ImL8II_FsMz-KIg-PJUHBuHLulq9XNVY&sig=Cg0ArKJSzOrpwztVzApZEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20221012.87013&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 15 Oct 2022 21:03:46 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame AED6 41 KB
15 KB 193ms
193ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 18:23:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 268829
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Oct 2023 18:23:17 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 4A1D 0
327 B 710ms
235ms Ping
image/gif 74.125.20.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~l9aeoxhp&c=1840560957883&slotId=920280478941.5&qqid=CM-Ur5-R4_oCFYLScwEdZskAPg&sei=44729911%2C44730425%2C44730426%2C44752538%2C75259414%2C420706098&nsei=44714510%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=ulc&ulv=1
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/66a8e2f1e23e39b4cd24e41f6fd8475d.js?tag=video_location/web_och
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.20.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: pi-in-f94.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 4A1D 0
0 181ms
181ms Fetch
text/html 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C4d09MCBLY8-8HYKlz7sP5pKD8AOe947TbJKV27mkD2QQASCGm6SQAWClwKOApAGgAYSetdsByAEJqQK8AWBcRs2kPuACAKgDAcgDywSqBI4CT9AL5Q-khPJoTP2-5GJwtma_ST9-9QZfWYs5m1-I5t7xe6Hm9xUt7ZrIRUGGl9oWvPIeYZHkRzTDnXi5jRoGgFvhVNDrS51_lfc8cggY3E1WhtNZ-885m0Q26iWARo4hhFOlIW_lKn61Zo6NsrXZqzyqNEWD1t0hBkrQS0X4wEo_CA5JhCMMhmnIUu7e6GnXac6C6iHf7OvYI3Yt6DUNaoWtUuoN2J2px7mfnhz0TcTtHYESe8zxJFNzbwH2yLgy9XOvkpCTXmvR9JJK2LucQckcU8iBhVlxyT0sws8i0VsGzIRKNvu_1C4njTL9yPKnm5pZ_JWmMBjh-_izK-TFyP1J39gTiOTOj2pYZsPVwATmhpKW9wPgBAGSBQQIBBgBkgUECAUYBKAGLoAH5OHKpAKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBDTnQLSCBAIiGEQARgdMgOKggE6AoBAgAoDyAsBmAyGhOW6igS4E6EE2BMO0BUBgBcBshceChwIABIUcHViLTk2MDI1MTk1MDI2MTgyNjIY-t58&sigh=s5RX_T4fBH8&uach_m=[UACH]&cid=CAQSPwDq26N9Behk7C6btv9J8sd9JNxampycyNmhrHg2L5Qcigse8mfm3R8E3sV1pmeHOvWFhGDX9jw1VXH6jMQ5fxgBIA4&template_id=545
Requested by: Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f157.1e100.net
Software: /
Resource Hash

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 4A1D 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 37d054ac8410cf892581c4796aa933de77f72ab8bd9d51c999490f7a7e3d3f70

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 137E 106 KB
37 KB 519ms
173ms Script
text/javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f148.1e100.net

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
Origin: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 17:08:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 14115
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 16 Oct 2022 17:08:32 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/elements/html/ Frame 137E 8 KB
3 KB 170ms
170ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BJkFGeXIRf2PDmBJQuJ172CP5gJ6xBTpMV-mJlZIjkdx2PVac__TVbXGZl2b3-gomo1DQezOJwvrF_DVJQqIK3gVuLBA&cry=1&dbm_d=AKAmf-DQEd3cxsAwCswDa7MtjdaPyWb2XcYlNFpWsBV3gV0bHaVQmxdBvP6seWsRr2Bj7LF4I7jyY-EqaiBNjhjL36LsfNTKO0COfWyawcZHyK3ewN130VRPGfh_dgJRlwXdZ7_hSXNLns15_v44nlSrWeXVKKrR0YY4xMyphY1H2SWM_6Ne-yzG5gEor9TzrRNxopE0oqyQs3sQVugFIM8GHOSboEX8Yfq6SdvsV4Hvm-FldtlkGNxvsUXj7RzXaGzLozNlJP2-W-aWx-YiFM8TlXtoRYwQbqHzNRL5Wz6bS0z5G8JwTFUY-uArF8wk7ZXe7iW72DM7u-FG6WTS5jzV1X69LksTf3y2AiSy5DKhPg5udvnxHZDlVMMIYEMLFUJiBgWuIiEbzdsypVPJnFPfxkxeQUKT20xbe4j8zu-6z2SLp68ZYJRjZXCP7E4CyQBA6cqeIvBhxTXwIaZ8ezVr6PAQPbE1Gj81CH4ZGNUkh2m5IkGI2MzLqUZoLyiVCbDm9adsVSi56LAMOBFvapU1iml0g-dTZukdXMqCLYhJ1sQfXCjQuVIOq9aevngOF6T5mUzS2sxrc3FXr9SB5rHlwDfH8XXWA3mvDlLm7bkbpqX-LhBGVEbJ64Og2fK-NtjFuvXF1FdWwQHKsu-sks6u5p412BZnVuy9ljgNXzh1a00hc_xNUg-EAhoREVybi8Iqm5jsC47lqwU6qsXvx4gqAeW2UkwvRqvCYFk6z3Fr70b0ogva6FrunmSNpxHGe9Za_lq15QFcI6ayhO901VRiQHaHNj1l6FrXj8ByhlyV6PkFeY3SIXCwfiBHi9r7f3OsqQUn8wNklk3WCopIv34_zWrVGVTS25fuZTpV_jjdrs876SW0K7LbDyCdipGSyFaa_PcweitPBCo2R6fvpxTDhysM4OKr43KgIcJ7xqd6xTHkvet6Uq3fTl40vcc_t6pHRMUTl3EIRPZWUuxbg2FUow5TdZdph80yhD0jnbCseRe_fNFTAUd8L3jFd5_ahIPMb26w_OHqadyx4m7XbS54aa0YlD7zCFqA-cyDYcDBUgiBb0UD9UsyKU342iL3oBvc5fa6OLiEF_hKYIUUXNPjblQCFIhwtruB8wFk0kM98k7oVGgEjWS0HLLURwdUkzScj9KOif-9bc16kwHRZ2DXxgMvunfEDW3G91693ywACCmIZN0044ahqGCT92pp1qwhKIZ6UMUwwyJSxpBBsclpltoNdotMmrA81jICTgslRIcF98ZQi8xP2AyfAu-jf4XnArg6DD5fZbpIkeanX_Rin3K_TtA1rsBHIV1z4eyLS711V208e0v6-v-61f_TPndiW9knOjQX857-3xk8C7ylCeE3qbjpDK5cvgqdYcKY8MrqJowAgzpVkY_DLJcFB4SaKAlG_Qmo6MNc4H1c2lCEQp2QJ1-XtwuMRo-YH0hVjhHqtSav_dwuCaj0bZv3RbNO3WAOkpfveCM06o8w3MyKwxZ_bx2G57wDV8R5BWHIdKb71eh_EJ25AKuZJpWbFsjSsu0kpEn0zaiaaUiVzhOKwwH9hdu-VYECncnIb_Cm6GpZgPGr9aXos1wdwLfORhw8ubGg5PAF6jQUjIxmhzmRKV_aHoOemBoKXFMctTHcbd7NvQ4eZbPrahCebjL7DT1Q0ie7RfRgWKsFL6mWIbc3ic-tQo9oU0bkKd-verRQ2LbQ2yK28txeTN19DCiP5QAJ1aGwFQcHFLnsgJwsu2F0hyseEyTkQE9zfg6Yk76vu7vHzecs6ltkTcMrFdpK88Zg-v3HRxVX6gP5Cd7Zl83x7vxuvGxZazDqyiH8sGGyZo0oCxPLZjhv1zce4y9gtHK0qO-S4AESDyOXDRVKDuPc6xFX3hT1zGJ8_wNDRHr4mN8hBx0D19tZsLL59x3X8a_sCTIJbv6NUbYX-xM26tBtAQ20RpAPo-dPsSfSZkdtpV4rPZ8Tj7Ml9ArlleRA3jl40LajAiVkh4T6IV1MVm3AepD6DjzS0dZDqJWRqDu7-51WACf4aOghNgjvPRtfiEFbdlq-1BwzzR98-eBxDcuet1-FRcR1saqkWC8LgA6QRqRSB2fxfbmBDn1fdXDck8ZAe3qJjXOT_xbG2KFktxGuJ1JS4wjw2quDphjB3XTSUld6tjeb4jzrTzNGjHjYGec42zA_-UfyRWMDvAWQFLf3DPsjA_RCvSaqhvTxxXkLna5CLJlZuH2okgnRN3asFksYjGcNQlYcCMLkLyKRmEUJLTY1eVTYeo3lt4PCZFmh29_gQ_llpGRnqPV4f85Q5UlJpnbIm0dT_d9Db9_Sjd5V19yzR5wBitzEB3LhSdCHVPingNy-ll4av9elvaDxh3HLAzWbymIGfb92EvGUdqeZujRriLxsI6xIZG1Vvvb9Yj0ZpkyAVT8XmdghcWnjga4GFmpkwimRaQ-_NZOXJ4yFI2islZGqilpeNoqyDI5q5FRyDQ0s8p_RtU5nLNDCqCoVZ1R0Ogt_tWZzxZisTXwglLJMfQ1-_nWQbYvMnuehhHKdMNkts04rKcCkhIf1iMcykvTI13S6wsY_dRM16hxnoPOxrAvHG65PhmLhFBcus3SW8d3oxvJ3ni58DdRTZnVFBFNaK-cy8MM81c8TTxIR0N27SOkCNSVLYd2MBor4rpgyfMwoe9ehn4LwKJIziVjf0l3FqMSDP1jPMTqUfwkWvYnH9JWR-MUJArsFX_2j3hsUWhW5KASsHR-NWHUXlglJobEvnPO88g0q2iiZCfP8k6aFGfMCUBeHMrbLyG7nq_8k6-CYrQdxh83xOcbALyjIodlnhcuyE14rM0ftfjrTBIvUBMt1F1CCtLbdSz2elJTtMbXdXnlhi9JEelvNu_kGxeQDSPv2BWofr6t6yuX6mjfjU8fDh91iHNCiFe6IhVQjscags3-xasV2MPhxjxjgb_hCfKQVPeW8Mu5jGKSJWr4MgFvxzqlq8FZEaO1LGPCeTQK38waVjNFq5d9i9674y_SjoMN9fo48WT870zBnwKbcD5Vzeezegh-K81zJISHJUPmep2mBrQEr0UjBrL6egO0Xmv_aGQ8yLnTjEI8ME3Poe2aEqgDUAqmE1ozknTtX8ga8MEDZZvZI0RtwR0q34fwm19MeFp-mkL8_mSgGzie3LfH4cyHZaIKEPoLn2F846nW3TQXnSzEfqIAonI6s4Hdv8GRW8vTKx1HRwzfIfMHhdL4Or_K8Vc803tkERYdHIGTgJDr45WQCpuWDga_7-7BMdoDU&cid=CAQSPwDq26N9Behk7C6btv9J8sd9JNxampycyNmhrHg2L5Qcigse8mfm3R8E3sV1pmeHOvWFhGDX9jw1VXH6jMQ5fxgBIA4&rfl=2%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 18:51:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7915
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 29 Oct 2022 18:51:51 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/ Frame 137E 30 KB
11 KB 170ms
170ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

b3c218f921126409f2f4a82b74458117039037330ffb76b30df5c6062b353a90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 18:51:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7915
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11730
x-xss-protection: 0
server: cafe
etag: 9319256901541695429
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 29 Oct 2022 18:51:51 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 2813
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1&C=1

43 B
766 B

410ms
297ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQi4Dw4AIYwauCvQEwAQ&v=APEucNXTbTPrNwmCo4iLnVpiFdcD99yg2u8d0yjRePEGbsDm77OfvRW2WO25PIbSwpgYmf3H7xXmU_GFyiagyG7aTgrOpiy9TA
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 2813
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y0sgM4.laeN8DbzYJ53nQAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1&google_hm=2

43 B
766 B

297ms
297ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQi4Dw4AIYwauCvQEwAQ&v=APEucNXTbTPrNwmCo4iLnVpiFdcD99yg2u8d0yjRePEGbsDm77OfvRW2WO25PIbSwpgYmf3H7xXmU_GFyiagyG7aTgrOpiy9TA
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 2813
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEJguiJ9zw4tH2EnPNJtcjcM&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJguiJ9zw4tH2EnPNJtcjcM%26google_cver%3D1

43 B
1 KB

234ms
233ms

Image
image/gif

104.254.150.241
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJguiJ9zw4tH2EnPNJtcjcM%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQi4Dw4AIYwauCvQEwAQ&v=APEucNXTbTPrNwmCo4iLnVpiFdcD99yg2u8d0yjRePEGbsDm77OfvRW2WO25PIbSwpgYmf3H7xXmU_GFyiagyG7aTgrOpiy9TA

Protocol

HTTP/1.1

Server

104.254.150.241 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
AN-X-Request-Uuid: 0574537b-6eb3-46a3-912b-2908a6187ef0
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 103.209.254.58; 103.209.254.58; 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
AN-X-Request-Uuid: e0251c79-ecdf-4ee6-a56f-05f8fc9bf0d2
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJguiJ9zw4tH2EnPNJtcjcM%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 103.209.254.58; 103.209.254.58; 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2813
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE3MTIyMzg0OTAyMDc5NTA5MA%3D%3D

170 B
188 B

175ms
175ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE3MTIyMzg0OTAyMDc5NTA5MA%3D%3D

Requested by

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
AN-X-Request-Uuid: 2a090fb7-e168-42b5-8916-ead40611ebc8
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE3MTIyMzg0OTAyMDc5NTA5MA%3D%3D
Connection: keep-alive
X-Proxy-Origin: 103.209.254.58; 103.209.254.58; 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 88C6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1&C=1

43 B
766 B

406ms
295ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKv65gIQstDN9AEYu7zx0wEwAQ&v=APEucNWy0hTV3j61PhnIwg3ZzpGh5jjhvF3U0aab0xd6zQwRBlRWYJqJJNwzmMzZaX1JbGRLsWyRsIZ4S0eYwXt5QllZmh1qtA
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 88C6
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y0sgM2Q3fSISiTVypnFjZQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1

43 B
766 B

295ms
295ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKv65gIQstDN9AEYu7zx0wEwAQ&v=APEucNWy0hTV3j61PhnIwg3ZzpGh5jjhvF3U0aab0xd6zQwRBlRWYJqJJNwzmMzZaX1JbGRLsWyRsIZ4S0eYwXt5QllZmh1qtA
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBpWSYV3DdvD1Uu2v4z7EIc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 88C6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEJguiJ9zw4tH2EnPNJtcjcM&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJguiJ9zw4tH2EnPNJtcjcM%26google_cver%3D1

43 B
1 KB

235ms
229ms

Image
image/gif

104.254.150.241
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJguiJ9zw4tH2EnPNJtcjcM%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKv65gIQstDN9AEYu7zx0wEwAQ&v=APEucNWy0hTV3j61PhnIwg3ZzpGh5jjhvF3U0aab0xd6zQwRBlRWYJqJJNwzmMzZaX1JbGRLsWyRsIZ4S0eYwXt5QllZmh1qtA

Protocol

HTTP/1.1

Server

104.254.150.241 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
AN-X-Request-Uuid: 3216aaa0-292c-4b60-978d-6c7f6ab2637b
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 103.209.254.58; 103.209.254.58; 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
AN-X-Request-Uuid: 06e9f4ae-07f1-4721-b652-7aeb3cf6d2df
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJguiJ9zw4tH2EnPNJtcjcM%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 103.209.254.58; 103.209.254.58; 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 88C6
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE3MTIyMzg0OTAyMDc5NTA5MA%3D%3D

170 B
188 B

176ms
175ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE3MTIyMzg0OTAyMDc5NTA5MA%3D%3D

Requested by

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
AN-X-Request-Uuid: 5ebbfefe-911b-4b46-a43c-e120941fcfc8
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE3MTIyMzg0OTAyMDc5NTA5MA%3D%3D
Connection: keep-alive
X-Proxy-Origin: 103.209.254.58; 103.209.254.58; 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 206
Partial Content videoplayback
rr2---sn-hxa76n7z.googlevideo.com/ Frame 4A1D 1 MB
1 MB 273ms
88ms Media
video/mp4 74.125.109.199
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rr2---sn-hxa76n7z.googlevideo.com/videoplayback?expire=1665896624&ei=MCBLY-D7OMiK9fwP1_CWgAI&ip=103.209.254.58&id=fc9f966b6231ad6f&itag=18&source=youtube&requiressl=yes&mh=Lq&mm=31&mn=sn-hxa76n7z&ms=au&mv=m&mvi=2&pl=24&susc=gvp&acao=yes&ctier=L&mime=video/mp4&vprv=1&dur=24.450&lmt=1658123394693758&mt=1665867438&txp=6310224&sparams=expire,ei,ip,id,itag,source,requiressl,susc,acao,ctier,mime,vprv,dur,lmt&sig=AOq0QJ8wRAIgdFw5uLagK1jSK_7QKtkVwJ9s-3C_2Cjo1FujWLJLQI4CIE3YsTouWuUSBInd-6UqRE_M9kSqjjQYN4qWW5Wzfq4V&lsparams=mh,mm,mn,ms,mv,mvi,pl&lsig=AG3C_xAwRgIhAMxF2eU808hmzP-aOIooue0FPSvjFRB2X6gLbQrXmJuaAiEAk9Za24Rorl51wOHQN_NuMR9O7qVkE28FayyGIgqs9vU=&cpn=1zm-mUc4goauCZE5

