www.howtoremoveit.info Open in urlscan Pro
2606:4700:3035::6815:16d1 Public Scan

URL:
https://www.howtoremoveit.info/
Submission: On July 15 via manual (July 15th 2021, 7:16:29 am UTC) from BY

Summary HTTP 133 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 28 IPs in 4 countries across 17 domains to perform 133 HTTP transactions. The main IP is 2606:4700:3035::6815:16d1, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.howtoremoveit.info.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on September 5th 2020. Valid for: a year.

This is the only time www.howtoremoveit.info was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
47	2606:4700:303... 2606:4700:3035::6815:16d1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:e134	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:803::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
12	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
1	13.224.101.72 13.224.101.72	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2008	15169 (GOOGLE) (GOOGLE)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:1a	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:135e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c06::9c	15169 (GOOGLE) (GOOGLE)
1	142.250.74.194 142.250.74.194	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
18	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
20	2a00:1450:400... 2a00:1450:4001:828::2001	15169 (GOOGLE) (GOOGLE)
4 5	2a00:1450:400... 2a00:1450:4001:801::2004	15169 (GOOGLE) (GOOGLE)
1	23.111.9.38 23.111.9.38	33438 (HIGHWINDS2) (HIGHWINDS2)
1	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
133	28

47 2606:4700:3035::6815:16d1 (United States)

ASN13335 (CLOUDFLARENET, US)

www.howtoremoveit.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:e134 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.101.72 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-101-72.zrh50.r.cloudfront.net

z-na.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:1a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c06::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.74.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:1450:4001:828::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:801::2004 (Frankfurt am Main, Germany) 4 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.9.38 (United States)

ASN33438 (HIGHWINDS2, US)

cdn.mouseflow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
47	howtoremoveit.info www.howtoremoveit.info	2 MB
32	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	489 KB
19	doubleclick.net googleads.g.doubleclick.net stats.g.doubleclick.net	103 KB
9	gstatic.com fonts.gstatic.com www.gstatic.com	153 KB
8	google.com 4 redirects adservice.google.com www.google.com	998 B
5	googletagservices.com www.googletagservices.com	176 KB
4	googleapis.com fonts.googleapis.com ajax.googleapis.com	32 KB
3	google.de adservice.google.de www.google.de	394 B
2	google-analytics.com www.google-analytics.com	19 KB
1	mouseflow.com cdn.mouseflow.com
1	googleadservices.com partner.googleadservices.com	267 B
1	cloudflare.com cdnjs.cloudflare.com	2 KB
1	bootstrapcdn.com stackpath.bootstrapcdn.com	11 KB
1	jquery.com code.jquery.com	5 KB
1	googletagmanager.com www.googletagmanager.com	37 KB
1	amazon-adsystem.com z-na.amazon-adsystem.com	8 KB
1	onesignal.com cdn.onesignal.com	3 KB
133	17

	Domain	Requested by
47	www.howtoremoveit.info	www.howtoremoveit.info ajax.googleapis.com
20	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
18	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
12	pagead2.googlesyndication.com	www.howtoremoveit.info pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
7	fonts.gstatic.com	fonts.googleapis.com
6	www.google.com	4 redirects www.howtoremoveit.info tpc.googlesyndication.com
5	www.googletagservices.com	pagead2.googlesyndication.com googleads.g.doubleclick.net
3	fonts.googleapis.com	www.howtoremoveit.info googleads.g.doubleclick.net
2	www.gstatic.com	googleads.g.doubleclick.net
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
2	www.google-analytics.com	www.howtoremoveit.info www.google-analytics.com
1	cdn.mouseflow.com	www.howtoremoveit.info
1	www.google.de	www.howtoremoveit.info
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	cdnjs.cloudflare.com	www.howtoremoveit.info
1	stackpath.bootstrapcdn.com	www.howtoremoveit.info
1	code.jquery.com	www.howtoremoveit.info
1	www.googletagmanager.com	www.howtoremoveit.info
1	z-na.amazon-adsystem.com	www.howtoremoveit.info
1	ajax.googleapis.com	www.howtoremoveit.info
1	cdn.onesignal.com	www.howtoremoveit.info
133	23

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.youtube.com
transparencyreport.google.com
blog.howtoremoveit.info
d19v7x158tl0yn.cloudfront.net

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-09-05` - `2021-09-05`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-06-22` - `2021-09-14`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
z-na.amazon-adsystem.com Amazon	`2020-12-12` - `2022-01-10`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
*.mouseflow.com Sectigo RSA Domain Validation Secure Server CA	`2020-06-12` - `2022-09-14`	2 years	crt.sh

This page contains 17 frames:

Primary Page: https://www.howtoremoveit.info/
Frame ID: C59A4FBB0E8F4D80D345B80D81EEAD44
Requests: 76 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210708/r20190131/zrt_lookup.html
Frame ID: 121BCFCBCB24DAD5D39E6097012239CC
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&adk=1314090037&adf=164220786&lmt=1626333366&plat=1%3A16809992%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366798&bpp=4&bdt=754&idt=94&shv=r20210708&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8167601955083&frm=20&pv=2&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=120
Frame ID: 0C49F0109FE0BB7A2131AF30E711CBEA
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=280&slotname=3096791380&adk=1331721975&adf=2381872099&pi=t.ma~as.3096791380&w=1200&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366802&bpp=5&bdt=757&idt=123&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=195&ady=669&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=T5ZGnmyvp2&p=https%3A//www.howtoremoveit.info&dtd=127
Frame ID: F24E75B56EAE375F249947CD5631805A
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=600&slotname=4915375718&adk=3019375545&adf=167443777&pi=t.ma~as.4915375718&w=273&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=273x600&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366807&bpp=1&bdt=762&idt=126&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1148&ady=1806&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=svNWN9UtfU&p=https%3A//www.howtoremoveit.info&dtd=129
Frame ID: D59981D9E39DDE415AEA6AE3E90BE021
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=600&slotname=5120651931&adk=863691058&adf=1889130561&pi=t.ma~as.5120651931&w=273&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=273x600&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366808&bpp=1&bdt=763&idt=133&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C273x600&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1148&ady=2900&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=ZuEKV64edp&p=https%3A//www.howtoremoveit.info&dtd=135
Frame ID: D86696E01ECB7B5EF35C7F6C669993B1
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=90&slotname=4667386051&adk=692682234&adf=4050520369&pi=t.ma~as.4667386051&w=728&lmt=1626333366&psa=0&format=728x90&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366809&bpp=2&bdt=764&idt=139&shv=r20210708&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc51d1e5889e5c76c-227c86ff6bc900dc%3AT%3D1626333366%3ART%3D1626333366%3AS%3DALNI_MakYRNpXy-O423JeNXGJLOPItKFrQ&prev_fmts=0x0%2C1200x280%2C273x600%2C273x600&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=1123&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfoeE%7C&abl=CF&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&fsb=1&xpc=ZUN6gri07v&p=https%3A//www.howtoremoveit.info&dtd=142
Frame ID: 19DD868990777CD8A22D8DB350CC7CE3
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: D3D6398275EC4F2867F0A1282A347CA7
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/_htgYqD-D_hqupanZs0dgoAXJAmF8Earzw--3TVapKE.js
Frame ID: B5DAF2FAD7A65B94C173B2C51A0ABC88
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 8CFE3B31BECE1349E38CBAE7976BF8C2
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 088E9EE9C2B63FE9DF7229151CBD441B
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/_htgYqD-D_hqupanZs0dgoAXJAmF8Earzw--3TVapKE.js
Frame ID: E509DC7EC9CBD936BC797542AE0F6A88
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 9597DBACE9CD30749C42D1F0CCF472EF
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/_htgYqD-D_hqupanZs0dgoAXJAmF8Earzw--3TVapKE.js
Frame ID: F4A7BF661173417B5DB42D85775E85F3
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/_htgYqD-D_hqupanZs0dgoAXJAmF8Earzw--3TVapKE.js
Frame ID: DAC70D4F993C8755769332F7F0933169
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 66AC3DA9C979CA2AD4AD9B4EFDEB5A74
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: C6ED9D9DDC2661B7CD687D5F550A1EC4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

133
Requests

100 %
HTTPS

89 %
IPv6

17
Domains

23
Subdomains

28
IPs

4
Countries

2758 kB
Transfer

4476 kB
Size

9
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/How-to-Remove-it-1414966761877779/?fref=ts

Search URL Search Domain Scan URL

URL: https://twitter.com/How_to_Removeit

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCDgAP4l8bPmFCtaCQHmK96Q

Search URL Search Domain Scan URL

URL: https://transparencyreport.google.com/safe-browsing/search?url=howtoremoveit.info&hl=
Title:

Search URL Search Domain Scan URL

URL: https://blog.howtoremoveit.info/
Title: Blog

Search URL Search Domain Scan URL

URL: https://d19v7x158tl0yn.cloudfront.net/fmrt/fmrtblog2setup.exe
Title: Click here to begin your download manually

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 85

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 120

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 124

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 126

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

133 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.howtoremoveit.info/ 271 KB
54 KB 1013ms
939ms Document
text/html 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.howtoremoveit.info/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

f98624809e936abad66ee499e8233b11724c69775403d975ff4464165fbb7199

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:method: GET
:authority: www.howtoremoveit.info
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
content-type: text/html; charset=utf-8
cache-control: private
set-cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; path=/; HttpOnly; SameSite=Lax th=Fired; expires=Sat, 14-Aug-2021 07:16:05 GMT; path=/
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: POST, GET, OPTIONS
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VXSqRZweJizTg5RmQAYyikXJgwweOXfk5hsUkPcgF50kSabFkoGXZYcegE6afeYB9BSjKXmDhKmNs9M4yj4ITSs2HiIwhtqhj7MC9T4dmsjvSJZ6R6M1IfpX9m6BCo3N%2BrUIp7RFNTFym34Vs6L5pI5ZM7y1"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=0; preload
server: cloudflare
cf-ray: 66f1340be8bd1762-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 13ms
13ms Script
application/javascript 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js
Requested by: Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4ca739a13d804ea8806c9878d5b463d2a2c2a75b61a1b2f8a8e104e9b0daecb5

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 1964
etag: W/"96fc99e13be87550fcfc4474d30d43d3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 66f134152b444a62-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
expires: Sun, 18 Jul 2021 07:16:06 GMT

GET
H2 200 css
fonts.googleapis.com/ 6 KB
791 B 17ms
17ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600,700

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ae62dd075f4359b389158ec0ce732971da832938b5d630a24eb2e89111b00e1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 15 Jul 2021 05:26:04 GMT
server: ESF
date: Thu, 15 Jul 2021 07:16:06 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 15 Jul 2021 07:16:06 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.4.0/ 86 KB
30 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.4.0/jquery.min.js

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.howtoremoveit.info
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 13 Jul 2021 00:11:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 198271
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30768
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Jul 2022 00:11:35 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 134 KB
48 KB 31ms
19ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d557ac01f6bfe50ee326ee5f2d49f424ec776af5da5abb4231083ab4a772feb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48558
x-xss-protection: 0
server: cafe
etag: 17065370731229648185
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 15 Jul 2021 07:16:06 GMT

GET
H3-29 200 logowithName.png
www.howtoremoveit.info/Images/ 18 KB
19 KB 52ms
43ms Image
image/png 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/Images/logowithName.png

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

fd368bf4cbbdb094b795520500791b8fc40c50ea697888038188d3f0ebbadf21

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /Images/logowithName.png
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 252499
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 18421
last-modified: Fri, 22 Feb 2019 09:05:56 GMT
server: cloudflare
etag: "f56340d28dcad41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ocIeNL%2BuRqh2Tz9zY2znlPlripOkm3%2FBdrOpqEHTIgqDQ1LzdSC5XNWmnh%2BjJOd2qRLZycHwSPjU8tM6GX6E%2FtJ9za9zQBThdAxSqTdGCh7sfTmgYihC3veNQwILoRLxBGlqlEpJjYqeywegfCO5Qw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156afb4a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 google_sb.png
www.howtoremoveit.info/Images/ 14 KB
15 KB 26ms
18ms Image
image/png 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/Images/google_sb.png