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

74.125.109.199 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mel05s04-in-f7.1e100.net

Software

gvs 1.0 /

Resource Hash

2c0db479250b840200841d4db80d3c704464290c6bf409c185c9c30b490a0f1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=0-

Response headers

Date: Sat, 15 Oct 2022 21:03:46 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 18 Jul 2022 05:49:54 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-1051666/1051667
Cache-Control: private, max-age=28498
Cross-Origin-Resource-Policy: cross-origin
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 1051667
Expires: Sat, 15 Oct 2022 21:03:46 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 6DD6 0
54 B 646ms
236ms Ping
image/gif 74.125.20.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~l9aeoxjf&c=7860145008629&slotId=3930072504314.5&qqid=CNyRr5-R4_oCFYLScwEdZskAPg&sei=44729911%2C44730425%2C44730426%2C44752538%2C75259414%2C420706098&nsei=44714510%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=ulc&ulv=1
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/66a8e2f1e23e39b4cd24e41f6fd8475d.js?tag=video_location/web_och
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.20.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: pi-in-f94.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 5540749736361901974
tpc.googlesyndication.com/simgad/ Frame 6DD6 214 KB
214 KB 171ms
170ms Image
image/jpeg 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5540749736361901974

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/66a8e2f1e23e39b4cd24e41f6fd8475d.js?tag=video_location/web_och

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

78892a8608e0798b07121b16c98885ea085971616c5ea6ad5f49d08303d9d0be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:46 GMT
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 218912
x-xss-protection: 0
last-modified: Fri, 11 Dec 2020 06:48:52 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 15 Oct 2023 21:03:46 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 6DD6 0
0 181ms
181ms Fetch
text/html 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CIYlpMCBLY9y5HYKlz7sP5pKD8AOe947TbJKV27mkD2QQASCGm6SQAWClwKOApAGgAYSetdsByAEJqQK8AWBcRs2kPuACAKgDAcgDywSqBI4CT9BfreptEvLb94glYKhTrfCnYKCq8P8yRE-HVGILls3GEWJrUX57tVMY1rmV6WazJ4ZWZcWvYlACt9hzI4T_s-HewT6AoGOIL91RdgQWJwkX5czyZxL23g7ZJgo2YQ71bQHpHieBm_XE-Azn0zfesrJOmuw6VmXgtexCzT1sw53R7646cbfedlcJ7NQOt7bSCJ_1PK0EUK6SAXqRVGEJWdmoKAyqBtCKCxcDsOHYDmqLdi99Q7eeYZQASIG5DOd9L8KTGfd1hzpSyOE5iMwtPtF8he4YFSYW4NpcLbdnejY9efGrvQMv7uAJgQ3dDxaOCIIZYT5eJyU8-xHdutyDksYukiyqrX_9Vjwkg3gKwATmhpKW9wPgBAGSBQQIBBgBkgUECAUYBKAGLoAH5OHKpAKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBDInQLSCBAIiGEQARgdMgOKggE6AoBAgAoDyAsBmAyGhOW6igS4E6EE2BMO0BUBgBcBshceChwIABIUcHViLTk2MDI1MTk1MDI2MTgyNjIY-t58&sigh=KC_SLFS16iw&uach_m=[UACH]&cid=CAQSPwDq26N9Behk7C6btv9J8sd9JNxampycyNmhrHg2L5Qcigse8mfm3R8E3sV1pmeHOvWFhGDX9jw1VXH6jMQ5fxgBIA4&template_id=545
Requested by: Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f157.1e100.net
Software: /
Resource Hash

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 9344
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=aps&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsmaato.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=8465a01f

43 B
479 B

296ms
296ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=8465a01f

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_n-MediaNet_smrt_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: Y6DJNM7M10FDXS3JZ8JW
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Sat, 15 Oct 2022 21:03:47 GMT
via: 1.1 31d603b763553e4238110d07f30c186e.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: SIN2-P2
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=8465a01f
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: Cp6NQTUFkhyRRcD8jgyo_SjRDhi_GdLd2_buywmHy4ENYKcO8FTpTA==

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 9344
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24%7BBSW_UUID%7D
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24%7BBSW_UUID%7D
https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=3233a8c9-4115-43a5-a376-c2eb49410f10

43 B
479 B

298ms
298ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=3233a8c9-4115-43a5-a376-c2eb49410f10

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_n-MediaNet_smrt_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 9DYZXPFNHDC38C1KB070
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=3233a8c9-4115-43a5-a376-c2eb49410f10
Date: Sat, 15 Oct 2022 21:03:47 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 9344
Redirect Chain

https://cs.media.net/cksync?cs=31&type=tam&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmedia.net%26id%3D%3Cvsid%3E
https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3088694271535431000V10

43 B
479 B

536ms
297ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3088694271535431000V10

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_n-MediaNet_smrt_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:48 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: E0GAQCDP5NA50RFP1HF8
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
Server: Apache
P3P: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3088694271535431000V10
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
X-MNET-HL2: E
Expires: Sat, 15 Oct 2022 21:03:47 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 9344
Redirect Chain

https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__
https://stags.bluekai.com/site/23178?id=yV3iT-48FA3I-PiaqFP8&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG33NEZSXQY3IMFXGOZJ5MFWWC6TPNZPXIYLNEZUWIPLZKYZWSVBNGQ4EMQJTJEWVA...
https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=yV3iT-48FA3I-PiaqFP8

43 B
479 B

296ms
295ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=yV3iT-48FA3I-PiaqFP8

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_n-MediaNet_smrt_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:49 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: C9CVE14AGN06C1YJEW0V
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:49 GMT
Content-Type: text/html; charset=utf-8
Location: https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=yV3iT-48FA3I-PiaqFP8
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 101
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 6DD6 220 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bf1221985966d7da32e91ce9dbe426f6667abc7d0178dfec3e02b78a890c58c7

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame 4A1D 28 KB
28 KB 169ms
168ms Font
font/woff2 142.251.12.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f94.1e100.net

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 01:25:02 GMT
x-content-type-options: nosniff
age: 70724
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 15 Oct 2023 01:25:02 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 2FC1 41 KB
15 KB 177ms
176ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D13fsxc_dslYp6h5qYYyS3kk1qmqx10FvBKmptVT1dVyi_IXRfQoQp2hO3qHSMIY8oywJhheeJRUHJXxkSVbUACoUow7juX1TxKmn-3bB2vI9YTS0j9bOsBk8BIZyBy7Z2wiyllTQj7l-JG7PT3A16O8JOFjVM3QFUDZzc91z9b-VdHkU&cry=1&dbm_d=AKAmf-B-fp_GuCMoxWtXHqY6o2s8fy3ns7K5GqDtXlmtbqVzjeARpxR2xNLV1etkZSXfd6KotfaAoTFSIBZoCq54b2DiNUIL2TrlUvcLiK9KrlIPMEF1KbDsHRFB68zV5-n00I00eN7hQjEGleocw0H96JQwolesCIcBp_OeENCR4PZOFPhDd2gSV-vSMcB-bnReaLHi_pXNeNO_nJIDbCqpM2cfblYd27XCe9ZJ7r71xMqCFYBmOmE146GFp-2y9XBpdaCxz7dU_Q0yefs7As_xPWhGocfkwzdSTDYG-XQUtQRqvC8ATMyUOnSV9IjdxUEltGLaADqYWsSTwLxT2k_WnR170DyvaSRQ3Ve-03HEJNHZ-B2dCs6-dmaYsf1jb_37YTVaWuG_7wS4t4iSbHa_iO8WzUNOfOeYcVoh4_L8O8fZFCLFdkvjA2i-YsAlf2Tu5s164WULG3CoIpOLpkm5C4onGWlag0gMmdNDffvDB3K6wgZvlQViY0DWwEow_8qKR6n19SNp7NJheZAVyzQSwLfsGrT4TcAEWjgwqhU4K5pZaE9xcJ6pCuNBi0IIgUddQTl51GAcP-KCaamaVbZGveldvvV-k-17SwkweRS-c7dfULEIBrByASpyPNmD4IRblTUOIXnNFnAgOayP5QaFVgPJmxD6ejAUElhKOKSkXV4chXr0aZRFqiAfuDiGVI0AfB6xsxY3vogd9LAJhoh1pmdUJ-uQwGQJ0wKy7cWNun6yDr9IW9LmqCYH0tnzgDWElwExaLlu4q_KlJshoW2YODlGVQ7Cq4X0nskxFscCs2mHmeaKy8UUOa8LEoqFqpCAnld-y8KSTAWD3sqo8gUyMVvfslkSv-b9rKZ9oIXfyBmD_8H7brUl9b_NB-BVA_qTsKOh6tEeSfHtC7rPXvPGQz92F2pwjGkliJoS2NekjDOOzEN0ax3FsHcjmMP6XZHdOEri3ORwpX-7TDH1VFmS40kUYXikZGhrEgQrHqXfiQ3UyFIcRYgnMpF6Y_AyHz_mtFpSWPN8326m7287Fgin81mul7ek2_lnDNeLoAx3VWdbDzITBP7kBpmIyABXKmj--dYdLnaV8ER3rluI8rgomO1-kO9HuH70_7RGsNP76iAvm9RNfcPvkUJ5THhLUSINlupH2c8oGn4HCv6MfXZS-YNUPp5WImrKJgoOUkLBAPBKqLdMJH-VdclEfOqckPkjdSOvGfwkPrxgJCSbWvo1zsbPDtTsZWprqfRc9AuSEQf6AMF4PS1hcFn070LZlUyQHMFlSODv8nkhxUYnX0mmAi9Gwv5KLQ1rineqF-3QiwOhpDQ86-oul7xPqX98bWIX6PvGpDULisEVkClpb9tQ9KEXDbFnZwkyD4KJvj43UwMXoUR7RPEwE8oNleoNf_W2-ZdP0nzL8En6XoF-chgk-AtSjhLVAsKvyB0dEp2bgh05Ae8N7QVzZddS2Ytbmzs3eaqxJ0Li4nByLGo_3s-28qynK_PbxMj359vLZIe_oTVXOj6CfGnXHsPr1wtqru7Ym4zt3cto_mgVP4GVM764o7XDmtNdkk-igWN5hY8nxEsI-AvD8gq38-AKfY1MDiLGwnlrh6RVLxFS7ppljC630ltZRfb1mG9dlSD5U6LWjpZsvCu4x4eOVCZMdt-OFm8exdRhhWdosvKZbFyEVqSxbZDvYnVTt7f0qTl0Y67OVVjgOouZ-PYwK7o1xcWKXQv1kUpIETZV66fgAA6Wenw8JEiDwzVLlebdvVXwZWTSKiDl_1r9L__mMo1ODMcLNPsi4lJYQU7GjU0diu3zKGutW6dlt38i-HyqMH2H5CMt0AS30ykGUEW_oMTk7zhFPJ4lb88NKVGy4QlvXwRvwxdGWzMcj5pmnG_Jp9MPkDqYKB88a8-uRNs1HpV6xS3IDBSVd5DULVdGV5ueJy9gfUeGX5LJG1gnpWXEzgCPTlrn8MeZlktUDWLoIxCsKsEa1ykX8ZCe-a2qfX5o48bgJF9l6a2opt0Loh1NIjVVWGFOv7ksLxAFOasrUcY4idkOfzaEZgceVgWdHLSqDXFN0V7oqGeD8JXNiJOeMwovPakzO1WNE4-c_hzcnu4Ea00qdzKgLxb3ol0fm9SJ-3bX6QVgBcCU_NqLVf2TADonnVVhLXTfJaS3O9lHPhVx-M7iyr0oBoJlnGTlxjKvF3hc1TC7AZrUeDjSL4hZXusNWl9PYmsagRTt30fsT-jw2K_LqJ7fMDZRFzgLg0y402WIMG43g5FBK60e7ViMjljc0l84trvMlHXKSxxwLlLOqSvYCD4J4-9B90Qfcc8D5TXCMIK6eHN_TJfhboAPrcZtXSgcrHSyImPOoS553Bkdn-stU5nWAkcgU43FcuncHtQgyApmcs6DT4jxnQyvD7CGNLsO141SvW8CW1y5d62f2yvYSW_dm6WTsH0bpNdxI4UAqBljR4X6SkmLU9I0F4RmuxtyBCGk1s3qZ-aVGDp0A2mqVnEr2KiYeuqfDURgsh4rjCkOlRMdqRmwSij7imEJ7SrZNKK2jgl7xGB7Avd2wQyeH8nK6zmjOVJc8T1lybrh1g8vCBxFYql-i3pUMva116LAYqSyChFFPZ156rIaj3dUY9Dnxmpz4fgOAiLWnJju3GgQeMO7S6Ty_6o0dOB_3cuNIpBAqNZVkOf2e5oaSAlmlHESXDtO4c2bx9p65XOgQ0BX8UqMG5u1Z1tHaVnEvFHVuVU_22ZSNERlZlS1-CzMqiXuHevRlkmYOnP26dJHQkgIYUY9a_QakpTo9JqaGdj7s1M5W3E7j-a6nv7flBQDtfYKojQynVkPAX6QyRajZjfeAfgFYgqb3qm-fuEtXzuME6UpRaete8IubxAZCyixLMaywk5fkGeawZaUVGXyP92n1WPbfkyXpoM_rI5DEmp3ZPKdB8iMSv0SfG2L6mmBQlm9lK4kz0bMdlyXlyv3jI2GbCnSSa4GLGHGKMvhvRD0nJwAksmbD9aqalaihD2RcrhRyuPqyO4U5O0roqlSh7jp-5Fs814CpQHp7Jfb13iLJ10EcHBGmNC5Ute7ghr5ZLBkDkC9Z0OyeXlRckzYyIKn1Y_sF9ESCT0BUFvbldJqTFEKbPMhlksjMviCDw7KH5o1phsftvPXcyINkrJE4t8qzvkACW1c9XdMmymRAGTXc-FXYzwdBGmbSR36UiU1YpWqj4bV543b__4tjduIOc2sbxI4SUqZRpUOqmxMzNj7ejeUNB9dhSb0DpiLJUvSW6-HdaYUEwUnAAgYTWg3M0ODDeG56id4xlXGbC5i-iIOBPtv0Z0HZSOGGlnYxkNFLmIhO6ninZpj&cid=CAQSPwDq26N9Behk7C6btv9J8sd9JNxampycyNmhrHg2L5Qcigse8mfm3R8E3sV1pmeHOvWFhGDX9jw1VXH6jMQ5fxgBIA4&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 18:23:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 268829
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Oct 2023 18:23:17 GMT

GET
H/1.1 206
Partial Content videoplayback
rr2---sn-hxa76n7z.googlevideo.com/ Frame 6DD6 1 MB
1 MB 261ms
88ms Media
video/mp4 74.125.109.199
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rr2---sn-hxa76n7z.googlevideo.com/videoplayback?expire=1665896624&ei=MCBLY9TeOOePg8UPq_G2sAs&ip=103.209.254.58&id=fc9f966b6231ad6f&itag=18&source=youtube&requiressl=yes&mh=Lq&mm=31&mn=sn-hxa76n7z&ms=au&mv=m&mvi=2&pl=24&susc=gvp&acao=yes&ctier=L&mime=video/mp4&vprv=1&dur=24.450&lmt=1658123394693758&mt=1665867438&txp=6310224&sparams=expire,ei,ip,id,itag,source,requiressl,susc,acao,ctier,mime,vprv,dur,lmt&sig=AOq0QJ8wRgIhAPXs8wx6NfiJFd00Ni3sBXAjXbtQHUD1bhQBTthVDC7wAiEAi4-gnt-BfVc12lBqXDmVUbF4A5xZAzaHglX807TOvMo=&lsparams=mh,mm,mn,ms,mv,mvi,pl&lsig=AG3C_xAwRAIgKdYLAGwMHHtXjb8XXox1ZD7l6MGPwIn-7V3IeBvZVcYCICE_zfAC0prHiu6LjJ5ezEZA5-eI0jb_vNabtNWPbZGG&cpn=wcHqusvfDOfzPzDr

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

74.125.109.199 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mel05s04-in-f7.1e100.net

Software

gvs 1.0 /

Resource Hash

2c0db479250b840200841d4db80d3c704464290c6bf409c185c9c30b490a0f1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=0-

Response headers

Date: Sat, 15 Oct 2022 21:03:46 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 18 Jul 2022 05:49:54 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-1051666/1051667
Cache-Control: private, max-age=28498
Cross-Origin-Resource-Policy: cross-origin
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 1051667
Expires: Sat, 15 Oct 2022 21:03:46 GMT

GET
H2 200 10341777395138636941
s0.2mdn.net/simgad/ Frame AED3 43 KB
43 KB 472ms
171ms Image
image/jpeg 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10341777395138636941