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

2ea38822f8bbbe74502b9274bcade3eacaccef4be92b6674aa6df6299370f863

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /Images/google_sb.png
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 252499
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 14578
last-modified: Wed, 20 Feb 2019 02:49:32 GMT
server: cloudflare
etag: "0c6e1e7c6c8d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=cZZR%2B6wfMeLPh%2FhOu%2ByVhXZKEQ8%2B9VIkhyk7yGpDY9e2%2Bk2QY1dgdYh81cCdGDbO8c7wS%2FTnsh%2FOSENIPc8u6BCo39qRCKVNe0Upyaw7aQhx1ROK9FoptQ0BYB0jsBWAJGm7QsjLb8NwBvR0tshGew%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156af74a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 en.png
www.howtoremoveit.info/Images/ 294 B
946 B 42ms
34ms Image
image/png 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/Images/en.png

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

a6f4e21e8920d976b1e9d7bdfa33e2d314c9aee23d65bb7a33c8fe481f6604ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /Images/en.png
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 252499
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 294
last-modified: Fri, 23 Mar 2018 10:18:03 GMT
server: cloudflare
etag: "2f6d573a90c2d31:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=mZ9SH6cPNXAfBckTq8SyocHPzBvX%2F6UzEEtOlDnW8nR54bdEPG0x7w2RXmpnBe%2BSpOeOBeAZURJ8ATPVh6EO4WYBKVcz5Scqq3%2BsTisIsX%2BFwcvlJwWMgZa1gTnoRyMXonyT%2FYeOR5TZt0liBX3oLw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156af64a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 ru.png
www.howtoremoveit.info/Images/ 98 B
749 B 43ms
35ms Image
image/png 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/Images/ru.png

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

f2f0648e4bdb13171776559355551d34ea5e6e19ebebdda40c0233c09dfcefd3

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /Images/ru.png
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 252499
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 98
last-modified: Tue, 17 Apr 2018 10:00:06 GMT
server: cloudflare
etag: "fdbcfbdc32d6d31:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2BCLTqY6x2ckyfyPlQabmLfRum6o2vtedpXYWIrQqYCod9ahk8yBf75fogum4q6N8%2BRqmSIU2HtESaOvqd2loCaHkdGG%2Fk68TkHtLMQ%2BhnKoRqMmHGwezFZ0pd6tTbHJO%2FFhv3d%2BxbeLFPWHVROluiA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156afe4a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 fr.png
www.howtoremoveit.info/Images/ 132 B
783 B 53ms
44ms Image
image/png 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/Images/fr.png

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

2de7002ff4737368f9dcb6cd8467ee9c2738483d88c5e3cf8af14f7a3e67eb19

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /Images/fr.png
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 252499
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 132
last-modified: Fri, 20 Apr 2018 05:33:59 GMT
server: cloudflare
etag: "ad2ed52e69d8d31:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=y2byuQvLt1YHjLQCfTPM0RWNGli8OBR9HyNsZS%2Bi9Bbez9Bx6SV4OOuZKWeTqp4cBDjcuywZDQIBqJEUStSk8A%2FNC%2FWs50MLmHIt3G6wMTUBDhrcTJl88d2iN%2BIQgAfK24a%2F4lqX9MgEzUDds52JAA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b034a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 search.png
www.howtoremoveit.info/Images/ 458 B
1 KB 52ms
44ms Image
image/png 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/Images/search.png

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

56d80532e1283478e0ca27d16ede80bed7687bee01742ab59aac81bae5a83805

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /Images/search.png
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 336645
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 458
last-modified: Tue, 17 Apr 2018 09:59:47 GMT
server: cloudflare
etag: "e9169ed132d6d31:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=wTfEh%2FM2Zr%2BV3%2Bvt7rWd9vZChNWSt18H6q4HrB6Hy2guY7Al%2FlejU5HmqgRk0eFmx2HCSW3hsg0qJoVfBTCebSRWLe%2FdDFSB0wMzyeBA%2FeSJtrriU8kI9poF%2Bt48C2H1IKzdpw9Md9OXffl3PAcnDA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b024a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 internet%20service%20providers%20that%20offer%2024x7%20customer%20support%20in%202021_orginal.jpg
www.howtoremoveit.info/images/postimage/3566/ 54 KB
55 KB 35ms
26ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/postimage/3566/internet%20service%20providers%20that%20offer%2024x7%20customer%20support%20in%202021_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

69e8c8b8b157abec05ceb0d8df7f59abc91d6d03f0a4fa8734fea1f628fee5c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/postimage/3566/internet%20service%20providers%20that%20offer%2024x7%20customer%20support%20in%202021_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 432619
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 55444
last-modified: Thu, 24 Jun 2021 06:25:58 GMT
server: cloudflare
etag: "52d0a1cbc168d71:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=nsBRGtL7%2B8qG7ahKOgE7MiIh5Jct9bkS6XBYpd%2Fc8h8xMHeEk6PEgQdH1K7EeFb8RCG4SLGUGCm7d5CCTwL%2BdjeOCAuccckrjSN%2FZ9JlFQIq8BCGyoHLVHWgP25Cd8vIYkZ3fyUeB6tUuxZyQokNxw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b044a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 chromium%20image_orginal.png
www.howtoremoveit.info/images/postimage/2319/ 32 KB
32 KB 54ms
45ms Image
image/png 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/postimage/2319/chromium%20image_orginal.png

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

885dd3ba5ec2b5ff297ac0b4812cd6ea2cd57d4d221729b5518a0b814d4f89b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/postimage/2319/chromium%20image_orginal.png
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 7117
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 32424
last-modified: Fri, 25 Jun 2021 10:17:41 GMT
server: cloudflare
etag: "6141e354ab69d71:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=leuRDy7Vc5Y772zwjVRtVax1rmV2KwnMXbtxnYEenaX2VBZ6dBkVdqq8rDr6ZLuaHEoNpKGvobIz4%2BdZUV5h%2Fl9dzXL%2BnczLh%2BhgsuLZqpCL4yvneBtfGUQbIGiTKjrz8TPCpMHrBQu48sMErMlzGw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b064a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 managed%20it%20services_orginal.jpg
www.howtoremoveit.info/images/postimage/3569/ 51 KB
52 KB 55ms
46ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/postimage/3569/managed%20it%20services_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

b9558f7016a4385a8b72db292eec2a6c2b0c259c713122b105202fe661e21fc3

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/postimage/3569/managed%20it%20services_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 65024
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 52320
last-modified: Tue, 13 Jul 2021 09:52:53 GMT
server: cloudflare
etag: "1ab1a2d9cc77d71:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=U4w69utiAV%2B0WE6rQCzXkEHguqKPV75EUn895EH%2Bihr9aNykNjNzvTGz0EHljcXCE7cl48c8fTSuIKcBpmHJJ6iHycB9LMDMq71tGxUTOmLi%2FTZgH%2BZSjDkos03HbpCnqLSIP8QKIxPN2Wc0FbRciQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b084a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 ITL_Ads.png
www.howtoremoveit.info/Images/ITL/Banner/ 83 KB
83 KB 57ms
49ms Image
image/png 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/Images/ITL/Banner/ITL_Ads.png