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BdFMX3ZQ5LADfqwSPmqeXRsBhs2CwvtH4TF7BR4zPJO2PDdjvi9TNP1xiOabYl4ZnPRuq-ktUB3TPFsEpk6ydAVMhd2A&cry=1&dbm_d=AKAmf-A3iALSqAs_-anxzXJIivJNnJ1M3kSCB2N7UQ2vBj1UktdWj5sKgbl3FLvFmtPizRq-Y0m4MIwoLls1LQLA1mX7yGynVwHNdNVSBiXI1Z-N2GF6IpFtiRbsdH1uBlNpXwRwJAsO_vRtxGz39iOeHFv43Kk3xgkrUOi586lwh9Ac9LsZfHblIjpwea66gTrY1ThFFZlMJgl4ue3QWD3hFPDjYEge_cRqgA_TBL22HCfF9HMQ5V5mtpeEUU_-WuBOVTD97cKReIodRxEHobmFs923yMrbk0L6yTbCdC5NeH7iM49CQH3XZj6MnuttZXeV24lGz6t2r9b-HbsAtX6jUVNAGiLVRNzO7Fxq7TF_IKYlBbuIeQ32hoIloh75eTbTIWyp542v7gEqo_eNFrcoeFdD_ZOTBOFXa7P4JNK6FX0mJxv2qV5NUqqQIIYU4hfh4nDtuEfqnLJfkeczqC9uWDMXeNYVLz0vwn6tagWbDHB1U0Ws4ezbSRw7TrC-aRB78gmROl26_St4VXbWU3qi4Rh3SKs5PATWHTAjR1qTrALir-VzS13jw1A0NkJpb4RYhQ-Ous7rOLhF4l4E2QgjMuzU_3ZdKEBglVxzmvtG2uN23cHwdwtW8lNu1QvNxyN4xDU-mh5sqIn1Hl4goq6Nq7sEUPUnmfFMUbW6gWMEnEysjsiNCEee9Qj8aoNn79pQroz5DCN9kuXQrVNr9w_vqWClN4_Ep_Oc9VVadu_dtbTFkegmrhXKcclDWgjTwAoBePAZY2fD0sb6Usnnb8k2rIFojYtsR79mZ399PhPzCL70xOZAhnyDmZKtHvKy3vyew4SVhcH13NkNmFJJa0PpEwg7Fn1CWP-knLF6C3urZMEnoE6CfR1usKS0pAjxXZI_x28hVY-NJ29Jz2sYQYPavaHUflkw9jsMfb0cEfTNcBxpxwl_xasWP31N_TbsQdv-mcuboLRoaq-l2pN-29a0GOld4lkOcxUp2Kz2hAzCC0w0NZOnfmdfPFx4kkpR8P20SMz5Nx2jkbCeC2TV1SWU-v98AVZxiihx1kX9B5QjfYEKG-kDH_YoS8iK5IagzOP-OL0uiOHCLKqLX4m8bZx9zvc85dYCjfRh8g68zx90lag0I7NVIw1YcdTeRghr6UtVUr5XrwkQtCI8R9OQD9mhmC7j-v-jVwKsgWJEdNJVFqO6YSgj7tBtuQ2CAN2MDasw7mos8rkOj4zkCax2TdYseoa59coaBz3nAyWIl9J6kGOsTVyXkj3eOC8EtaBhj6W4YQihdZa_QNUy1mg4N9gnDTaJoMea9GgQKcXUBS4Hxy1A13lt8OaefbUa6tbwboxvK_ib6k-TWC6cpC2ZFml48k6QVnGH5YlZ594ZxOdSwiYP6HL5xYUXzzJLDm2qhGJZ7iOohe-QZF20ys2GHCYMu0Sge-rQuL-rKPK2LSlAqWaB3gu_Uac-RT3w095D6-o6YGlmyWzibGGJH0GlOKWgG_avJmz-3ZlwV885Yg-tYBVoK47resTE4kVhaCEsnKg1iMvJBsgCo-gWxVULUoJGXyhVCT7e1NPu2eNLaL4fBeLwiqMO2gBkON7uOS1VkEK4NZeIh4wOqwElvX3HgQ-zAE223W_ecxureep47ISfGCPk4zCRj8CrHLyqwEphBkBYI8QMMYqb7YDdGj61-BoVdq1zAlqqpuoetNCAjynXqs3UNHFYfAhWkiw4czjrkKM607Xjn0l217iuM_sEuPR_hrC5UpZIa67M9gVfh_zyXJDFRrnJNRSwtaWxo-U3mvGVlvSGjlgBMQn85ZwAL5TI-4QvAH-ki1o7eRV2mCS0dVZZYkvZlBxP1iEbqWkzwVL6PRDx8E25BbyPKwM_MFz4U1TWrEFOlT3vNaJ_YHH36ts8HS0u31Rys4sJfve3LALPwn4twB44-3vtZj10MfJiCCep1sFygwjimGgG9d9xjuxnhoTfZM__PirNpLRBc4uGcBbypX01cDcXfsAIBGrygoDqCh-QnN9NsqOOex-mpV3IiI5ZIY6v3-Fdj3zZdOqFVONTXKywd3fxEQRioh_j5ACcg6q7QsTan-hF-i_OhoQy6YcPSFrN1C61IfmD1Y6Aj6KkTakMyJDizejAI3juyQiEuEluNPvcBDeq-okpEtqLOPkzny_EccXFdH1OsQ24zqrLI7G6iXmBhHPKc5mntIf-gkexNcuLoounqGRtnvsvW39uNw5OAtyKxdDY8SB4aY8FLKjXGMILjPTVuV3L15wkBtXH1pBNKW2LfKNoMsFmcNmeNIp5zsOouiridprS7kohL9o9S3lSHn7WxvcOIHdQDxdTZZvjYbjLdP4eWj4QHF1ZH97P0-CpOdNAcUsDhOVZtXdHSr8x4rAc8zgTsroBcr4j-gUWZqVvEkBqwLKqm4nVmP4bovTyhvKr7kXkL5S3SG_E--_aXpP-wImngzYcqCDUpf19HW7Zjs2nn5UhZm2DlDvkIxABHHtC5qtt3DP7cRbhezqH1xLGZFh3qBwPuxUvMS4ceKpX_gVaBB-GzGZMjvufLNmmEaUJtBGIpudivNG8yKGek5TDae5Yzqs1YRB5a9DodZi9uRVUhJS99sx6_S_GerUWxZ-t0sJ_efqUFUuHDQeOGW2sOEuYOEt9jyzv05LVylNJ3xKoQhn9lhsREBw-QnlCKLBvH54M1iypstRT7oD6DvE9Wvf5QR5hm0O8CN9RgCCqwprgzB1ZwbiJM1DVFna7U6GBKPsX0mqn6aZ2RC6JxOp91LyTNn5z0R4t7yGoEiI6W6K4Jfih03nA-JxIa_fHUya7BTx9MQ1NGrSE8emu1nJvaJGD1oyJx8_O8B2iEf4L7mIKnblc294Ru9EZSkiRj1W56EG4i98KiH8xMjBaHXF6fOqgkZVsIJkEF8z6wGy1PHi_ifTXowT3x4rbLjGAEQLdz9RLoMagpDLtVEL7QvbClxC92eKTYsL_XfliBNbBhBX5C3xP42dlt7Hm4sTAxx14Ne92WTs7n1CS--A7llt2TxBX3uzgOHMCGa22WCVtSJcQgNaXKIW7asE4SFujYogb1vFS1IQTAMVa4LfyOusOlH9xD3ihacjtBZJYmdxWT-jS97m_5F_I1GnyTGJcyQ4T8-0nZKi0ETJeK3rEOwXYKOAeemiIkKSLGvkmr3JXfocUC4yA_OXKHPmywtkB96L0jzHl7c-FzdLH9tPDM6XZ9ub7naqjGIWO4cHq6MlE-TCS6sqWG-MfCO5in-ctYqNjyaMPu2EwHT6xEb2K_FyG9nKxtxVBNw9TYgbhecuEZnMH7T3wCja3aobtubv0a4uRPWg07wZLvs10&cid=CAQSPwDq26N9Behk7C6btv9J8sd9JNxampycyNmhrHg2L5Qcigse8mfm3R8E3sV1pmeHOvWFhGDX9jw1VXH6jMQ5fxgBIA4&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f148.1e100.net

Software

sffe /

Resource Hash

277c2feef0a479fec8d6dff68ec2bf47b1a74e3fe07fff001039f6f802fd6222

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:46 GMT
x-content-type-options: nosniff
age: 1
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43718
x-xss-protection: 0
last-modified: Wed, 21 Sep 2022 09:01:15 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 15 Oct 2023 21:03:46 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/ Frame AED3 30 KB
11 KB 170ms
170ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

b3c218f921126409f2f4a82b74458117039037330ffb76b30df5c6062b353a90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 18:51:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7915
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11730
x-xss-protection: 0
server: cafe
etag: 9319256901541695429
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 29 Oct 2022 18:51:51 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/elements/html/ Frame AED3 8 KB
3 KB 181ms
181ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 18:51:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7915
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 29 Oct 2022 18:51:51 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame AED3 0
64 B 293ms
185ms Ping
image/gif 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvMIT0zCOC9pFKiqxHrQN5Y88U0Y6boL81SvEQPRILgajEQGDpkFx-Hvdw4xNp6fX1PMCc0xHgG3Pi39fVEIEppf83uVyT4DT4XPk_lN4mj7yJBUniaD7vqNEmpldzbxMjbLKgzbkkwznUPRApr38aGJrv6DRagJ6Dxrr8o5DJxVzBlST85Ul5MbluEgtrE_BwGW9O6NkEN-ripFNMwyMcr3oF1Qw6NedKE3h1hk7cXiZznTQwQuS_InO69pU8fKoqTeb-I8Xo9ysYal-tfaIB57HwmLGuKRsxtLnVS1deeY1GBxXHqdaFf4ecXMnwQC86r2C7XKg3Zso956aWwX7sA7C65XMDWFM2CEoj6xnnXDGamhk-5FV95V-QsqcK04lxNHPC_Dnw3U2bbuZvKRT8qy-GivmAtL5kMep3SUEFM9OIRT6k6Jop5-IUnnPK4X4fv3FBoG561nvIXCyv_kM5g_fHWpVNpH9zLtAn2TTzEh-f0OIvP5sbpGw8QCr92WzYnZB1PdXdvfYEfNSFptACrPw2pzTXCJ7FnzsisggiQ-AD5RSFDZYYtsbR1Ae_MsnwqQVSUPR14qaWXSMBd_SYjhdVVDQea5fTPYw_iMAZOaYoa-Ldh0Frl3z5NeL_Ckw4HJHEab-M8i9jiBVx6fdJdhsxpSWOwO1L8k2IorUT0SySbAWRIXZsXR_hkGJ8eBJr09yR-1COWyO4bwdWptmk6ZxxEzNXoueWLNPaz63a3lDrsaAGBJYu2sK5Ewdxki5Pml0H-DoRCNOtQBhrGOpN1nLsUkfdlVqTLuZveN4ITiaKw3SrNrCR5bdL-9KWfwmlxZsEcPZmW5kC7-yClpUt4o33PdQ3JN4jSsVZrVGce4g3uUTc7ZmxbFf7mWfWPtCvhC-GnMnC8Ab-69lF2L1Szr4DL-5LulOQN5xje2fexBch3vA_K5jG-ROG2XeK-y1oaeJH2Lx2BPKFWoSmygQztJuKhK-BB8NbLVO15O3rqMDXzNk5D7MjCamTthFy25GZ1ZMGN7FV14iOr-PcvmBZ_0uVA3FdNXS_JYPL8o-NLl_BgLF5cebtRswmwAhPdBMkTBEoURHqVf86B0YFoFupRyqfbq7PLh1TR-19b8RN61vSuJm5OjKCEB-63USEGMomNxIRe-QENTXQeGmTH5Wb3u0LEwDvMUx0OkTzpcayuZ3JguZcnvwDqnjfNFKU&sai=AMfl-YQHLloweWMc4dlMBKApGzqEdCFiP1yIZ9D8EY3Bs-EicnJ1GQkowzFqVAAq6FvH4AqH4ZoDojgDKWzRdSKA5D_-AjZOZFkjWRx0fBPUb4c3XwBBcq6yKXWCZwE9EbhHYBY0hZO-EGrrB8wzYGjEvL1koQ7H8fK36G1qk24Z_DmaawN1nTKmrZzzqRUkVVj5DPozMNXJX3jaqKmiBRwGChRVThFoeqqy3MVpmWW3HayapUvCpyekAgGGR1irGqy2Sv0r6DKippcbsngpANLVwoU&sig=Cg0ArKJSzIBcCL2t8H7OEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20221012.57648&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 15 Oct 2022 21:03:46 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame AED3 41 KB
15 KB 176ms
176ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 18:23:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 268829
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Oct 2023 18:23:17 GMT

GET
H2 200 / Show response
match.sharethrough.com/jwumXNuB/v1/ Frame CCE4 427 B
613 B 563ms
172ms Document
text/html 52.220.251.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_n-MediaNet_smrt_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.220.251.156 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-220-251-156.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: aa693f03b1d3fd450ae3ddae706633e08bbedb1f4277670a1c4056aece5c9fcc

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

content-length: 427
date: Sat, 15 Oct 2022 21:03:47 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 2760 15 KB
6 KB 953ms
316ms Document
text/html 104.65.228.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_n-MediaNet_smrt_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.65.228.208 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-65-228-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=160085
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Sat, 15 Oct 2022 21:03:47 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Mon, 17 Oct 2022 17:31:52 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame C374 281 B
554 B 529ms
170ms Document
text/html 23.9.185.218
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_n-MediaNet_smrt_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.9.185.218 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-9-185-218.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sat, 15 Oct 2022 21:03:47 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 1CE2
Redirect Chain

https://ssbsync-us.smartadserver.com/api/sync?callerId=2
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=7733999678171328375&gdpr=0&gdpr_consent=

43 B
479 B

295ms
295ms

Document
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=7733999678171328375&gdpr=0&gdpr_consent=

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_n-MediaNet_smrt_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Sat, 15 Oct 2022 21:03:47 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: 136KM6GZ9S6BSHFA0SW4

Redirect headers

content-length: 0
date: Sat, 15 Oct 2022 21:03:46 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=7733999678171328375&gdpr=0&gdpr_consent=

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame 6DD6 28 KB
28 KB 176ms
175ms Font
font/woff2 142.251.12.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f94.1e100.net

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 01:25:02 GMT
x-content-type-options: nosniff
age: 70724
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 15 Oct 2023 01:25:02 GMT

GET
H/1.1 200
OK dvbs_src_internal109.js Show response
cdn.doubleverify.com/ Frame 2FC1 59 KB
19 KB 193ms
193ms Script
application/javascript 23.36.254.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src_internal109.js
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=1828362&cmp=115751&plc=4166890&sid=18330&dvregion=0&unit=160x600&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&prr=1&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0gMAbPlYc8NvEzL0hZ18-hA&DVP_DBM_1=3060631&DVP_DBM_2=24867964&DVP_DBM_3=15215462632&DVP_DBM_4=396400065&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=201491245482&turl=https://pastelink.net/wwr50xs3&DVP_PP_BUNDLE_ID=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.254.7 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-254-7.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: e9881b639c7528a358803222a3d5b1ea1fae69ede0ad9ee2e363be38a2712302

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 15 Oct 2022 21:03:46 GMT
Content-Encoding: gzip
Last-Modified: Mon, 29 Aug 2022 13:20:14 GMT
Server: Microsoft-IIS/10.0
ETag: "03bb312aabbd81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19455

GET
H2

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A8E4
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
170 B

474ms
173ms

Document
text/html

172.217.194.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 21:03:47 GMT
expires: Sat, 15 Oct 2022 21:03:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 21:03:46 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 7290 22 KB
8 KB 169ms
168ms Document
text/html 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 311317
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 12 Oct 2022 06:35:09 GMT
expires: Thu, 12 Oct 2023 06:35:09 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame AED6 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e81e653e6d3b349628f196fc41799f4a55a01a921ed01f0412bfaa985486122a

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 173ms
173ms Image
text/html 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022101301&jk=3603762764478711&bg=!OjmlOX3NAAYeOJy_Pjg7ACkAdvg8WnvMbTzG6ul_6gz4aXkSbOZSpRn3hvM-dhOjsQTtSPY7IFZkxAIAAABmUgAAAAJoAQcKAL7In3X1AtgLX0R_wGI1Gg8VyCslUPKfAmFCqdL-RqzRZiB_Vp-rdVaAzIz4tQfm2yqABp7AogHbH9ih-2mZskcHPBNtTxXaw15NDUhBHK3Ry3sjEDfZDWTxPHP3enHfcu3kBCG0lFlmV3RxS-yJpoBkwgoMyAJ1PpjnzhV3nAU-ZwYd3fP1otCX2K09aCD2Z0F8JKkv6nUSaK3gZqcKmNZOOjLjIVCd-BkrQUQiwGECoJd04ZseRUICt4f6TlL5mQKjv5qK8jRc5bXaC_gOrWnmtKKtSiI0Kav_PPbuKO0e3Ds_eaNSjbSXY0rbZYD6qx-NfQPfGZcZRJz1TjlqzHaYOPWtBBmCYJ9NhbWzBNdwVRlBbl1PQd6uQe_LSw0WPn7hUtip76TspJN9_-jrvdXN7Wx2DKseEebjRwxLgCdZ4YVYZ-ogUTrEAg1puCJM-LqElHDgNF0YmpgiQ1skghY2YQnWYLMJxMHtoURMqdbL4HATOYUMh8ybvimvkessudOJPqNVjhlcl8xRnBUYAVSjgfwV7dJH3H8CrlaKvUUWIdS56TBiQYjXMN4PA6gF2BV_cvqvncN6bAHm4b-9BntQATPouv0Xm7dmBIbI8Q0-GvCGIcK_Magl7IzrzuJUlJxWSL9Ry-rzF9p3e4fc7NBW3pdalDUl7kOJqgf3bX_uvAlOCJOBnLZ0nKOkO3TJMehoK9ROCuAWL2zoIfDdqDkPwx4lL6S1qFZAwIJx7q9Hw-oIHG22MENfDg3Q_v3wWwa37T4yiWomuRX_jf84XOATPCLqCM_9Cagi90SLrZSDfXRNL134nA9T4Fppe0u8rfvKw7K9uKY_aIuWdNNjzxdA67S1pk3PauCz6XHjnvs0-v_8Wg9kkHOz0fg2_SjEfzDHjKpV9mY_9LbZ-dMMYgoPO4eP-3NuUsjOrUMiHnzjdkiqPmdR_bfuQv60fS6Uq2BSWXd6jwiQy9HMXdVJuIAaO7gb1RmdO23UaxkWdJ6GvLyhORj5t4fjt4p8Sd0s7kzC4DwTpVF4vBRLfoHMg_vU1KCiu6ZSK9dSf6k68p3rhMk-bospNHoGpZcMYVIKcRlrouIPX1CvDN71WycGjywnd8ZqCrThPO_zVEeB6MfUGGQ8salwHaA2cM2AZkf5JR-8wJNp
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f157.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js Show response
pagead2.googlesyndication.com/bg/ Frame ED6B 36 KB
16 KB 170ms
170ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