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

00529cc4947e8493a8da51d3d75f09726e28ba6816ec2ba724c87d1cb4a1983d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /Images/ITL/Banner/ITL_Ads.png
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 7117
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 84719
last-modified: Fri, 01 Mar 2019 11:36:24 GMT
server: cloudflare
etag: "5e6222023d0d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=u8hXt2eXWnFCkvrRU4xP7A5YWuv6sqv9ztutEfp4k4ZBpiNvitmzLo2WNEbqDpDMFSA5nvVmqPoGmX9dSWvYGwlS9eriBaGjXcZLlWq9RzZtszlu2cbMZce5nv6NOXH4cSlheeOXlMg0jWmFpsmYRQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b094a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 apps%20for%20personal%20injury%20attorneys_orginal.jpg
www.howtoremoveit.info/images/postimage/3568/ 65 KB
65 KB 61ms
53ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/postimage/3568/apps%20for%20personal%20injury%20attorneys_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

bc58805330fbc8d179dae79257bd71e3ccad7e42af1ca9dac81bce49b8a19936

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/postimage/3568/apps%20for%20personal%20injury%20attorneys_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 432619
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 66225
last-modified: Fri, 09 Jul 2021 13:21:55 GMT
server: cloudflare
etag: "dd9f4e63c574d71:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=nL6ZUVMi4vtXqW4w%2BRETNU7mCVtD1ZapK%2BGbMEDZ6uZTT69XfcWe37sSleN6HxFi2KL3RE3%2FgnkwtMMJP7Pii6yeb0J93YaixqSG32F6xiM3JQ5Zj9DXQgbfhGHI%2B%2FAVaA8i4sv8WAqCL6Gerkt5iw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b0b4a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 farmers%20insurance%20company_orginal.jpg
www.howtoremoveit.info/images/postimage/3567/ 47 KB
48 KB 64ms
55ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/postimage/3567/farmers%20insurance%20company_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

eb70f6e954d178c4200bf8907568d7b86398b52c3a693fef5875a998a4ce7916

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/postimage/3567/farmers%20insurance%20company_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 584639
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 48430
last-modified: Fri, 25 Jun 2021 09:48:15 GMT
server: cloudflare
etag: "e83c1938a769d71:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=BAJ9X3zee0GaW5go5goUTfD9wxD%2BlzdUWkJ6rcpegGsa9W%2FQZT7tgEyKOE1%2BQVnW09642JHlW7eDCeo%2B5jek5ousy39bT4zEpu1luzUypGs%2FsAy0frhJ9HfHDzs35oZ6SW6kvn0hkGpq7BsnetxgdA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b0d4a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 fix-err_spdy_protocol_error-on-google-chrome_orginal.png
www.howtoremoveit.info/images/postimage/2222/ 49 KB
50 KB 64ms
56ms Image
image/png 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/postimage/2222/fix-err_spdy_protocol_error-on-google-chrome_orginal.png

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

de816a8f60f41bc7c3a17f9bcec549beb46fdb9c086dc21c347de992d5fd5c82

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/postimage/2222/fix-err_spdy_protocol_error-on-google-chrome_orginal.png
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 7117
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 50472
last-modified: Fri, 25 Jun 2021 13:39:11 GMT
server: cloudflare
etag: "30a9347bc769d71:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=dbyXk5ZzVejgif%2BjGD9wsH8lZ6kLiaCqAW%2BxVm0HaPEofB7O4eCicmPjqnCWLqVGMmxiQip2W1DkyP6UdpoVXuy5NJ8fHQZ8ZwDfYdk3UzEHnZ%2BUql3El%2FMAssqI03FG6p9iIk2nRvdWQjaO%2FEGygw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b104a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 use%20a%20product%20sampling%20guide_orginal.jpg
www.howtoremoveit.info/images/postimage/3565/ 53 KB
54 KB 65ms
57ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/postimage/3565/use%20a%20product%20sampling%20guide_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

f22da31728b179d3a21d80a13f54b75c2e5362c0b35386d5e57690c1abf08121

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/postimage/3565/use%20a%20product%20sampling%20guide_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 7117
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 54283
last-modified: Mon, 14 Jun 2021 06:40:48 GMT
server: cloudflare
etag: "43fcd35e860d71:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=PC6PfwI7NYvYO9Lk8%2Fn%2Ff6e8J4tu2zWPkMJ4umxBryycBMJm4kltAkkYFfe%2BMoUe4VJRNSazZZUv8kWKHlXgTj3OiEGbc5XVkbnJO%2BU%2FhoqOhSgQB%2BJXhvwIkTckOB%2B1vXTz8rOlSgPmC2uDyHWFLA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b114a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 how-to-build-your-business-through-google-cloud_orginal.jpg
www.howtoremoveit.info/images/PostImage/3459/ 53 KB
54 KB 68ms
60ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/PostImage/3459/how-to-build-your-business-through-google-cloud_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

86222f2978279f3de4c54d5b2375528bac3bdadad1df82d8a63c2dd6c3ec11b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/PostImage/3459/how-to-build-your-business-through-google-cloud_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 318788
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 54582
last-modified: Mon, 07 Oct 2019 09:13:55 GMT
server: cloudflare
etag: "649c418bef7cd51:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=2JoRZyB2KlZhy3nGWgBcR9E0uAeNyJO%2Fj%2BNb00pdkiEY3tw4TpRc0WdMHy2K13PGjP6ODZmZpP8Q8%2FSwG2sMrsYVAvmvojv%2FmKOgMAbZBZkD0WOGAOt2YEQsWk3rzRT4RonUQrL99QIj4LdGuDY69Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b144a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 dont-search-googles_orginal.jpg
www.howtoremoveit.info/images/PostImage/3481/ 48 KB
49 KB 68ms
60ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/PostImage/3481/dont-search-googles_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