71f2940ec78bc4c5ff54c23fb9aa3faead0c28e69e0ab83c1998d21719a8b46f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 19:19:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 265430
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 11 Oct 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 12 Oct 2023 19:19:56 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 137E 41 KB
15 KB 169ms
169ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 18:23:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 268829
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Oct 2023 18:23:17 GMT

GET
DATA 200
OK truncated
/ Frame 137E 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d611cb158976ef0f0853abc81e8c095f889f4c9c954610f80eb90fa554e94bbb

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame D558 22 KB
8 KB 169ms
168ms Document
text/html 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 311317
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 12 Oct 2022 06:35:09 GMT
expires: Thu, 12 Oct 2023 06:35:09 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 bg_600.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/252410901119672947/images/ Frame 4BEB 47 KB
47 KB 173ms
173ms Image
image/jpeg 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/252410901119672947/images/bg_600.jpg?1662302269722

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

430d2d537dde971ff390bca2f486887d2e12e4daf92696e0393d011cff2d863b

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Sat, 15 Oct 2022 21:03:47 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47635
x-xss-protection: 0
last-modified: Sun, 04 Sep 2022 15:04:40 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 15 Oct 2023 21:03:47 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 5340 22 KB
8 KB 169ms
168ms Document
text/html 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 311318
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 12 Oct 2022 06:35:09 GMT
expires: Thu, 12 Oct 2023 06:35:09 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame AED3 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c691be9884c456280417d5ad966d7cfe6bd0a5dc00fbf60c2e1775607a41aed4

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js Show response
pagead2.googlesyndication.com/bg/ Frame 4BEB 36 KB
16 KB 170ms
170ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

71f2940ec78bc4c5ff54c23fb9aa3faead0c28e69e0ab83c1998d21719a8b46f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 19:19:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 265431
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 11 Oct 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 12 Oct 2023 19:19:56 GMT

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 2FC1 1 KB
899 B 1422ms
195ms Script
text/javascript 34.149.43.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?flvr=0&jsCallback=__verify_callback_280511229105&jsTagObjCallback=__tagObject_callback_280511229105&num=6&ctx=1828362&cmp=115751&plc=4166890&sid=18330&advid=&adsrv=&unit=160x600&isdvvid=&uid=280511229105&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&nav_pltfrm=Win32&dvp_strhd=0.40&dvpx_strhd=0.40&brid=3&brver=89&bridua=3&dup=null&turl=https://pastelink.net/wwr50xs3&srcurlD=0&ssl=1&refD=1&htmlmsging=1&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0gMAbPlYc8NvEzL0hZ18-hA&DVP_DBM_1=3060631&DVP_DBM_2=24867964&DVP_DBM_3=15215462632&DVP_DBM_4=396400065&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=201491245482&DVP_PP_BUNDLE_ID=&prr=1&aUrlD=-1&m1=13&noc=4&fcifrms=11&brh=2&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=157&eparams=DC4FC%3Dl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETar9EEADTbpTauTaua57hech2bhc5_2eec3a7%607d3d6d777f_%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3EU2%26C%3Dl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETauHHCd_IDb&dvp_exetime=6.80&callbackName=__verify_callback_280511229105
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal109.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.43.113 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 113.43.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 04b0100c247e9cfe0a22758dbfae4e4ec4562548e6af186d03f76943ccac7b47

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:48 GMT
Content-Encoding: br
X-DV-Response: 1
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Connection: close
Expires: 10/14/2022 21:03:48

GET
H3 200 cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js Show response
pagead2.googlesyndication.com/bg/ Frame 7290 36 KB
16 KB 171ms
170ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

71f2940ec78bc4c5ff54c23fb9aa3faead0c28e69e0ab83c1998d21719a8b46f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 19:19:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 265431
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 11 Oct 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 12 Oct 2023 19:19:56 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame AED6 0
63 B 476ms
175ms Ping
image/gif 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:47 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame D516 22 KB
8 KB 169ms
168ms Document
text/html 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 311318
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 12 Oct 2022 06:35:09 GMT
expires: Thu, 12 Oct 2023 06:35:09 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 137E 0
20 B 172ms
172ms Image
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodarir&v=30&d=1&s=1&f=0.01&bgai=BDyGmMiBLY5KPDP614t4Prv6g-AQAAAAAOAHgBAI

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js Show response
pagead2.googlesyndication.com/bg/ Frame 8B41 36 KB
16 KB 171ms
170ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

71f2940ec78bc4c5ff54c23fb9aa3faead0c28e69e0ab83c1998d21719a8b46f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 19:19:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 265431
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 11 Oct 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 12 Oct 2023 19:19:56 GMT

GET
H3 200 cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js Show response
pagead2.googlesyndication.com/bg/ Frame D558 36 KB
16 KB 170ms
170ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

71f2940ec78bc4c5ff54c23fb9aa3faead0c28e69e0ab83c1998d21719a8b46f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 19:19:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 265431
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 11 Oct 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 12 Oct 2023 19:19:56 GMT

GET
H3 200 cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js Show response
pagead2.googlesyndication.com/bg/ Frame 5340 36 KB
16 KB 170ms
170ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

71f2940ec78bc4c5ff54c23fb9aa3faead0c28e69e0ab83c1998d21719a8b46f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 19:19:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 265431
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 11 Oct 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 12 Oct 2023 19:19:56 GMT

GET
H3 200 cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js Show response
pagead2.googlesyndication.com/bg/ Frame 085C 36 KB
16 KB 170ms
170ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

71f2940ec78bc4c5ff54c23fb9aa3faead0c28e69e0ab83c1998d21719a8b46f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 19:19:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 265431
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 11 Oct 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 12 Oct 2023 19:19:56 GMT

GET
H3 200 cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js Show response
pagead2.googlesyndication.com/bg/ Frame D516 36 KB
16 KB 170ms
170ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

71f2940ec78bc4c5ff54c23fb9aa3faead0c28e69e0ab83c1998d21719a8b46f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 19:19:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 265431
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 11 Oct 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 12 Oct 2023 19:19:56 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame AED3 0
26 B 331ms
179ms Ping
image/gif 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:47 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame C374 31 KB
10 KB 171ms
171ms Script
text/html 23.9.185.218
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.9.185.218 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-9-185-218.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: adc95bbf12184c1a406a301d34ffb8a8fbfa10ab0639ce675eb2476a317e7c37

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 15 Oct 2022 21:03:47 GMT
Content-Encoding: gzip
Last-Modified: Thu, 15 Sep 2022 22:38:47 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=67403
Connection: keep-alive
Content-Length: 9422
Expires: Sun, 16 Oct 2022 15:47:10 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/8276465137012464354/ Frame FDAC 89 KB
21 KB 172ms
171ms Document
text/html 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/8276465137012464354/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f148.1e100.net

Software

sffe /

Resource Hash

018420e737716b45749449e1c26e06190371aa7a83a7406a1f44c3fd105521bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 2219
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 21037
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 20:26:48 GMT
expires: Sun, 15 Oct 2023 20:26:48 GMT
last-modified: Wed, 28 Sep 2022 02:27:39 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 137E 0
27 B 275ms
186ms Ping
image/gif 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu6QfXUQDL6i_KZUxX7fbb_n2R86TQfJr_bVmJC7nL_1PDw9WN59pupii39gzfxiJLEVtofdJ2eHpYZjikgjCacNcBUfG_QXp3by0BEe9og_4-n5aGIT52rA3Yi7QzKk8AWFuN-0FI-uIlFpsiH9TxT9keDLRziitvAuijkGFqa09zJQHnvO1UJ_ddwa7Tx_1fdjlUt-3fDxr-ATa7taFDzfFWFL8SglkggovtWFB9-8llI9BdBEbc9cYBEspX1WkWBLNNB79cmldy7cjflHEhfrFt3ycoqpPeX4TTOqIQKf1jLG29kcGJKOdRJt1BOk-FPYVRbj8WCy9hOoG1WQEpxermSP4qAbHMGGxN6bW8vKZGiaPzgnBObvtrP4u8CJ2nKA6_q2Dca4xnlyITfsbrMtm8P7YvfBE2fA_irN8LmTmxy_bIxesnQNFayPpp4xIhEdTZbI02IvLcVlMg1Gqm6Ni1cbJredqQ6FABZwr05fnnI8Fow8O6HJzoxu9WolYF23C4bd3P50KwnHe27BLY_pZSYNAGlq4bAQiL-YiAB8t3pzXucd1Uhb4qCNAdllle_2DpDG_9XHEF4EjWjXh7HAFz5HrJNRqK5Au1kgZwYbHW10h2wUF0dkuN0Li2USW7ryKZVd459XiVlK7FvfCCbXNsr_vWNlAoXJ_nV7zhh94qGHH_z0yrSuqoCBG02XUe0VRQ2pKNQlA_vsiEK8RvP3DklbGTOtzh0-D5TmAtPDsKICj1XbSWv8YhLhuEGVv3IlqK55IcetcqV2naRdAqkwTcRZBJbZydpBjKdNOvwx4AXUSVXw51f5inlON3Zp2Mr0WmE11P67byDZGut7FLncfeF_07Kq19Sr2L7k06yQ1H3Jelqf_fq90WeylxlyjmC6RzA-i7yt39WqsZjzaW-t6oQjkrG6fbKzq2HO2rmKi_lTkdVvhAObWboptDpzcu30_bgpreIaDoVZtN97rVSAJoXver4DxwlWUhksE-WLdDLcXsbtxtRvmzAcbkR7wN8sXI-VV1q4AQbcxQQIQtHg8RzknJMN3i0DEG6gfYuOlWOXOVPk-ULRLCxh0yb3_hztvuXeIkVrdIHr-9IXxQTb5hlcBbrWA5slYFh-8xUSPU2kWT82f069Me0DlUcY4ES1w_aM43qkP_n2iqmy_i_Is6_LkorU5O0jEQOm9NleWmPcQchrxj7H0v_pMsM6LnQgGRy-m6DOQ&sai=AMfl-YSNf9w9KviJGAxdzj7g0Qj40svDCjD4YKBNuz0sreLEAOXlRslzCU29VztPQpYwCixEmprPx4SkZQlKgaqiYDILaNurwADn7weWT9QXpli23hHXpLj8pAJ11_y3UZyudcSR5M2AwDZR6QAeHOevWIt4MXb2m-vRrkNEYzRnD8Fd_UzaAqD-d7O0osMjVqD2kpd4zPUnOSqWJXGDAFFpoa4Uc8iiDpw8qFWpXBxEeAwzzri5g7wzGu-QM445btDyf2lwm8ECLwOYQSwGIEeB1Sg&sig=Cg0ArKJSzL8biECocdKLEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=661&cbvp=1&cstd=658&cisv=r20221012.24719&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 15 Oct 2022 21:03:47 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame CCE4 43 B
479 B 298ms
298ms Image
image/gif 52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=sharethrough.com&id=658a50af-fd5d-4ba6-bf3b-d150d16ba97b

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:47 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 91QYWTEND8PXK3ZF4A4H
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame CCE4
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=

68 B
279 B

175ms
173ms

Image
image/png

52.220.251.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 52.220.251.156 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-220-251-156.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:48 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H2

200

v1
match.sharethrough.com/sync/ Frame CCE4
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=

68 B
279 B

174ms
173ms

Image
image/png

52.220.251.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 52.220.251.156 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-220-251-156.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:48 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H2

200

v1
match.sharethrough.com/sync/ Frame CCE4
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=

68 B
279 B

173ms
172ms

Image
image/png

52.220.251.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 52.220.251.156 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-220-251-156.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:48 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H2

200

v1
match.sharethrough.com/sync/ Frame CCE4
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=

68 B
279 B

173ms
172ms

Image
image/png

52.220.251.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 52.220.251.156 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-220-251-156.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:48 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7290 0
20 B 175ms
175ms Image
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BJDhhMiBLY5b0C8PW3LUPrKOG6AkAAAAAOAHgBAI&bg=!Pj2lPXnNAAYeOJy_Pjg7ACkAdvg8WjYA6lloaTWr4tNsDTC4n5cAbv2eV2cA8U8vNxkre0Ncm4GIaQIAAAChUgAAAAJoAQcKAJ-IVAAkRy1rBXROk03yiwPb1wtXdYds0WPmAOH5mp1NfFnAwOERvvngBQU4icaV6t_OBTVIa4jIwsCJsxggBreWiyr1G23vfzOcMF-mJbwTnCy7aZQOdnfrmIUrEm9WmhVRLEqzyj2zSIWB_ElIXJNpJVL5lJCPXdBozuMRCKlBHL-Cf_taplMyfhOth090ZZ-3rePb9FpH-69zj1GcaKqZAuJBNOo-Hd8tFuxFp_s-tTH-ksNFFbEt29r2K9BCFP4b-UOmFL1-Dun0O3Dx7ZEFrpCCwvQDBc66WmmLRJNzld9zEHY-lvJ2-DJFpbTy198l3vpRkqxMBmyXwuMaw-Cf-PTlqLMItQ1iKfUIs06qPZdsiD117SSkzIiRhXGQ6X91rqBvhYEA1hMQ3ASl7RuaS0dhiJAYJlmeT3qPvr4IUySgnvtx6zksNoq_lincEqViWhCY2jf8CBSaIWJf4c4YM01EhOaX61Jgh_m06Ep8OsX4BDCMOtSTDKsElWW31Fr50ovpbpmsJsGvUqDTh7AndCelS4KQNlm8PtmzhEMxkZnU-uOroUJnJd29TDkzXmoYk4HXZYoRZR1rnIVS_j8Qss21HHfAGSSfzE9zlakG902wfBDtQACN_42giNV-kmniVaTsYzIbFPRajMFpAebNSPxqBBSGPLMucRcBgHP-vDLpgVfty1yPkITgbwwgnsPAb2_dgEToyihoRzRWuW2BN0vh5_4iGsAf3plzOAGk_XRDl8pXohrTWiPjJDfYUSBDXP-Xmzf5wLp3VTTpeew-aeAqV-3ujA2zTtA7lsx4nqleaiPjXdNQpHJFUFN6u_hmRv94oEn5rNF77D9qwgx8a3l9TQgXholP0jqfZbsAqcPN8zsmgneI8IIC_MBWmfMgOBpjHRoT5kXXcr0LeduMlqI6KzvuOPE2y_NEV0FoPBqbWABHPMneLfBFPYrqw85rpikdujgTH0mMeQwSuzkD9vMT8oYVw8_rwDUwNlR5ox2bxnf7nixp8Idea3IQAPQ7tBIsbTEkopy7g8chCz9ev3Fy35TvSyupNZ-f4aiFj9nf03Fxu-yDMta9hBnK-GEyskTzG_XY4cn4VOK7Qzy05xRPUqH1bf4uobikOpXA9PAtzWPVJjGvrGnx4sSbLsSBAMuR7uHHl_77meQ8dy5WSEfjG59tGfz4qfCJyek4RQ6fMjo

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame FDAC 2 KB
591 B 174ms
174ms Stylesheet
text/css 74.125.24.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Arimo:regular

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8276465137012464354/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f95.1e100.net

Software

ESF /

Resource Hash

42074ae258a13356bbc4dbe1133b20e4485a3d9bfea58353fcd83ce71981ee66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 15 Oct 2022 21:03:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 15 Oct 2022 21:03:47 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 15 Oct 2022 21:03:47 GMT

GET
H3 200 DcmEnabler_01_247.js Show response
s0.2mdn.net/879366/ Frame FDAC 29 KB
10 KB 172ms
172ms Script
text/javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8276465137012464354/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f148.1e100.net

Software

sffe /

Resource Hash

467a5b06cb117035f7882e8c71d80e093f04ce586c1ac2b84e7e4adf978edb30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8276465137012464354/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 06:28:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52496
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10136
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 16 Oct 2022 06:28:51 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame C374 284 B
921 B 689ms
171ms Image
image/jpg 69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 284
X-RPHost: 6690dc791bf02dde8c4051a04cfd7bb8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D558 0
20 B 175ms
174ms Image
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BieCAMiBLY9-pFsaGwgOCwJXADAAAAAA4AeAEAg&bg=!AQKlAkbNAAYeOJy_Pjg7ACkAdvg8Wh_PBEUIC9pM5NRq27R4LAPllA1EI4JxhSWC-CtXzP7t6T6cRgIAAAEKUgAAAAFoAQeZAu1bIKwrcYyRVays21W2i5L0CTsK2UYgjnAawBywuEc4bHCtdtBtsjz6Z_s1uFs8EudXSutylzDD272KjjndyD0V2uS-F3Un9RXu5FOPVCPzo9cb5XmL6ei5UZvYQ2V16RjBCUp7X2uEG0AVuipQ5S_9v7iKpsUMPWBa28NDhJTk0Ro-z9fIv6MYFyryE0TeAY2piNdvCHBVCkLxMDte0tiTcOgQkFx60ZN29wXQRRJ5fdGwtAbP2A5htJcPPTuM8XCCujfSFCrwFd93i4K9-fOJ9R9MKKtAk4abfnpDi_PC6nd_CxRxl_Sg4NJSPFULtffJrvAyqXnOIaYMRf-eD5kzqcKO7ScJayMg25U68aM70SvxZa8xGfhKACVlfcW5REUYbqiNb5qf6LwBbko1jUWisc5LHdrCo_I7OuQ2dt2VVPAv-pMwEKHnyKObQJcnxLh_7e2GE7HTncr2DjaxC6zI6gNlrC6nRbtcSoIY763NJ-TfbIJPLlPHrNMVqILhCr7iaDklfwI7GgesG2y4hyDIZSER4T4YwEDZt48jbBvx5tFCkHX8EraHbm1wXxvCfJDPUYVi-DVAqAm3Q7K_b0pL4w2RAoEDnL6DkVPT0_bt-2uzIhUDN43XC6d9dk60OFGo2qvSKES3k987025iXeu20ChUZ2Wv7J_vy_B_GUBr4gM66HPYnzMbRX0-m_4sEmMut1Y888M1J02d_Cl_ktXxzyV1hHFBPTJ7B5c5QgPInMjgxjKPdSKZubnGbOP0sbiYYxloNGQenDYAqecV3bHyhOmydxpxuLRvQCgdWXqCpSJ7WiFhaxYZaLgFhYopSXVli6tvxTJLFexgjJ7a0AZsy9uVqgShAYiIUuSyzToy_7cRBWV1B3xPgcCMO6eeLr44iuyNdYkl1yqu0BcoEf1tdlFvPYZ56vDoJLVLeyqBjKBFPkA8DJFTXdeRI-58P3k2B4o9eVBLPEjO50xCfK3UT2cSbS0DLSdfD-t7Zw

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5340 0
20 B 173ms
173ms Image
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BoMXSMiBLY4mRFqqMz7sPjqOviA0AAAAAOAHgBAI&bg=!uLulu__NAAYeOJy_Pjg7ACkAdvg8Wi_pDAnuYfey4VHaBvaicKIzrvnPwXYUCvZhYkp_2DNN4_CbcwIAAAD8UgAAAAJoAQcKAG1ixVpwhxHcbzID69pp91P5R7rmhBH04mFOBCO95EHJQcHC7Hw5zhM-5wHllxA70uSbTIEvK6PEsptmfS2-WKAtuSZys88FyLgBynY-RYNf8oQJrR5gm1LnbHcQNb1Fa2H32xucg7QknSjkoTqtmQLkhxhysC8mjaQpZz3tEKz-ePs8TeTdsTcD8rTAuBR7iOnvt9vtFgAyr0ht-R8SqREDeEMT5xuLLTEq4KjlCmVBv4XEjrOPuWFJstFzX3HHO2ZaWCrixXUa5yhfBTLv0E2VfAdgpN93rkV6NKc82GAVWgR3PS6bLbVXiKvX8kIDCmXOD518lKWHQMJv9EfWIIG2QqhjMmxGODNmPHD5yIt_YE9KtPrFGN4c3IhFZ8-trWoNZcsLM4CBYw4bslz3JHiwZqTRlVhDIG8xghoSwGU5X--oD5tuUANyxXbdz7EJxfS4JKTGm40F-Ou3AIWmNfQ6HV3NHOQuhxjgkNSDhXeF8bvhlDnAmBlnZNof8qY6EqtEe3JHUe1PSUjB7cMTvOW7jjHGH48hcYfhKucnc38omJonYynVVmzwN1cAFqC02pQCzMd2AwuaysWyHu6_vqogfCSuE4VwdH3rdgmBHV-PH5VJ7dWBUmGHoEgiZkI-1s7e0iuhJpc6l6QDtfXm5__t7JVH2-ooPFPYiikvEQ2OBvd8s055wT6SdFLZUzjY8Sq5V1YObm8vUVWh1-y77Zr2cNfdWjpkruNSjhfazyD_RqMrvStP97BDasN5amT0JwsqhNM3Tx8awlO1sdO65BESmQ6VdSTQ7WcHuUbTLZenGE_NJtw88nDq1_RyqbM7KRD2pbQhia9chWZLYej-wBDPvqdKrBUX9y999U8gifcrKMgX-52t_wPBJvE4IZcnYC6Zrlr4mKgRmHN9SxtMtl-STlLW1zshCyzK0rOaWiAucqKuiiHiK1CMt5O14zN9lsPmrPWI2dU1VzrzPBfcBXdMe_-aMWMifEFev5GfAi-IiRO3bU6G1AUE9KaN2IdhwaRjCr-kbntz7LcWYtollAjhWWVhgquMkT5UpPVEPD73EDuodcpZ_BOqoWtUokqqMW_l1tkBmsc4v-3R3fpXWt6i27YUg4hCvMFaJnh37IfuzDV9-Ow

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 2760 2 KB
2 KB 574ms
191ms Script
text/html 103.231.98.196
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=66562632&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.196 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: a86e6460bb1400e1eb0c5dbf7baa1078524f4b06232a238401388a62dc8720a1

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 15 Oct 2022 21:03:48 GMT
content-length: 1610
content-type: text/html; charset=UTF-8

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 137E 0
26 B 180ms
180ms Ping
image/gif 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu6QfXUQDL6i_KZUxX7fbb_n2R86TQfJr_bVmJC7nL_1PDw9WN59pupii39gzfxiJLEVtofdJ2eHpYZjikgjCacNcBUfG_QXp3by0BEe9og_4-n5aGIT52rA3Yi7QzKk8AWFuN-0FI-uIlFpsiH9TxT9keDLRziitvAuijkGFqa09zJQHnvO1UJ_ddwa7Tx_1fdjlUt-3fDxr-ATa7taFDzfFWFL8SglkggovtWFB9-8llI9BdBEbc9cYBEspX1WkWBLNNB79cmldy7cjflHEhfrFt3ycoqpPeX4TTOqIQKf1jLG29kcGJKOdRJt1BOk-FPYVRbj8WCy9hOoG1WQEpxermSP4qAbHMGGxN6bW8vKZGiaPzgnBObvtrP4u8CJ2nKA6_q2Dca4xnlyITfsbrMtm8P7YvfBE2fA_irN8LmTmxy_bIxesnQNFayPpp4xIhEdTZbI02IvLcVlMg1Gqm6Ni1cbJredqQ6FABZwr05fnnI8Fow8O6HJzoxu9WolYF23C4bd3P50KwnHe27BLY_pZSYNAGlq4bAQiL-YiAB8t3pzXucd1Uhb4qCNAdllle_2DpDG_9XHEF4EjWjXh7HAFz5HrJNRqK5Au1kgZwYbHW10h2wUF0dkuN0Li2USW7ryKZVd459XiVlK7FvfCCbXNsr_vWNlAoXJ_nV7zhh94qGHH_z0yrSuqoCBG02XUe0VRQ2pKNQlA_vsiEK8RvP3DklbGTOtzh0-D5TmAtPDsKICj1XbSWv8YhLhuEGVv3IlqK55IcetcqV2naRdAqkwTcRZBJbZydpBjKdNOvwx4AXUSVXw51f5inlON3Zp2Mr0WmE11P67byDZGut7FLncfeF_07Kq19Sr2L7k06yQ1H3Jelqf_fq90WeylxlyjmC6RzA-i7yt39WqsZjzaW-t6oQjkrG6fbKzq2HO2rmKi_lTkdVvhAObWboptDpzcu30_bgpreIaDoVZtN97rVSAJoXver4DxwlWUhksE-WLdDLcXsbtxtRvmzAcbkR7wN8sXI-VV1q4AQbcxQQIQtHg8RzknJMN3i0DEG6gfYuOlWOXOVPk-ULRLCxh0yb3_hztvuXeIkVrdIHr-9IXxQTb5hlcBbrWA5slYFh-8xUSPU2kWT82f069Me0DlUcY4ES1w_aM43qkP_n2iqmy_i_Is6_LkorU5O0jEQOm9NleWmPcQchrxj7H0v_pMsM6LnQgGRy-m6DOQ&sai=AMfl-YSNf9w9KviJGAxdzj7g0Qj40svDCjD4YKBNuz0sreLEAOXlRslzCU29VztPQpYwCixEmprPx4SkZQlKgaqiYDILaNurwADn7weWT9QXpli23hHXpLj8pAJ11_y3UZyudcSR5M2AwDZR6QAeHOevWIt4MXb2m-vRrkNEYzRnD8Fd_UzaAqD-d7O0osMjVqD2kpd4zPUnOSqWJXGDAFFpoa4Uc8iiDpw8qFWpXBxEeAwzzri5g7wzGu-QM445btDyf2lwm8ECLwOYQSwGIEeB1Sg&sig=Cg0ArKJSzL8biECocdKLEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1078&vt=11&dtpt=417&dett=3&cstd=658&cisv=r20221012.24719&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: pastelink.net
URL: https://pastelink.net/wwr50xs3

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:47 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 REFILL-REUSE.png
s0.2mdn.net/sadbundle/8276465137012464354/ Frame FDAC 5 KB
5 KB 172ms
171ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8276465137012464354/REFILL-REUSE.png

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f148.1e100.net

Software

sffe /

Resource Hash

b8a8b548b702df9584cfb363e27f8e00eef7c01f2b5eb460eb854d7fd1432573

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8276465137012464354/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 19:04:14 GMT
x-content-type-options: nosniff
age: 7173
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5046
x-xss-protection: 0
last-modified: Wed, 28 Sep 2022 02:27:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 15 Oct 2023 19:04:14 GMT

GET
H3 200 bottle-cap.png
s0.2mdn.net/sadbundle/8276465137012464354/ Frame FDAC 22 KB
22 KB 173ms
171ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8276465137012464354/bottle-cap.png

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f148.1e100.net

Software

sffe /

Resource Hash

9b7a2763288773976a369a1a52db5180edbc3d8a91521e78e57277f1ecb829fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8276465137012464354/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 19:04:14 GMT
x-content-type-options: nosniff
age: 7173
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22202
x-xss-protection: 0
last-modified: Wed, 28 Sep 2022 02:27:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 15 Oct 2023 19:04:14 GMT

GET
H3 200 MORNING-FRESH_FRONT_Original_400mL.png
s0.2mdn.net/sadbundle/8276465137012464354/ Frame FDAC 78 KB
78 KB 327ms
325ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8276465137012464354/MORNING-FRESH_FRONT_Original_400mL.png

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f148.1e100.net

Software

sffe /

Resource Hash

9c7ddfb74ebd494e83135523c605744d4d86844413a61dc572af925dbcb87cd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8276465137012464354/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 19:04:14 GMT
x-content-type-options: nosniff
age: 7173
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 80063
x-xss-protection: 0
last-modified: Wed, 28 Sep 2022 02:27:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 15 Oct 2023 19:04:14 GMT

GET
H3 200 MORNING_FRESH_FRONT_Refill_Pouch_ORIGINAL_800mL.png
s0.2mdn.net/sadbundle/8276465137012464354/ Frame FDAC 76 KB
76 KB 268ms
267ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8276465137012464354/MORNING_FRESH_FRONT_Refill_Pouch_ORIGINAL_800mL.png

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f148.1e100.net

Software

sffe /

Resource Hash

e0addf73edd9e92928605d8a1a2b57776f46a0f181c76c90b9b38c6698dda527

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8276465137012464354/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 19:04:14 GMT
x-content-type-options: nosniff
age: 7173
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 78169
x-xss-protection: 0
last-modified: Wed, 28 Sep 2022 02:27:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 15 Oct 2023 19:04:14 GMT

GET
H3 200 ANIM-Liquid.gif
s0.2mdn.net/sadbundle/8276465137012464354/ Frame FDAC 11 KB
11 KB 235ms
234ms Image
image/gif 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8276465137012464354/ANIM-Liquid.gif

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f148.1e100.net

Software

sffe /

Resource Hash

60530e10524805256bd851633c30fd3aba138f482321e71f6019ec94441ccfa2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8276465137012464354/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 19:04:14 GMT
x-content-type-options: nosniff
age: 7173
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10768
x-xss-protection: 0
last-modified: Wed, 28 Sep 2022 02:27:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 15 Oct 2023 19:04:14 GMT

GET
H3 200 glow-bg.png
s0.2mdn.net/sadbundle/8276465137012464354/ Frame FDAC 111 KB
111 KB 647ms
645ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8276465137012464354/glow-bg.png

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f148.1e100.net

Software

sffe /

Resource Hash

362925b63fe1d27f0632fe1c0f9d1f1fa85d91c55b9020b722850d6351d789b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8276465137012464354/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 19:04:16 GMT
x-content-type-options: nosniff
age: 7171
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113764
x-xss-protection: 0
last-modified: Wed, 28 Sep 2022 02:27:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 15 Oct 2023 19:04:16 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D516 0
20 B 173ms
173ms Image
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BDyGmMiBLY5KPDP614t4Prv6g-AQAAAAAOAHgBAI&bg=!AwClAETNAAYeOJy_Pjg7ACkAdvg8WsQEuExkK-2ar-6KI9XmvRop4whb3PgEi_-NOS-URL03_o-4XwIAAACjUgAAAAFoAQcKACoLCmI3NYOerQPdXIiD-_x2vcjsZ1EmvTwDtdqSC3vnRfBfc_J9p2viKv6ZAy4KKd-Peqd9XC5BQLPo5iRFOcOVYuCJlEa9Gl4hZqyOyLvtsaW-pLgNrMKYVdeGb7eY9N74ujEil2ZlrXFjY4ptSJ5ja_GGs9Dxp6QnQfL1xYK98hTS4RnEc8j8xZWvnsRoFQeibB3Z6h_82C0dzJNjBV7jrseLgc2qgtL4vwpBt9M-YfEYY_VQGXF7bJDgZlQ-xLo7mZ6OI1hqXAOUYZHKGl6Ht75gRZXAJNLQBjlRMw2WjKvFTWc0pIyYfxf3CX2NZDVGD4ytiZ5oFPsnQf7u3lU5YeIE9Mdl-NzEh42BqYHw6CDESOr04btSAQKw55f5H3oRJBanU2pkqTdOFwNRPF25GOA0h_KIaeyDWB88j8uWWocY9KAlRFR4x7AzwRUYwEObDVzfAoE_H9FgeoOKsGd_4cvNrdwFsyFNnkYzrjGiT4wczcVB3zmlkmUb4mzlW9OCqbXmlfk2S9Dnrjc6uV-O696H6l_sJNOFqqpGGMX97e39hh0OUsFqgHoBSCcq82eLRIFJ6qkk0qOB6WOsJpTnDy8ZVwp8XFK6Ov2BpREBmDurYmiSXVL2CJmtQyXiPDTieg7U4iu84CcxNryxEOrOiiRRKUQtT4DLUa2yXx6dAy4Cunk8zlIyR7-xno9_V-nvvzvpZsNpDMjArw_ObTWALSUgkO3RYFe1alRkk96GM-UhWJ5jdibt8FHGRIuHKrdtwNSJYTPa6H3EKoDuHVYi6dWS3p8v2oHt2c4ZowU5MSw-Q0gQUKeSdMKvR6eobZX0W5X2hfE56Ueng956z6tcKY9I12n6aIo0hM4DHubxcBKJt6Sqb_TJ7ebqFtxM4uuSt_uN1ABnz22FN0MGAUYJNus45ZZdI4hpk80KzW4-Gf_Qc3tx23hlMFdbw_hwKvKZCmsTIGMNGB1PlNNJ9Rv4pqkJTv4iSRN4rLwbY91Owkb9W1mHR_HcoVqnNwxgl-5WAUSkCxTYa7st4Oc1i3KraDKXQZA1NuXsASibNAY0l09YXoFs_finGJtsMyV3hQXVtwH2JcshOkX1G-YDjs0Y-BBZXswjY0UCSATGkDVzMliw0vtMGowtBVE_