3f6e3803d173e4e575336ae9d9f479a56f53fcb81c432e84f04258378e3279fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/PostImage/3481/dont-search-googles_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 143911
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 49497
last-modified: Fri, 15 Nov 2019 13:32:00 GMT
server: cloudflare
etag: "3635dfb99bd51:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=G3psXf9H%2BFtrDTPXEyc7g8uAY%2BsC0wlMZ1hsjnZimlduCbHrzZ0N9LzW38M7DPCCTQbyUnMVdWx7hPULgc7MVdpzk1pwWtIqPnLW3%2BK0JcJvnmalAAaaJJiGxHGkde7brfA%2BXRRUopxPSDGqLTfEcw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b154a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 best-online-dating-apps_orginal.jpg
www.howtoremoveit.info/images/PostImage/3406/ 53 KB
54 KB 70ms
62ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/PostImage/3406/best-online-dating-apps_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

0d5fcf4470214156877210c27c06b8c7b6f5dbc9115c3c18ae214a911889be2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/PostImage/3406/best-online-dating-apps_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 566132
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 54150
last-modified: Mon, 10 Jun 2019 12:23:39 GMT
server: cloudflare
etag: "38568c55871fd51:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=DK2aTssvP81g2gbJSSG%2FruvLD61RCoiK2gQi0pwf1cE6zIvsgkvIvI1zIMiw61ljp5dwj5%2B9KRZtJrhurEx88xshkdq9J0ZBpBKpp%2FI%2F%2FrCMEz3uLiTboaEoPO42mED3qft0n%2BI%2Bn26iBXho1nPjzA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b174a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 Managed%20IT%20Services_orginal.jpg
www.howtoremoveit.info/images/PostImage/3569/ 51 KB
52 KB 717ms
709ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/PostImage/3569/Managed%20IT%20Services_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

b9558f7016a4385a8b72db292eec2a6c2b0c259c713122b105202fe661e21fc3

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/PostImage/3569/Managed%20IT%20Services_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 52320
last-modified: Tue, 13 Jul 2021 09:52:53 GMT
server: cloudflare
etag: "1ab1a2d9cc77d71:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Abl88XkHrd6iyhfo1mZnSFjTwtSp0a7HIGrm4QnMNuC6Q9MgPj2day46bKNLXUz6P68e9wMRFavuSjqdLsqz5RXquUe0VcQBF%2FiT%2Bj6x7drLN20ayzKhyakrQxml8k30KYjF0KCYxm8qi9f93fH6DQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b1a4a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 Farmers%20Insurance%20company_orginal.jpg
www.howtoremoveit.info/images/PostImage/3567/ 47 KB
48 KB 70ms
62ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/PostImage/3567/Farmers%20Insurance%20company_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

eb70f6e954d178c4200bf8907568d7b86398b52c3a693fef5875a998a4ce7916

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/PostImage/3567/Farmers%20Insurance%20company_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 323889
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 48430
last-modified: Fri, 25 Jun 2021 09:48:15 GMT
server: cloudflare
etag: "e83c1938a769d71:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=lNRV6Qa6xbKoFxCZgbl7vtABF5zMBtJ36EGwI%2FNpTiWeYCAKVK1Pay3f4uHwvnxHl11Mf8QI%2F%2FnA0n8kae1SPBiJ4tGk2VR%2Bx%2FwGi9NTBBt13LsN90V4rwlcME30yAgK1RIcOxCL0fzWlZjPxLPqpA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b1c4a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 Internet%20Service%20Providers%20that%20Offer%2024x7%20Customer%20Support%20in%202021_orginal.jpg
www.howtoremoveit.info/images/PostImage/3566/ 54 KB
55 KB 841ms
833ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/PostImage/3566/Internet%20Service%20Providers%20that%20Offer%2024x7%20Customer%20Support%20in%202021_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

69e8c8b8b157abec05ceb0d8df7f59abc91d6d03f0a4fa8734fea1f628fee5c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/PostImage/3566/Internet%20Service%20Providers%20that%20Offer%2024x7%20Customer%20Support%20in%202021_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 55444
last-modified: Thu, 24 Jun 2021 06:25:58 GMT
server: cloudflare
etag: "52d0a1cbc168d71:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=MUZ7WXtRurSqgAKqQx29UceQAATIy5nPk6YVhT14UDeZzJCR9qi1YxSMR2cmNxtSaHzka%2FWW4mAi8z1y0ZwSVYBAKq7d%2B9CPYuu7I3OAEly4J48BshrmJYOcl2GkMLY7G8LM8rggstkVbMhprPF8Og%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b1e4a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 fix-err_spdy_protocol_error-on-google-chrome_orginal.png
www.howtoremoveit.info/images/PostImage/2222/ 49 KB
50 KB 709ms
701ms Image
image/png 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/PostImage/2222/fix-err_spdy_protocol_error-on-google-chrome_orginal.png

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

de816a8f60f41bc7c3a17f9bcec549beb46fdb9c086dc21c347de992d5fd5c82

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/PostImage/2222/fix-err_spdy_protocol_error-on-google-chrome_orginal.png
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 50472
last-modified: Fri, 25 Jun 2021 13:39:11 GMT
server: cloudflare
etag: "30a9347bc769d71:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=BsUB0egmf%2FDoXxCeqhJhwnoIQdwTHvBvKY8jbA8nwq3mj1c%2FB5zxQLOhyYs8s3d2PiYkQEWRhh2uRcaFLjKFtUJHc5wuX3kMnsjIlgUqnATvbisT6C7Bk2PvSThFummmYBsxm%2BBYiriO%2BcYfxJ3NaQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b1f4a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 Prevent%20Browser%20Hijacking_orginal.jpg
www.howtoremoveit.info/images/PostImage/3564/ 65 KB
66 KB 71ms
63ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/PostImage/3564/Prevent%20Browser%20Hijacking_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