Requested by

Host: 2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
URL: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E3C7 42 B
64 B 179ms
179ms Fetch
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsswvpniWZ06WuAQlTxnyU4mrivBRTBDikwdHAPRE_G2GyczS3FmJ0BRvRVvK3D0Ug7K4HNdmi14BYR09c43V5cOdQvKiwTJJQR92C8FoyMwn_JvPBmzQeCj06wGU5JD1ktFXVg12Yxpp2JMnIhT5_Z5cJO_qPy5qMkpgaoFP_MjVyZvqPis9cEV0HWKEw2RQHwSciH9rdZoa7ln31ra0uH5NdmlBFbFw1e5t1uxeTgJfEnHgtAgKiD3sZCrf109cetBuCjujSCcnOjjPu_jzIIDQgatO8NXqVOUGN9GCWdFxlYaJG7_ubcml1iQxqULY6GiiPrpOygbtd-nFwVA47aiS50HjKForEEo4Y2zey7jRnkHzMtQU0kDmeqIUQAPCWLk5YXAgvKeVaA7S_67FNj3oIHMcDCxrzVk2ma8awpYTmZrXJ_RiKnRuWjgRseCnLuU5PoOHrIgu12wJ0a7ItTC98kTJ6J20I0a-73mVswvk8i47AlOiVi3_F0LvYZy-L55TQT1Rm3z7NAnxpXQZi4pGLIWK0O-iZy_qZUbNBiYd9ZkIoSadz7leey4kUxr5Em8McYtC4ZjSOQxj-nLjOfpr6-7a8q9caQTC3zR7vfeGGpVZ4yrwzD1RpvSE3b1Nk_SyIRbMJS-ilnGBomQ-JRGnKZ81bEwk0d3fsbGc0X-quFh_op0APiBSC8JSxzAFdohpqH05arHMjv65UDNByz4WZLPjLTd_qXxjKBwQtaYEY5zHGzOQdwbALnumhOpl26qOr2MJn3_4qqvKhKrR5UavVc9vCIPWB22DyMjEl-qKSI5BtPcF4pLxqONXWQsNYU1gDiT99zUe7XRQG-2ui5hPIKshC1Mq0ZPMl8f0qVFWpudLG5UyAx5AQLpU2r-Uu2bLeuUbDTNdNl6ZyOAQ59Tk3VNquBRZm-kfRT-ui1olyCcUHED_a7vD7cdYETgMXZjVhLJa2DQQx1cxCUof69WzCYAkjNpg2RbpJjIk-5iirF-SlFPO0OL4HQ_677-iFpqELr0hdJwK76x9vv6z58wYoXy-erBrC9glxQfIKx8XVzSVZeLd2U6HlaDBlhHIWEihluRXu5aH2SmzQ&sai=AMfl-YTE0Ey_qOv0ImqaynhpftjyDdcsI20OJLsCFXy308e2mwyUIowHZJ5XEKxwUjnxWULn7Y9gAhFC49OXuIzjPWyWQoORdJi2JnvrI7HccTQK0cdBk2bfp5GsGbzvuXJAH3fQgINKxg-LjbFWawh5&sig=Cg0ArKJSzEeStTeGDneqEAE&cid=CAQSPwDq26N9Behk7C6btv9J8sd9JNxampycyNmhrHg2L5Qcigse8mfm3R8E3sV1pmeHOvWFhGDX9jw1VXH6jMQ5fxgBIA4&id=lidar2&mcvt=1001&p=1105,436,1195,1164&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20221012&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=3402602959&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1665867825235&rpt=1571&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame AED6 42 B
64 B 174ms
173ms Fetch
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvGD1U-425_g_TcDzvJ_ZI8by1zELi2u7BGxMh8NHgDRndG0cwFZP7LF2Z14A-B7LE0QsSg0gJ_SlOFFFQxbb2G7DL1eFIZjgYWFkPna5QVCzAmJfRSa1oZy-sHbNnY4UES_g8e&sai=AMfl-YTfGUizZ3sIcFRGhu8d1hPPoFRVKknXCKDW08-3X92y8IkbOYWIErudk371DzmsWmmd6Hx8-iEXvTG7L0IDCqWswg9byP0qOZA1OVz1FY3GEKnFpNDug6_iHO9b6P5M6cw&sig=Cg0ArKJSzNP69sYoA2mMEAE&cid=CAQSPwDq26N9Behk7C6btv9J8sd9JNxampycyNmhrHg2L5Qcigse8mfm3R8E3sV1pmeHOvWFhGDX9jw1VXH6jMQ5fxgBIA4&id=lidar2&mcvt=1000&p=313,513,563,813&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221012&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1666686559&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1665867825298&rpt=1755&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 4A1D 0
54 B 537ms
235ms Ping
image/gif 74.125.20.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~l9aeoxir&c=1840560957883&slotId=920280478941.5&qqid=CM-Ur5-R4_oCFYLScwEdZskAPg&umsem=0&ape=1&ple=1
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/66a8e2f1e23e39b4cd24e41f6fd8475d.js?tag=video_location/web_och
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.20.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: pi-in-f94.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:48 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame C374
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&khaos=L9AEOYPO-1-D5EB
https://s.amazon-adsystem.com/ecm3?id=L9AEOYPO-1-D5EB&ex=d-rubiconproject.com&status=ok

43 B
479 B

298ms
298ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=L9AEOYPO-1-D5EB&ex=d-rubiconproject.com&status=ok

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:49 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 98AM9ACCB8RRV019ECNV
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s.amazon-adsystem.com/ecm3?id=L9AEOYPO-1-D5EB&ex=d-rubiconproject.com&status=ok
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 1c34e56f66d325760e494cbb7a93f50f
Expires: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame AED3 42 B
64 B 173ms
173ms Fetch
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssxlVwAXgIkpK_Um_qQRyspgGgm_7am-JGhAfVOFL_On2B-U63pLIEJxy1PvMEbwgU-gP3j0t6EC9_I8aKizXBphmhNlnuMkSGTmpagyQFaAez42mfSFquF6CdGuR8mY6HaBnxb&sai=AMfl-YQTsbeExC-A7Ea06QXjGQ5mRGIys3kHNygFgV1yrtvKNBdxF6QIta9MUMpvl1fvfuUXziY5IgPr7qkclXqyuvnCPetvlGQxRwbBYN79sTVdGUWLqOGFi1uybYrUSPag394&sig=Cg0ArKJSzBSxnOFi08WxEAE&cid=CAQSPwDq26N9Behk7C6btv9J8sd9JNxampycyNmhrHg2L5Qcigse8mfm3R8E3sV1pmeHOvWFhGDX9jw1VXH6jMQ5fxgBIA4&id=lidar2&mcvt=1003&p=746,513,996,813&mtos=1003,1003,1003,1003,1003&tos=1003,0,0,0,0&v=20221012&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2365527928&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1665867825302&rpt=1940&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 6DD6 0
54 B 535ms
235ms Ping
image/gif 74.125.20.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~l9aeoxkl&c=7860145008629&slotId=3930072504314.5&qqid=CNyRr5-R4_oCFYLScwEdZskAPg&umsem=0&ape=1&ple=1
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/66a8e2f1e23e39b4cd24e41f6fd8475d.js?tag=video_location/web_och
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.20.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: pi-in-f94.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:48 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 0EA0
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=C2E1DFFF-90AF-45E8-9817-31DBC0A6255C
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=C2E1DFFF-90AF-45E8-9817-31DBC0A6255C

35 B
467 B

203ms
203ms

Document
image/gif

185.84.60.21
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=C2E1DFFF-90AF-45E8-9817-31DBC0A6255C

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.84.60.21 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Sat, 15 Oct 2022 21:03:48 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Sat, 15 Oct 2022 21:03:48 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=C2E1DFFF-90AF-45E8-9817-31DBC0A6255C
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 9154
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:c213634b-2034-4c00-af24-bf7a9e7bdf98&gdpr=0&gdpr_consent=

42 B
325 B

191ms
191ms

Document
image/gif

103.231.98.194
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:c213634b-2034-4c00-af24-bf7a9e7bdf98&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.194 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sat, 15 Oct 2022 21:03:48 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Sat, 15 Oct 2022 21:03:48 GMT
Expires: Sat, 15 Oct 2022 21:03:47 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 4539 98cc2da master nrt-pixel-x19 config:1.0.0
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:c213634b-2034-4c00-af24-bf7a9e7bdf98&gdpr=0&gdpr_consent=

GET
H/1.1 200
OK ecm3 Show response
s.amazon-adsystem.com/ Frame 48B7 43 B
479 B 300ms
297ms Document
image/gif 52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UIDC2E1DFFF-90AF-45E8-9817-31DBC0A6255C

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Sat, 15 Oct 2022 21:03:48 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: FJRFAJ0Q6HYMP6YWEBWR

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 2760
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=wuHf_5CvReiYFzHbwKYlXA%3D%3D
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

15 KB
15 KB

316ms
316ms

Image
text/html

104.65.228.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Server: 104.65.228.208 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-65-228-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:48 GMT
content-encoding: gzip
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
server: Apache
etag: "1300708-3de4-5d6ef246ef4cf"
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=160084
accept-ranges: bytes
content-length: 5549
expires: Mon, 17 Oct 2022 17:31:52 GMT

Redirect headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 272
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET

458249.gif
idsync.rlcdn.com/ Frame 2760
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=C2E1DFFF-90AF-45E8-9817-31DBC0A6255C
https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJEMyRTFERkZGLTkwQUYtNDVFOC05ODE3LTMxREJDMEE2MjU1QxAAGg0ItMCsmgYSBQjoBxAAQgBKAA
https://pippio.com/api/sync?pid=5324&it=1&iv=9084f82de3ade4068ee0e959fedbbfe66307c27d423a9811c874a4e99dd5b729791426b5417dce21&_=2
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA5MDg0ZjgyZGUzYWRlNDA2OGVlMGU5NTlmZWRiYmZlNjYzMDdjMjdkNDIzYTk4MTFjODc0YTRlOTlkZDViNzI5NzkxNDI2YjU...
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA5MDg0ZjgyZGUzYWRlNDA2OGVlMGU5NTlmZWRiYmZlNjYzMDdjMjdkNDIzYTk4MTFjODc0YTRlOTlkZDViNzI5NzkxNDI2YjU0MTdkY2UyMRAAGgwItcCsmgYSBAgCEABCAEoA&goog...
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
https://idsync.rlcdn.com/458249.gif?partner_uid=2a72ac6e-d2a7-4498-a830-f22ecdd611e2

0
0

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 2760
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=9ef0634b-2034-4800-92e4-ddd8d7126f0a

0
260 B

579ms
192ms

Image
text/plain

103.231.98.195
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=9ef0634b-2034-4800-92e4-ddd8d7126f0a
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Server: 103.231.98.195 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:49 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Sat, 15 Oct 2022 21:03:48 GMT
Server: MT3 4539 98cc2da master nrt-pixel-x6 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=9ef0634b-2034-4800-92e4-ddd8d7126f0a
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sat, 15 Oct 2022 21:03:47 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 2760
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QzJFMURGRkYtOTBBRi00NUU4LTk4MTctMzFEQkMwQTYyNTVD&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
245 B

572ms
190ms

Image
image/gif

103.231.98.194
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Server: 103.231.98.194 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Sat, 15 Oct 2022 21:03:48 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 2760
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECtswvNhpt0xpD3CDHlsMvQ&google_cver=1

42 B
377 B

572ms
190ms

Image
image/gif

103.231.98.194
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECtswvNhpt0xpD3CDHlsMvQ&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Server: 103.231.98.194 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Sat, 15 Oct 2022 21:03:48 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECtswvNhpt0xpD3CDHlsMvQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 2760
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:95B09608F370452BA2DF4425E9B5BB5F

42 B
288 B

190ms
190ms

Image
image/gif

103.231.98.194
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:95B09608F370452BA2DF4425E9B5BB5F
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Server: 103.231.98.194 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Sat, 15 Oct 2022 21:03:49 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date: Sat, 15 Oct 2022 21:03:48 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:95B09608F370452BA2DF4425E9B5BB5F
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Fri, 14 Oct 2022 21:03:48 GMT

GET
H2 200 C2E1DFFF-90AF-45E8-9817-31DBC0A6255C
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 2760 43 B
603 B 521ms
175ms Image
image/gif 3.0.69.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/C2E1DFFF-90AF-45E8-9817-31DBC0A6255C?gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.0.69.23 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-0-69-23.ap-southeast-1.compute.amazonaws.com

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:48 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 2760
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=5e4858c0-d88b-4ad3-b03c-e0c31745bc26

42 B
507 B

573ms
191ms

Image
image/gif

103.231.98.194
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=5e4858c0-d88b-4ad3-b03c-e0c31745bc26
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Server: 103.231.98.194 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Sat, 15 Oct 2022 21:03:48 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:48 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=5e4858c0-d88b-4ad3-b03c-e0c31745bc26
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 313

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame C374
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=dNFB1HmqTGa57ZcmZuE0LA&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=dNFB1HmqTGa57ZcmZuE0LA

43 B
479 B

295ms
295ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=dNFB1HmqTGa57ZcmZuE0LA

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:49 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: KSPZ7BKZ42522FKYZWT9
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=dNFB1HmqTGa57ZcmZuE0LA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 38ddff6a66d3988dfd0c6ea3be81c5f1
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame C374
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=&expires=30

42 B
678 B

684ms
171ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: dedf7fc216a5bbc739a54325e875a79f
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:48 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=5e4858c0-d88b-4ad3-b03c-e0c31745bc26&gdpr=0&gdpr_consent=&expires=30
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 289

GET
H2

200

setuid
px.ads.linkedin.com/ Frame C374
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L9AEOYPO-1-D5EB

0
573 B

475ms
293ms

Image
text/plain

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L9AEOYPO-1-D5EB
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:48 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: B379F2479A92496EAFE7F8208FBADD6B Ref B: MEL01EDGE1210 Ref C: 2022-10-15T21:03:48Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXrGRQuXwZaVdrmrPo6wg==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L9AEOYPO-1-D5EB
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 38ddff6a66d3988dfd0c6ea3be81c5f1
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C374
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDlBRU9ZUE8tMS1ENUVC

170 B
189 B

174ms
174ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDlBRU9ZUE8tMS1ENUVC

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDlBRU9ZUE8tMS1ENUVC
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 6690dc791bf02dde8c4051a04cfd7bb8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame C374 43 B
855 B 1580ms
450ms Image
image/gif 52.94.220.185

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.94.220.185 -, , ASN (),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:49 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 890DPCYAXFVXB999BRXM
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame C374
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/63QbcS7-wDaPMbKJfYYoQA?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=5895685174981949212

42 B
678 B

283ms
170ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=5895685174981949212
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: d264e84c9dc1a645a3048554992c5d82
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Sat, 15 Oct 2022 21:03:48 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=5895685174981949212
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame C374
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEO2hQ8rh7iRYoYePWpWIZFc&google_cver=1

42 B
678 B

691ms
174ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEO2hQ8rh7iRYoYePWpWIZFc&google_cver=1
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 94869a3d6d62a785bc2a9351b08a70bb
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEO2hQ8rh7iRYoYePWpWIZFc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C374
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MWMwYTNjODMxOTcwMTUwN2Q4ZGI2OTc3MmEwZDk5NzE3ZWU0NjgzZg

170 B
194 B

175ms
175ms

Image
image/png

142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MWMwYTNjODMxOTcwMTUwN2Q4ZGI2OTc3MmEwZDk5NzE3ZWU0NjgzZg

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MWMwYTNjODMxOTcwMTUwN2Q4ZGI2OTc3MmEwZDk5NzE3ZWU0NjgzZg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: dedf7fc216a5bbc739a54325e875a79f
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 2FC1 28 KB
11 KB 170ms
170ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal109.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

250686eb4f9e94b0bd0812e4e65b239b3355af85e21aff1dfaf3914f8b99f8f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 20:54:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 566
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10831
x-xss-protection: 0
last-modified: Wed, 21 Sep 2022 13:41:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Sat, 15 Oct 2022 21:54:22 GMT

GET
H3 200 impl_v91.js Show response
www.googletagservices.com/dcm/ Frame 2FC1 61 KB
23 KB 170ms
170ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v91.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

bfcf80bfb2d17562d38d3f50db9274d902ec50021beb3cc46ca61de7d2410a2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 20:53:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 87044
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23646
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 14:32:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 14 Oct 2023 20:53:04 GMT

GET
H2 200 B9689862.280626343;dc_ver=91.268;dc_eid=40004000;sz=160x600;u_sd=1;dc_adk=943508956;ord=q27rep;uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd;dc_rfl=1,https%3A%2F%2Fpastelink.net%2F$... Show response
ad.doubleclick.net/ddm/adi/N1395.150740DOUBLEVERIFY/ Frame 97BC 54 KB
26 KB 559ms
212ms Document
text/html 142.251.10.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adi/N1395.150740DOUBLEVERIFY/B9689862.280626343;dc_ver=91.268;dc_eid=40004000;sz=160x600;u_sd=1;dc_adk=943508956;ord=q27rep;uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd;dc_rfl=1,https%3A%2F%2Fpastelink.net%2F$0;xdt=1;crlt=3cLyqGOXcq;stc=1;chaa=1;sttr=193;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v91.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f149.1e100.net

Software

cafe /

Resource Hash

00bd0c7e75122105dde4eb0385a999256373242d9998d1f948c5cbcf821d7b5b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 25675
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 15 Oct 2022 21:03:49 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK dv-measurements3094.js Show response
cdn.doubleverify.com/ Frame C795 545 KB
105 KB 212ms
212ms Script
application/javascript 23.36.254.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements3094.js
Requested by: Host: pastelink.net
URL: https://pastelink.net/wwr50xs3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.254.7 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-254-7.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 540f48245870c99b467d8171b70e0fac699be40281033d7d90e4a70eb4666f0b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 15 Oct 2022 21:03:48 GMT
Content-Encoding: gzip
Last-Modified: Sun, 18 Sep 2022 19:04:54 GMT
Server: Microsoft-IIS/10.0
ETag: "0cf338991cbd81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 106974

GET
DATA 200
OK truncated
/ Frame 2FC1 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1bc6531d710b7b809320e2160c299e643bf5f74659cf30125e8e950e1e144f2a

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame C795 694 B
702 B 847ms
175ms Script
text/javascript 34.149.43.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=523&ttfrms=27&brid=3&brver=89.0.4389.72&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETar9EEADTbpTauTaua57hech2bhc5_2eec3a7%607d3d6d777f_%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3EU2%26C%3Dl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETauHHCd_IDb&srcurlD=0&aUrlD=-1&ssl=https:&uid=1665867829303397&jsCallback=dvCallback_1665867829303546&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=600&winw=160&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=3094&tgjsver=3094&lvvn=28&m1=13&refD=1&referrer=https%3A%2F%2F2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&fcifrms=11&brh=2&sdf=2&dvp_epl=277&noc=4&nav_pltfrm=Win32&ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&adsrv=0&advid=3398311&turl=https://pastelink.net/wwr50xs3&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVPX_PP_IMP_ID=ABAjH0gMAbPlYc8NvEzL0hZ18-hA&DVP_DBM_1=3060631&DVP_DBM_2=24867964&DVP_DBM_3=15215462632&DVP_DBM_4=396400065&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=201491245482&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=182028051958.97855&dvp_tukv=27260103635.58313&dvp_uuid=86644526.54981576&dvp_strhd=0.40000009536743164&dvpx_strhd=0.40000009536743164&dvp_tuid=136810615376
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements3094.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.43.113 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 113.43.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 3519cfe9e90ed65c2de6beaf3c647e7c88f67cf434502b1e62400f67a3b9c018

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 15 Oct 2022 21:03:50 GMT
Content-Encoding: br
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Connection: close
Expires: 10/14/2022 21:03:50

GET
H3 200 16441750131771963665
s0.2mdn.net/simgad/ Frame 97BC 40 KB
40 KB 172ms
172ms Image
image/jpeg 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/16441750131771963665

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adi/N1395.150740DOUBLEVERIFY/B9689862.280626343;dc_ver=91.268;dc_eid=40004000;sz=160x600;u_sd=1;dc_adk=943508956;ord=q27rep;uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd;dc_rfl=1,https%3A%2F%2Fpastelink.net%2F$0;xdt=1;crlt=3cLyqGOXcq;stc=1;chaa=1;sttr=193;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f148.1e100.net

Software

sffe /

Resource Hash

5d162f1a957634c9f376091ae016a94b3bb7e9b11830eafef203201156289f39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 02:37:14 GMT
x-content-type-options: nosniff
age: 239195
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41202
x-xss-protection: 0
last-modified: Thu, 26 May 2022 20:27:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 13 Oct 2023 02:37:14 GMT

GET
H3 200 sodar_loader.js Show response
pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/xfa/ Frame 97BC 10 KB
4 KB 170ms
170ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/xfa/sodar_loader.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

874e545a5055f7c8602c30ffd711768e8105bb75c87045a794f934d9cffa30c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 20:04:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3587
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4037
x-xss-protection: 0
server: cafe
etag: 4842123143989086801
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 29 Oct 2022 20:04:02 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/elements/html/ Frame 97BC 8 KB
3 KB 170ms
170ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 18:51:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7918
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 29 Oct 2022 18:51:51 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 97BC 152 KB
46 KB 172ms
172ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

18ffb82a05bcd7e430f57b9428d2a6990f127948e7ff14d66c3784a84f4330ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47415
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1665574756386403"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 15 Oct 2022 21:03:49 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 97BC 0
0 511ms
174ms Fetch
image/gif 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvt6vgIWK4S81fL5UxYeZdEnftZ0WYLAsF0JA5AwIIKpYbwyTR_M9W21I3SfQt3V8ldQKQacCCqCXWX7yL0p7ra3JTms0wpOBMpZvw6KOzg9gH0x11aqTPkaSJwVz_GJOh9ZlQk_r7HB7ZThi9jwd0HwcYN8Q&sai=AMfl-YS4mtKkzdG7Qhwp06OnxM_cC7BrOKU3o0lutMfIZxyCnX8-jIlB1YaDAwRMTe9eH40DGfZ44CiIBjmLWyjYIm_yRJlYUibaM5bqCN-x&sig=Cg0ArKJSzILuZkbJ6aqaEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20221012.32033&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Oct 2022 21:03:49 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 97BC 41 KB
15 KB 169ms
168ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 18:23:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 268832
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Oct 2023 18:23:17 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 97BC 7 KB
6 KB 174ms
173ms XHR
application/json 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=r20100101&st=int

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/xfa/sodar_loader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

d4bcd19bb05b07d9872c1cc5529a66c058542afee5958e2716fcba8a5d880f60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5771
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 97BC 0
0 354ms
177ms Fetch
image/gif 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Oct 2022 21:03:49 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 00A4 22 KB
8 KB 169ms
169ms Document
text/html 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 311320
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 12 Oct 2022 06:35:09 GMT
expires: Thu, 12 Oct 2023 06:35:09 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2FC1 42 B
64 B 175ms
174ms Fetch
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvNey9FLB05cK7ddIsHSc_iW4XTIRE56fIyzr2qv0TxInkdgM4bwdVjEKEryJWMPSkcnl-NerW6-hdt3QwrAfihD5mY3zilxtMmMxXAzmuUwBvHRa-3zoXo9A6aqeGrKI6hqGy8&sai=AMfl-YTYydnCINbmKUznoCPUHBRNpC6epxIlqhnolZQ7KsgLqpC_501MYFJPyFouTSjzsCMXr56LMStmd_BQ0lNpujY2aH4JEHYD41zeRwbjKuLK-uych63fWQYhqSxo9c3m4wU&sig=Cg0ArKJSzKTLVomCjxOBEAE&cid=CAQSPwDq26N9Behk7C6btv9J8sd9JNxampycyNmhrHg2L5Qcigse8mfm3R8E3sV1pmeHOvWFhGDX9jw1VXH6jMQ5fxgBIA4&id=lidar2&mcvt=1000&p=521,1071,1125,1231&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20221012&bin=7&avms=nio&bs=0,0&mc=0.99&if=1&app=0&itpl=20&adk=2108190548&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1665867825475&rpt=3318&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 97BC 17 KB
6 KB 170ms
169ms Script
text/javascript 74.125.68.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/xfa/sodar_loader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f132.1e100.net

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 15 Oct 2022 21:03:50 GMT

GET
H3 200 cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js Show response
pagead2.googlesyndication.com/bg/ Frame 00A4 36 KB
16 KB 171ms
170ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

71f2940ec78bc4c5ff54c23fb9aa3faead0c28e69e0ab83c1998d21719a8b46f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 19:19:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 265434
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 11 Oct 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 12 Oct 2023 19:19:56 GMT

GET
H3 200 cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js Show response
pagead2.googlesyndication.com/bg/ Frame 53FB 36 KB
16 KB 171ms
170ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/cfKUDseLxMX_VMI_uao_rq0MKOaeCrg8GZjSFxmotG8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

71f2940ec78bc4c5ff54c23fb9aa3faead0c28e69e0ab83c1998d21719a8b46f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 19:19:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 265434
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 11 Oct 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 12 Oct 2023 19:19:56 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 00A4 0
28 B 174ms
174ms Image
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bs5_-NSBLY5-SDNibz7sPyuSBqAkAAAAAOAHgBAI&bg=!jY6ljsrNAAYeOJy_Pjg7ACkAdvg8Wi32A7F3CIu3scv9lOq4z2ctNzOfDpX2esK0XjGcHAqEUJoK-wIAAABSUgAAAAJoAQeZAvz8Dkk3w2kiDvfJn4SP2KU6d-cO2eRSyER_Zg_cVxuUQhfIaBZQ4-mnt_HMt23Fi6c0XoFFc8UWBW6zaZ6qdvIv8RrFve7NKRp10fc5pjVlvuDCjWVNjZr0f_alSSIt6QOD2BBXQe2sEtgote6N7j7XyzCWUIP4Q0qjbBCIBRtmdj_2bxwxbmCPpJg3RUEC4k3HPenWT7IPdB0m_8o_j1bgKC7aPA8x48kcHHC5UsgYk3Zidv5UNmurrSDVIk_ZmTStRY3_m3r6wH8Jy3_jBrodUIISSNp2qpkcsw1Y4h85exnG7qegFsaPCnegHngoyK8Y4XtvN48bg2ciF9pgvbEH2RRROTHgWOeKh9vVSRb1vCBslxNWDig8QLLT_S0jgsTe20UTQKfUzLYRo1RxCOmSuNPr39h8wNl_p77DtdyV5XsnQl2tNNGqE_pyfKDh1DMg-8e8eLHv5rF2DuBreU1pwJLaugVbtKcYlpWkxF7pEX5hdkARNNmmc0e8cG1hNQPgnTCq2_D59PRbhNF5jxrGDA_Udcs8NO0usVcTUfQROPD4Ib7R00epvMJsE_MMwiWFUR9NTs_P7EUPc4AYLARaR23f74eoDDeU3q9qLObHTBJ7CWpMsjTLSuAMiOUpa1SR0KdsbfUvMzDI2HVwfisWtjRrXmVxUvNjsDT1RlILdKbvaWWQM2qsPc55szCvxirGMt6MXW-WBhObXt7SeLjcpYGQ3SwFo4jUr4kFA17qyMXIOiiWEZV3TnYUzNvKPl3tShC3OWJ7eeQapWJPc7hukxP3uMsuuJxbT5l6SZjBFGFILMafiYCTQc4y60vzglpxlsXcqyD9WUx3w2a89vaocXuUX_A8LRKbfei-9wWP91aLIisiNXgezk0l8JT-qfwLoyYRySrHPuxc9ONx6BMuhLPAUO7gm4F1taOqZE73WvcXI8yOjatTcTCgwInOVspoH1bU83FFksCO6G9NOzVOCDkXQ0vYnC-5aY3hnNppOk5fK2qBh3-kC1beag

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 169ms
168ms Ping
text/plain 142.251.12.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-S3DKHVPF03&gtm=2oeaa0&_p=1980954100&cid=1495621433.1665867824&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AI&sid=1665867824&sct=1&seg=0&dl=https%3A%2F%2Fpastelink.net%2Fwwr50xs3&dt=On%20the%20internet%20Sports%20Betting%20instructions%20Tips%20on%20how%20to%20Bet%20Like%20A%20Champ%20-%20Pastelink.net&_s=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S3DKHVPF03&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f100.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pastelink.net/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:50 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 2760 0
128 B 193ms
191ms Script
text/plain 103.231.98.195
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156011&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.195 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 Oct 2022 21:03:50 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 97BC 42 B
64 B 171ms
171ms Fetch
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstxuOH-M4ObbQs8JKvAQdK1lhJinMiIwDTLTW9H761YdR4utjt-2Q5HUhYL3FsKw9DDqX63zpWSWU_ESIn1BUskT3uC7qU8&sig=Cg0ArKJSzPz12XNt0_MjEAE&id=lidar2&mcvt=1000&p=0,0,600,160&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221012&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=33&adk=943508956&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1665867828755&rpt=821&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Oct 2022 21:03:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: pro.ip-api.com
URL: https://pro.ip-api.com/json/?key=ZxSSLwZtxrKxQbv&fields=status,countryCode,region

Domain: idsync.rlcdn.com
URL: https://idsync.rlcdn.com/458249.gif?partner_uid=2a72ac6e-d2a7-4498-a830-f22ecdd611e2

Verdicts & Comments Add Verdict or Comment

167 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

61 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
pastelink.net/	1970-01-20 07:34:27	Name: PHPSESSID Value: 68a1n7ckn33olg20v4orea2k7d
.pastelink.net/	1970-01-20 08:54:03	Name: _gcl_au Value: 1.1.171779558.1665867823
.pastelink.net/	1970-01-20 06:45:54	Name: _gid Value: GA1.2.1434387865.1665867824
.pastelink.net/	1970-01-20 06:44:27	Name: _gat_UA-55088947-2 Value: 1
pastelink.net/	1970-01-20 06:45:54	Name: plTest Value: false
.pastelink.net/	1970-01-20 16:20:27	Name: _ga Value: GA1.2.1495621433.1665867824
.pastelink.net/	1970-01-20 06:44:27	Name: _gat_advallyTrackerpl Value: 1
pastelink.net/	1970-01-20 07:27:39	Name: _pbjs_userid_consent_data Value: 3524755945110770
.pastelink.net/	1970-01-20 16:06:03	Name: __gads Value: ID=8f2c905ad4131d7c-22825b7312d70063:T=1665867824:S=ALNI_MYERgYl_L2E4DAM8Iv_UfjylFhB-Q
.pastelink.net/	1970-01-20 16:06:03	Name: __gpi Value: UID=00000b6317f96d5a:T=1665867824:RT=1665867824:S=ALNI_MaIC8VSBkvT_EBk77W-ctFB6HCOAQ
.pastelink.net/	1970-01-20 16:20:27	Name: _ga_S3DKHVPF03 Value: GS1.1.1665867824.1.0.1665867825.0.0.0
.crwdcntrl.net/	1970-01-20 13:13:16	Name: _cc_dc Value: 2
.crwdcntrl.net/	1970-01-20 13:13:16	Name: _cc_id Value: c61a3bf20dfebaf66864212f6b0c319d
.pastelink.net/	1970-01-20 13:13:15	Name: _cc_id Value: c61a3bf20dfebaf66864212f6b0c319d
.pastelink.net/	1970-01-20 06:45:54	Name: panoramaId_expiry Value: 1665954225466
.amazon-adsystem.com/	1970-01-20 12:57:25	Name: ad-id Value: A0LDtnC4ek00rfOxL2zmZKo
.amazon-adsystem.com/	1970-01-20 16:20:27	Name: ad-privacy Value: 0
.doubleclick.net/	1970-01-20 16:20:27	Name: IDE Value: AHWqTUmQpqO4ecnSQJCEj2UyWns0TjI0oAEVYchYXWGbDN-Mjq3GWc5aKuXUPjZRPcI
.id5-sync.com/	1970-01-20 08:54:03	Name: id5 Value: 40e3d651-2207-453f-90e7-fe7cb9a4dcdc#1665867826724#1
.smaato.net/	1970-01-20 07:14:42	Name: SCM Value: 8465a01f
.smaato.net/	1970-01-20 06:59:35	Name: SCMaps Value: 8465a01f
.sharethrough.com/	1970-01-20 07:27:39	Name: stx_user_id Value: 658a50af-fd5d-4ba6-bf3b-d150d16ba97b
.bidswitch.net/	1970-01-20 15:30:03	Name: tuuid Value: 3233a8c9-4115-43a5-a376-c2eb49410f10
.bidswitch.net/	1970-01-20 15:30:03	Name: c Value: 1665867827
.bidswitch.net/	1970-01-20 15:30:03	Name: tuuid_lu Value: 1665867827
.doubleclick.net/	1970-01-20 06:44:31	Name: DSID Value: NO_DATA
.casalemedia.com/	1970-01-20 08:54:03	Name: CMPS Value: 4848
.adnxs.com/	1970-01-20 08:54:03	Name: anj Value: dTM7k!M41.D>6NRF']wIg2ImSnX>rx!@wnfH8K6pQK`!5=E<L5?%K3bjs6b_HzbYe8F^V3BTt:/[VG1A[R5:uabpRzqF1`b`F*5f-T
.adnxs.com/	1970-01-20 08:54:03	Name: uuid2 Value: 8968025534682147906
.smartadserver.com/	1970-01-20 16:14:42	Name: pid Value: 7733999678171328375
.ads.pubmatic.com/	1970-01-20 06:45:54	Name: KCCH Value: YES
.media.net/	1970-01-20 15:30:03	Name: visitor-id Value: 3088694271535431000V10
.casalemedia.com/	1970-01-20 15:30:03	Name: CMID Value: Y0sgM2Q3fSISiTVypnFjZQAA
.casalemedia.com/	1970-01-20 08:54:03	Name: CMPRO Value: 4848
.adsrvr.org/	1970-01-20 15:30:03	Name: TDID Value: 5e4858c0-d88b-4ad3-b03c-e0c31745bc26
.zemanta.com/	1970-01-20 15:30:03	Name: zuid Value: yV3iT-48FA3I-PiaqFP8
.rubiconproject.com/	1970-01-20 15:30:03	Name: khaos Value: L9AEOYPO-1-D5EB
.pubmatic.com/	1970-01-20 08:54:03	Name: KADUSERCOOKIE Value: C2E1DFFF-90AF-45E8-9817-31DBC0A6255C
.pubmatic.com/	1970-01-20 08:54:03	Name: chkChromeAb67Sec Value: 1
.pubmatic.com/	1970-01-20 06:45:54	Name: pi Value: 156011:2
.pubmatic.com/	1970-01-20 08:54:03	Name: DPSync3 Value: 1667001600%3A197_201%7C1666396800%3A164%7C1665878400%3A174
.pubmatic.com/	1970-01-20 08:54:03	Name: SyncRTB3 Value: 1667001600%3A220_21_13_71_7_54
.casalemedia.com/	1970-01-20 08:54:03	Name: CMTS Value: 4761
.adsrvr.org/	1970-01-20 15:30:03	Name: TDCPM Value: CAESGwoMc2hhcmV0aHJvdWdoEgsIxOqeltm-lzsQBRIWCgdydWJpY29uEgsI4OTcmtm-lzsQBRgFIAIoAjILCMSdnMLvvpc7EAU4AQ..
.yahoo.com/	1970-01-20 15:30:25	Name: A3 Value: d=AQABBDQgS2MCEBiCrHTrnqScUAqRovFbY7sFEgEBAQFxTGNVYwAAAAAA_eMAAA&S=AQAAAhEtG-HJv2lvoEqPKklMjbo
.mathtag.com/	1970-01-20 16:10:23	Name: uuid Value: 9ef0634b-2034-4800-92e4-ddd8d7126f0a
.adform.net/	1970-01-20 07:29:06	Name: C Value: 1
.pubmatic.com/	1970-01-20 08:54:03	Name: KRTBCOOKIE_377 Value: 6810-5e4858c0-d88b-4ad3-b03c-e0c31745bc26&KRTB&22918-5e4858c0-d88b-4ad3-b03c-e0c31745bc26&KRTB&23031-5e4858c0-d88b-4ad3-b03c-e0c31745bc26
.simpli.fi/	1970-01-20 15:31:30	Name: suid Value: 95B09608F370452BA2DF4425E9B5BB5F
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 15:30:03	Name: bcookie Value: "v=2&7c41a84c-0d5a-49af-8301-bb8c7d3fa9ff"
.linkedin.com/	1970-01-20 06:45:54	Name: lidc Value: "b=TGST01:s=T:r=T:a=T:p=T:g=2932:u=1:x=1:i=1665867828:t=1665954228:v=2:sig=AQH3QKophTEeM4IuxNePD35v36fb5bZS"
.pubmatic.com/	1970-01-20 08:54:03	Name: KRTBCOOKIE_80 Value: 22987-CAESECtswvNhpt0xpD3CDHlsMvQ&KRTB&16514-CAESECtswvNhpt0xpD3CDHlsMvQ&KRTB&23025-CAESECtswvNhpt0xpD3CDHlsMvQ&KRTB&23386-CAESECtswvNhpt0xpD3CDHlsMvQ
.pubmatic.com/	1970-01-20 08:54:03	Name: KRTBCOOKIE_27 Value: 16735-uid:c213634b-2034-4c00-af24-bf7a9e7bdf98&KRTB&16736-uid:c213634b-2034-4c00-af24-bf7a9e7bdf98&KRTB&23019-uid:c213634b-2034-4c00-af24-bf7a9e7bdf98&KRTB&23208-uid:c213634b-2034-4c00-af24-bf7a9e7bdf98
.adform.net/	1970-01-20 08:10:51	Name: uid Value: 453061477553175241
.pubmatic.com/	1970-01-20 07:27:39	Name: KRTBCOOKIE_148 Value: 19421-uid:95B09608F370452BA2DF4425E9B5BB5F
.pubmatic.com/	1970-01-20 07:27:39	Name: PugT Value: 1665867829
.rlcdn.com/	1970-01-20 15:30:03	Name: rlas3 Value: B0tIsS6Hz3ovypoYzGAHq/4DHJk8tlchCZfXJjoGQP0=
.rlcdn.com/	1970-01-20 08:10:51	Name: pxrc Value: CLXArJoGEgUI6AcQABIFCOhHEAA=
.pubmatic.com/	1970-01-20 07:27:39	Name: SPugT Value: 1665867829
.rubiconproject.com/	1970-01-20 15:30:03	Name: audit Value: 1\|X/nyWLmwnAyqdWBpP3P8VYr+YNp8OugmV1PO8pXIpUJNDY5C4h7Kr5n/xNDN1Y3AiAYEmhriK+oiZ07GJqnMno4BjqNRGrmz