0bfe7bb5f3f94d511b0a4c06af0bfdf8f3cbcb5bb7e26930ae6e3e38f71dc0c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/PostImage/3564/Prevent%20Browser%20Hijacking_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 143910
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 66719
last-modified: Fri, 11 Jun 2021 03:40:56 GMT
server: cloudflare
etag: "aa712696735ed71:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=zYosqgIDZb2PwVFgm9cX5EkhKrSc9FVtAM1vRZDvPNKvvZ4EyI1TPl8%2Fl4PBFdJVweowgc%2FmSdXecWwVOTYhcqRFQKCQTxth5d1w9L0YAD8Xqa%2BKjo6J3bghsN9W%2FkhTiEr4CmGOTMsgiwYapf0hTg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b204a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 clop-ransomware_orginal.jpg
www.howtoremoveit.info/images/PostImage/3232/ 102 KB
103 KB 850ms
843ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/PostImage/3232/clop-ransomware_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

8ad3573efbb722f24cebf078ef75b9de59a8ed463480cd3268fe38dc654db08f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/PostImage/3232/clop-ransomware_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 104610
last-modified: Fri, 15 Mar 2019 13:05:56 GMT
server: cloudflare
etag: "65b6c2d32fdbd41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=3xNgeDY7PoxV2eGA0FyJdjMj99Z%2Fq8rJNhAeh9XyxoUxTybWQ%2F%2BU2nBwA%2FAneCWJIsH3ZNPJUz%2B%2FHem85ZXQYGpo5GawDb8%2F5%2Bk0RyIm91qHiOSPRQADnmKIVZ8HW5jCAJgJ0hSfEXUWg%2FqC%2FKdnDA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b224a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 aye-ransomware_orginal.jpg
www.howtoremoveit.info/images/PostImage/3267/ 21 KB
22 KB 713ms
706ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/PostImage/3267/aye-ransomware_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

bc90e085ea5f538e02d672930d3bde710e982465d1978d5075cf9d7355c49970

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/PostImage/3267/aye-ransomware_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 21773
last-modified: Fri, 29 Mar 2019 12:30:42 GMT
server: cloudflare
etag: "dd3ae2392be6d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=yiPZuDey%2BpzmenGy4bHGV9tMMR8QMPccPU1zia0%2FPhXUlIsiSI4hThhgJe0axbu48JtgQc6CbP86vWPv%2BI%2Fh3kbsiWlJmgE0QZrz%2FywSXVAF5rP2iZ4Fy6yCHelF0oVfyVMTLpg7u5GUprzv3M8Dxg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b234a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 pewcrypt-ransomware_orginal.jpg
www.howtoremoveit.info/images/PostImage/3184/ 33 KB
33 KB 711ms
704ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/PostImage/3184/pewcrypt-ransomware_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

c7ba43f00109270a7653d06745a827eb57f5f0cb6c0264d9c762b4c51a35729a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/PostImage/3184/pewcrypt-ransomware_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 33494
last-modified: Mon, 04 Mar 2019 12:49:48 GMT
server: cloudflare
etag: "70295c088d2d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=y5S%2FTAoy3v08H7zxfm6lKmJkmYOtd6cFFrS6nDM1dyNDUKiCpU9VpCdBz7hOUTuI5wJbuqLiNMBrpd1bp73y7XwvDwRhqiafVJph3FBG2LTYYBp4IIjt6rcTbiojJL9rTXZj0JzsDLdiAJNOqKhjsw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b244a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 chromium%20image_orginal.png
www.howtoremoveit.info/images/PostImage/2319/ 32 KB
32 KB 74ms
66ms Image
image/png 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/PostImage/2319/chromium%20image_orginal.png

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

885dd3ba5ec2b5ff297ac0b4812cd6ea2cd57d4d221729b5518a0b814d4f89b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/PostImage/2319/chromium%20image_orginal.png
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 146484
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 32424
last-modified: Fri, 25 Jun 2021 10:17:41 GMT
server: cloudflare
etag: "6141e354ab69d71:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=7FiOCFNvcF99ewwjmsfzkNn7v0sDnmjggLHmrMIhEG4TXTUopqKIHWfhEyViHjbtlLxVdQUzz6BXaD6GiXwW6Aqv7EMvsAzDdvIITslLY6%2BAB3M0epQH%2FepCm8pEdwI1VRAn%2B8tWNa5RhfCPMJNBnw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b254a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 Rietspoof-Malware_orginal.jpg
www.howtoremoveit.info/images/PostImage/3107/ 45 KB
46 KB 733ms
725ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/PostImage/3107/Rietspoof-Malware_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

c56b74107d4b4dd635d525c968c3f48f44e6ecc2028ca32f413eccb0b3c2e30d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/PostImage/3107/Rietspoof-Malware_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 46516
last-modified: Wed, 20 Feb 2019 12:38:13 GMT
server: cloudflare
etag: "20b4242519c9d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=bkRheV26ZZK5CIMyDjGfIo43g5oFuricWCkBK1xb6qD4ww7Lk2qgIco5W3j1t1mfOwlj9AYYELfXxGcsOxRCS5NueGThVRBObGA%2FAYVeFAJLjdDxs6WVVjVgfHvIPXjt5r9RE7eYqDB4DekTbG5cSA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b264a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 eftpos-malware_orginal.jpg
www.howtoremoveit.info/images/PostImage/3146/ 72 KB
73 KB 853ms
846ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/PostImage/3146/eftpos-malware_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

5358815b4581d676a6727445317f28ad470121100384003dbf6d43f05ec46f2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/PostImage/3146/eftpos-malware_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 74135
last-modified: Tue, 26 Feb 2019 13:01:02 GMT
server: cloudflare
etag: "5e8a653d3cdd41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=gFoH060oXcBx2HcdQtONGvC7yy%2BOMffrBrkqHii%2FPXohBydvYdLe8LzGelFNdq04vfYWZ6E8wCk0pF1GJlOjm5zn5WaC2SkYhTV%2FifZ3Fi4%2FVy6t%2BigXVZIo9oQH3olKyzAUhIDcpb5LxQAE1coLrw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b284a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 eSpeedDownload-Search-hijacker_orginal.jpg
www.howtoremoveit.info/images/PostImage/3065/ 26 KB
27 KB 718ms
710ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/PostImage/3065/eSpeedDownload-Search-hijacker_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

8d60979751668c634c300bdff7af7565f67064815f9e200140c78fbf215ce0f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/PostImage/3065/eSpeedDownload-Search-hijacker_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 26696
last-modified: Wed, 13 Feb 2019 13:11:48 GMT
server: cloudflare
etag: "37171cad9dc3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=bTrTT8zLYDEyKSkxUOkV1YjJDbC0c%2BeBWo%2BWnD5D%2FqdogSj%2FUj4R0%2FNb2dDaDg6a2%2Fa%2Bz0f15hmHPGqSJGI5bpzCmkDTiWi3GmaEbxQQxabnSFDIlDt6PB0TxJv2H7UwGnc7ciwOIdNcfmmIz9lU%2FA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b294a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 search.pdftycoon.com_orginal.jpg
www.howtoremoveit.info/images/PostImage/3123/ 34 KB
35 KB 725ms
718ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/PostImage/3123/search.pdftycoon.com_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

5e8640bb201940a4d28fe9c4c02cb70957f302f53df2f69184d3ee5a4b4b470c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/PostImage/3123/search.pdftycoon.com_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 34958
last-modified: Fri, 22 Feb 2019 13:08:15 GMT
server: cloudflare
etag: "30ef22acafcad41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=bZFfufQmZjM%2BU01%2FQrAqOs7muuONQ0IPaNZLGQvwa2Pxsj35XwIFLITJ8bxz9qeNIaVcVDbg9SscVIMdt3525so%2FlqrNKfFa5VlLSNk1lOfNQZ8hEneXXQ%2BhfuUo3RzkjmmoKGfNgpvIQpuZ6RZ4%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b2a4a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 Eegookiz.com-Pop-Up-Ads_orginal.jpg
www.howtoremoveit.info/images/PostImage/3032/ 46 KB
47 KB 731ms
724ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/PostImage/3032/Eegookiz.com-Pop-Up-Ads_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

914c9b1cd12a30ef04543e0cdcc2e24514a38c5675f25f18cf9e946575315f42

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/PostImage/3032/Eegookiz.com-Pop-Up-Ads_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 47440
last-modified: Thu, 07 Feb 2019 12:38:19 GMT
server: cloudflare
etag: "421941e2bed41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=lpzGa2bodw%2FUdJ4IZkP4lFJWxobFo%2FmlPISZoaMwpZ%2BEeovtO3F5%2FZEhkrQtusWFfLhX9R6eJ1XXmwnLSWMAogZrSDULYX9gKj8pv4eB9HACsK60oJ8D%2FHaA8%2FKzTGuEqSSw1PSgQ9fH10gPHDtOWA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b2e4a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 remove-bing-redirect-virus_orginal.jpg
www.howtoremoveit.info/images/PostImage/3435/ 49 KB
50 KB 843ms
835ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/PostImage/3435/remove-bing-redirect-virus_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

93037a46b7069133315f774b6fdd329c54299c36d29c8d8233ee7704f28c5ad2

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/PostImage/3435/remove-bing-redirect-virus_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 50615
last-modified: Mon, 19 Aug 2019 07:46:23 GMT
server: cloudflare
etag: "2f9ac8326256d51:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=HL8gMeTyBTwvZibrlpM8MTgY2T1fkv2NHL64%2BhY7a%2Btq6GkxkgQIs70ZceDEJTP6EaDifQdpgl1gm3%2Bg4FeLlWm5o3L0Z6ioCvyWqllxYqV1odo0n%2BA8s5x3ssry8KkY4Z7NuAJvmLZlzb0JCbJHyA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b2f4a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 how-to-spot-%20the-most-subtle-malware_orginal.jpg
www.howtoremoveit.info/images/PostImage/3436/ 93 KB
94 KB 867ms
860ms Image
image/jpeg 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/PostImage/3436/how-to-spot-%20the-most-subtle-malware_orginal.jpg

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

0c31345c4bbe218e27851d6f702a1d242cde8aea49f977b5c4ffaac36ebfe102

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/PostImage/3436/how-to-spot-%20the-most-subtle-malware_orginal.jpg
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 95109
last-modified: Mon, 19 Aug 2019 10:21:09 GMT
server: cloudflare
etag: "ec1063d17756d51:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=M5TYOmPLXIZX034D3YluON06tgl%2FtFGVl6jtPg8ygRnnb3%2BWe%2BjPSpEm6Dm95Mw6S7Z3xqR0lnDnT8sXnH59FexCxk7HyJF6GZuzu44og8fmevYv3smdC4YAhqGXzPucjbFLbh9%2B3rDBB5GLmL8tFg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b304a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 bnr3.png
www.howtoremoveit.info/Images/ITL/SideBanner/ 26 KB
27 KB 726ms
719ms Image
image/png 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/Images/ITL/SideBanner/bnr3.png

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

5da979027e919fdc08bc56e72fe84540f9af47be519c869dbce5e0defa3404ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /Images/ITL/SideBanner/bnr3.png
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 26943
last-modified: Wed, 05 Dec 2018 09:37:57 GMT
server: cloudflare
etag: "9a5859347e8cd41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=9PFqwttr6lgstWuCzzOYXCbHwDTn7vvADT%2BXhY65aSPZJBzQ0sSjgHIz16kthmg7WHMkPwEV2CRVAzF68nlVPQySw%2BYGqCpqXRSMImkYD7eFEbbuDgoypMWEbEwztGl8YvutQrm%2FexukdFDFrRDtUg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b324a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 logo_footer.png
www.howtoremoveit.info/Images/ 2 KB
3 KB 74ms
67ms Image
image/png 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/Images/logo_footer.png

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

8554fcdb838bc7bb17830f1be629b21a517f965747a30eb85077e3e24e69e6d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /Images/logo_footer.png
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 252498
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 2055
last-modified: Tue, 17 Apr 2018 09:59:57 GMT
server: cloudflare
etag: "e1a53dd732d6d31:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=5%2FMueCXPRmEGFq%2BtnRgKa%2FipkLcz75dvk%2Ba1I3kyIY04HYURWDeg6OH7SEVbHbx1a3yFyPpv6Ghp1L7c7c9aGoym%2FHDdoNZKxS5GmwvF5oXSwEaobzWPVH8iuhxFHau6Yt0gFlz78%2BiaQ8H4xEehgg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b334a8c-FRA
access-control-allow-headers: Content-Type