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.googletagservices.com/dcm/impl_v91.js(Line 99) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://www.googletagservices.com/dcm/impl_v91.js(Line 111) Message: Origin trial controlled feature not enabled: 'attribution-reporting'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2df9649a394d0a664b2f1f5b5e5fff70.safeframe.googlesyndication.com
aax-dtb-cf.amazon-adsystem.com
aax-eu.amazon-adsystem.com
ad.doubleclick.net
ads.pubmatic.com
adservice.google.com
adservice.google.com.au
b1sync.zemanta.com
bcp.crwdcntrl.net
c.amazon-adsystem.com
c1.adform.net
cdn.adligature.com
cdn.doubleverify.com
cdn.id5-sync.com
cdnjs.cloudflare.com
cm.g.doubleclick.net
code.jquery.com
cs.media.net
csi.gstatic.com
dsum-sec.casalemedia.com
eus.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
id5-sync.com
idsync.rlcdn.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
lb.eu-1-id5-sync.com
lbs.eu-1-id5-sync.com
match.adsrvr.org
match.sharethrough.com
mts0.google.com
pagead2.googlesyndication.com
pastelink.net
pixel-us-east.rubiconproject.com
pixel.rubiconproject.com
pr-bh.ybp.yahoo.com
pro.ip-api.com
px.ads.linkedin.com
rr2---sn-hxa76n7z.googlevideo.com
rtb0.doubleverify.com
s.ad.smaato.net
s.amazon-adsystem.com
s0.2mdn.net
securepubads.g.doubleclick.net
simage2.pubmatic.com
simage4.pubmatic.com
ssbsync-us.smartadserver.com
stags.bluekai.com
sync.mathtag.com
tags.crwdcntrl.net
token.rubiconproject.com
tpc.googlesyndication.com
tps.doubleverify.com
um.simpli.fi
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
x.bidswitch.net
idsync.rlcdn.com
pro.ip-api.com
103.229.205.243
103.231.98.194
103.231.98.195
103.231.98.196
104.17.24.14
104.21.93.14
104.254.150.241
104.65.228.208
104.65.229.32
13.107.42.14
13.251.228.157
13.33.79.24
13.33.88.84
13.35.17.5
139.5.84.243
141.95.98.68
141.95.98.71
142.251.10.105
142.251.10.149
142.251.10.157
142.251.10.97
142.251.12.100
142.251.12.154
142.251.12.157
142.251.12.94
162.19.138.82
172.217.194.132
172.217.194.157
172.253.118.138
172.67.38.106
178.79.155.87
185.84.60.21
199.187.193.202
23.36.254.7
23.36.48.24
23.9.185.218
3.0.69.23
3.33.220.150
34.149.43.113
34.83.125.63
35.213.12.39
52.220.251.156
52.46.130.91
52.94.220.185
54.192.150.68
69.16.175.42
69.173.158.64
70.42.32.159
74.125.109.199
74.125.20.94
74.125.24.148
74.125.24.94
74.125.24.95
74.125.68.132
74.125.68.154
8.43.72.97
00bd0c7e75122105dde4eb0385a999256373242d9998d1f948c5cbcf821d7b5b
01408f8061623faa6d2c0f015cd23483c3aa363c095e152f613ed94c87a5803d
018420e737716b45749449e1c26e06190371aa7a83a7406a1f44c3fd105521bc
02dc30d0a6224d227cb1a3988826a92d44d78cc0c53ce6ad1d092211e76aea9b
04b0100c247e9cfe0a22758dbfae4e4ec4562548e6af186d03f76943ccac7b47
0508a8a5a368a4ae1f86a156d4723c734cd3b1d22cf3d45d0c69afd6d2bacbd3
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
13100cd3879e5c1385581d7c88153e60cd7c3e4b0578fe2838daa56da689769b
15f20e02ef301e62ed325d633f971c506dcf1be3458c2371b849b505bb8673dc
178996f91fcc30fcab68d58ab30fdfd3820198e3f6bd9764a71e9c5259cb7f92
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
18ffb82a05bcd7e430f57b9428d2a6990f127948e7ff14d66c3784a84f4330ee
1af2148d7bd5e2a0c9ddc1c5b9ff072996852f4f11ebc19695ba4ee08ddb9c4a
1bc6531d710b7b809320e2160c299e643bf5f74659cf30125e8e950e1e144f2a
1c5ea13fb089a755e1ac11d873fbeb94f272578656800f74407829c19d025af1
1c9e4c65f9d921b1c0829958cc7b2f307a3e22ac7a23e8315b6db4c0954e1107
1ca7d45c26841657f394d905623d5e5c9c7f32aecc66d66ff8401388ffc43097
250686eb4f9e94b0bd0812e4e65b239b3355af85e21aff1dfaf3914f8b99f8f3
277c2feef0a479fec8d6dff68ec2bf47b1a74e3fe07fff001039f6f802fd6222
2c0db479250b840200841d4db80d3c704464290c6bf409c185c9c30b490a0f1b
30c16319dee7fc64b48fd737a5e7c5f0b88d0e2d25a598ed93dc7c3eb8e11020
328f7808cfa82581e66b87932fd28a928ce58f69a388aabe667e5154c3a9a437
3519cfe9e90ed65c2de6beaf3c647e7c88f67cf434502b1e62400f67a3b9c018
362925b63fe1d27f0632fe1c0f9d1f1fa85d91c55b9020b722850d6351d789b8
37d054ac8410cf892581c4796aa933de77f72ab8bd9d51c999490f7a7e3d3f70
396c964c85a9b2e9a380bb18b1f6d51960f2bc7f7d4fd2bcf4754fc0ac443cd0
39ea310e86ee5d4b745f48121268b8848ebbc92d2b9a1a791c36c7a03512b101
3a73b36061944ebbb33696553917d393280f796e212afcd09057b441c1168606
3dcf1ad00b0974c4f09cdc6e4293f650397270344eb472fc7564a36ebcf312c4
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
42074ae258a13356bbc4dbe1133b20e4485a3d9bfea58353fcd83ce71981ee66
430d2d537dde971ff390bca2f486887d2e12e4daf92696e0393d011cff2d863b
459d16c4160346aa45f0fa3e3513612a6fed9378b58c54fdd29f2b6faefddb67
467a5b06cb117035f7882e8c71d80e093f04ce586c1ac2b84e7e4adf978edb30
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4902d0b50b7aaf4ddba3726bbcaa748c7c2e6f4092d1fd15193cdaca2c2fa724
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b6d244a569a8befc0b901e3dca8e82f19b188e2d3e76f7c62fce96935ed6311
4f93c0215e933b6cb432ac6fa32f7feaca61a7d967a577a05e0bcb3e6626a2a4
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
50a60e5e5f2e8f10a2f8685031ec9849ba8faff613139f3a402e89f25ccbbabc
540f48245870c99b467d8171b70e0fac699be40281033d7d90e4a70eb4666f0b
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
57226adbc32c91a8cd4ec9ee08e4f155f3450e79256731c04f81709a58c4c1fc
5740ea039fa2894da5942c74ebbd622c42f128d2777881b5c654c85fe07cb66f
58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488
59b0485c1fec4f53ce71bbf2805f19215f6651cc406e6ff66548444594eebc7b
5ca180607fd93a9e1b6b1d03e5ac2c4d9f661f7ce867be2b9b91ba3c3e9da926
5d162f1a957634c9f376091ae016a94b3bb7e9b11830eafef203201156289f39
5ee28336152adca449d6f93482f37ffbd759afee6f6e3e7e72877431a4b2548d
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
60530e10524805256bd851633c30fd3aba138f482321e71f6019ec94441ccfa2
612ac93fa7a4f369ab6549ed35e681c03fb942081d36944edeec8b9ea3a0c1e8
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
651fc5051db295a80ef0ec8faf17ab61562ea6e220be33a1a127263e3681a491
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6f0507591c49aa88fab2433451c6c3154c5d4450636b43b749afa1ae2521fe2f
6f2c1aeade82fc5c824cf9f349adcc0ad46d16e4322b9cbc442644e26902f8c2
6f4813e4fe6dd891838e421479bf603f6d3f0d2a55b90517b875a77050471d4b
71f2940ec78bc4c5ff54c23fb9aa3faead0c28e69e0ab83c1998d21719a8b46f
733b81ca611521c0c5664701f060df9d5486014c1dba79acb22269bfc9e06d0a
752ff8324271233c2135a95dde8adf84e507296eacd17db421c623b0c5e5af85
77a0b11cd5e0c806337bf397bafdbb909d2d5b35a69258dc5e59697711da6a15
78892a8608e0798b07121b16c98885ea085971616c5ea6ad5f49d08303d9d0be
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
86ae37a750e77037da22fc68d21c68c5f60058a017466916d186bac9cd5f501b
874e545a5055f7c8602c30ffd711768e8105bb75c87045a794f934d9cffa30c6
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8af24d7350dbdc8eea22e4737deaa35a795b19b0560d7173113bec7e8a3effb7
8cad91e999229f2d8ccce22d7393f2f44e37fb3855978f1f0f7238c17d1ded6e
8e22e8601cb927cfcaa560470c56f4913def5cb16bc74a9ead9b072cbabe4ced
924aa05b323d36b5b38f14ed476b6194cebb043ab792f4160b77bf0234addb45
92f53b235a9efd9f918702ebf2635f389c7838d2c38f3c36c85804fa7f339b5e
9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526
981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0
9b7a2763288773976a369a1a52db5180edbc3d8a91521e78e57277f1ecb829fd
9c7ddfb74ebd494e83135523c605744d4d86844413a61dc572af925dbcb87cd8
9dc99a92f9d68c0bb47cf55e03971e0f068090465859bd483c97bf9c6fdd32e3
9de467698e6f01cefaf833467bb772c696f657197fc3c27255f2efade85bfba4
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a49a524dd26fd6b8a3275b692a00ebf28019503006efdcab7ae5e9c0d6833376
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a84d94b0dcd047bad60cb8d5b672102121205720bab6b0a429832b5cef59356e
a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940
a86e6460bb1400e1eb0c5dbf7baa1078524f4b06232a238401388a62dc8720a1
aa68e17fb13028f96c0d5b38fcf7006182894eb694625f9dedf5824d5066a5f0
aa693f03b1d3fd450ae3ddae706633e08bbedb1f4277670a1c4056aece5c9fcc
adc95bbf12184c1a406a301d34ffb8a8fbfa10ab0639ce675eb2476a317e7c37
b09446027180b67167594e89d0330395fb4f31e09db5cd0a7c94bea6ce34a7e3
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b388e642374740ae32a6fbc88dc2708c26e810443b2d9b2bd6974a0b43cfd04e
b3c218f921126409f2f4a82b74458117039037330ffb76b30df5c6062b353a90
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
b42f035c593881359488262fdaf928acd4b9e6129051810120cc361c2a9688dd
b47a72d5930339dc0b34855fce20ec85d6b785a21ce76d79bbbf345771e51ab1
b5b7440eb01b4db530c8b12650e39b4a3bfb1b49b7518c76b08bb6e8b8434a2f
b7e54c08be2d3028420666e9aca9074537fb351e2ece4e32b925ffca1840ce12
b8a8b548b702df9584cfb363e27f8e00eef7c01f2b5eb460eb854d7fd1432573
bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27
be3b15b1e68cf3e9278293d3b50491fe16c985e0ee5968852cac4fc062a7134e
bf1221985966d7da32e91ce9dbe426f6667abc7d0178dfec3e02b78a890c58c7
bf293c6ec64062426d963624d5727bf3ef92eb7c478399918c502635c0c69726
bfcf80bfb2d17562d38d3f50db9274d902ec50021beb3cc46ca61de7d2410a2d
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c24ccee9a35eef9e74411eac871935bdff6bcb895cce80b754b66d3e4292a3ce
c436c070b4846bddc3edcd9b1a64b2847af21d3725bf4e9e297c978db85259b6
c64cda3c1c7c935b57b27894caec3b370b98d70011c8e5ea2f31691be13c8fe7
c691be9884c456280417d5ad966d7cfe6bd0a5dc00fbf60c2e1775607a41aed4
cb7a3056d385c2fe63ac184dba2b7a8ba742f6807c5186cd4ff26baa39307872
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
d4bcd19bb05b07d9872c1cc5529a66c058542afee5958e2716fcba8a5d880f60
d611cb158976ef0f0853abc81e8c095f889f4c9c954610f80eb90fa554e94bbb
e0addf73edd9e92928605d8a1a2b57776f46a0f181c76c90b9b38c6698dda527
e23aa41677b6c7479e9f2a46fb0e8a85c5ece6c088bb9fa8938fe970fc8493ab
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73
e81e653e6d3b349628f196fc41799f4a55a01a921ed01f0412bfaa985486122a
e9881b639c7528a358803222a3d5b1ea1fae69ede0ad9ee2e363be38a2712302
ebbb5d4ff5173e5dc1c7627341ade76b290c077c94c78e41bbfeff8f27ee47b9
ebd902c796e15c5ea443dff52f3581b7b0076a00fcf4acce32983a48d27d877f
ebfd96030683611d9ed054682f1ddf8b9098bc7d10105602b338605b0ae82a9a
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152
ed6cd01c384db70bedbe24986aa85b0745f994ad71b7e5712f8a60e1ff457d7f
ee9620c51f33cebb8cb9c6bce01a5569f8b49b5be3e6f66c1e3ce3c3c63fb05a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2732b0f9327632cf190f94cfeae74e77deed8306fcc26916200d352ad0a166a
f43767361e15e0c49aa31e1957c95066b3b65caec29cc34941f4f166d9479058
fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

pastelink.net Open in urlscan Pro 178.79.155.87 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

282 Requests

86 %HTTPS

0 %IPv6

39 Domains

65 Subdomains

47 IPs

8 Countries

6094 kBTransfer

11131 kBSize

61 Cookies

15 Outgoing links

Redirected requests

282 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 15 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

pastelink.net Open in urlscan Pro
178.79.155.87 Public Scan

Screenshot
Live screenshot

Full Image

282
Requests

86 %
HTTPS

0 %
IPv6

39
Domains

65
Subdomains

47
IPs

8
Countries

6094 kB
Transfer

11131 kB
Size

61
Cookies

282 HTTP transactions
15 data transactions