GET
H2 200 onejs Show response
z-na.amazon-adsystem.com/widgets/ 22 KB
8 KB 422ms
389ms Script
application/javascript 13.224.101.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://z-na.amazon-adsystem.com/widgets/onejs?MarketPlace=US&adInstanceId=1d1f2920-341d-4966-b321-75b91af5085d
Requested by: Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.101.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-101-72.zrh50.r.cloudfront.net
Software: Server /
Resource Hash: 64d8001df3401f972aa146ac27f20fb0c3be8bc5fd4c072b372ea7ccd3b75313

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: Public
date: Thu, 15 Jul 2021 07:16:06 GMT
content-encoding: gzip
server: Server
x-amz-cf-pop: ZRH50-C1
x-cache: Miss from cloudfront
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
charset: UTF-8
cache-control: public,max-age=300,s-maxage=300,no-transform
content-length: 7343
via: 1.1 08c5e904e2f0226b2d9c1417f32b12f2.cloudfront.net (CloudFront)
x-amz-cf-id: lF5Iw6FY29iAuwEdYtl1YZ5ZpB6pM0oq47NqScO_EzTiERVqhc3mPw==
expires: Thu, 15 Jul 2021 07:21:06 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 13ms
5ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 17:36:57 GMT
server: Golfe2
age: 5120
date: Thu, 15 Jul 2021 05:50:46 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19661
expires: Thu, 15 Jul 2021 07:50:46 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 96 KB
37 KB 27ms
19ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TTLK3BC

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5950d97f521bf0718d31ba1bc5b48728cd3272787a563d8a2dfd844dc706995f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37998
x-xss-protection: 0
last-modified: Thu, 15 Jul 2021 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 15 Jul 2021 07:16:06 GMT

GET
H3-29 200 swiper.js Show response
www.howtoremoveit.info/Scripts/ 120 KB
30 KB 53ms
35ms Script
application/javascript 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.howtoremoveit.info/Scripts/swiper.js

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

3d52eb4784c784ef86bda77a144cfb18105d5cbd88a206611953bb7cbc49598d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /Scripts/swiper.js
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 252499
x-powered-by: ASP.NET
access-control-allow-methods: POST, GET, OPTIONS
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Fri, 15 Mar 2019 12:50:26 GMT
server: cloudflare
etag: W/"87f071a92ddbd41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ShavrSpDrMu67ggsSlFIqTwsODzdE3RPsyzARE4QVFh7fWhE9uZvDzorU2QXyzw%2BpPJil%2BlHeqOm8gTarNtpSeieNx1zSEadWyEkmJnLOGuyXTIKbYACRwIVt3DSP%2FDQ8BoZLgxgOsxRQqYj5gahnw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=691200
cf-polished: origSize=122746
cf-ray: 66f134156b004a8c-FRA
access-control-allow-headers: Content-Type
cf-bgj: minify

GET
H2 200 jquery-migrate-1.0.0.js Show response
code.jquery.com/ 15 KB
5 KB 27ms
8ms Script
application/javascript 2001:4de0:ac18::1:a:1a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-migrate-1.0.0.js
Requested by: Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: d9b635248efd4b596cad402579c29a619b4379cfb553a32589350b04c07f2bfa

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
content-encoding: gzip
last-modified: Fri, 24 Oct 2014 00:16:08 GMT
server: nginx
etag: W/"54499a48-3d75"
vary: Accept-Encoding
x-hw: 1626333366.dop108.fr8.t,1626333366.cds252.fr8.hn,1626333366.cds201.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 5347

GET
H3-29 200 mlcsetup.png
www.howtoremoveit.info/Images/indicatorImg/logo/ 1 KB
2 KB 75ms
69ms Image
image/png 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/Images/indicatorImg/logo/mlcsetup.png

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

7a89ed061d4f08b38f6fb2208eb01ef977d76506665ccacf6543b1452ae36eb8

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /Images/indicatorImg/logo/mlcsetup.png
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 252498
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1311
last-modified: Wed, 03 Oct 2018 12:51:37 GMT
server: cloudflare
etag: "70e66cd2175bd41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=JomNxlvnusmvY4EWpurRN7eOFDMKohuq58iV98n%2F8phGP0lmWjHZTwyEiV5KEdFXLAC1WIiVnlqzvtJnPofuNbKXahPOlAzi8Lsxsbh%2FErLgq6YY76pX9hZLFqjVINYqfrZG2jeh6WbLyEcPq7oE7A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b344a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 indicator.js Show response
www.howtoremoveit.info/Scripts/ 1 KB
1 KB 44ms
35ms Script
application/javascript 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.howtoremoveit.info/Scripts/indicator.js

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

bcfbdb36bd6283ffb2c4db85ecdba67421a292ed485334fe5e17561c33aa66a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /Scripts/indicator.js
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 252499
x-powered-by: ASP.NET
access-control-allow-methods: POST, GET, OPTIONS
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Thu, 07 Mar 2019 11:20:50 GMT
server: cloudflare
etag: W/"3362e2d1d7d4d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=fN2TeO%2FIl9oV0pA%2Fvr0WjWdXL4chPLFHG02FJX3wG9JVtlpCSdCKDd02TBpwoCnHUocyPDOZ5UkKGYv%2BXPX8SMbQngHSq4ZO1JkOPEufvWSiwYmGSuHEFMCPo%2BI0wV7TnqyRvbsSDHR7DITE25PVSg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=691200
cf-polished: origSize=2129
cf-ray: 66f134156afa4a8c-FRA
access-control-allow-headers: Content-Type
cf-bgj: minify

GET
H3-29 200 close.png
www.howtoremoveit.info/Images/ 410 B
1 KB 77ms
70ms Image
image/png 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/Images/close.png

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

9208a1abfe29525febf3ee4deb8c8dc73de02141a4e642975802a1d72d69cbf8

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /Images/close.png
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 252498
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 410
last-modified: Tue, 26 Dec 2017 05:00:32 GMT
server: cloudflare
etag: "c04b477567ed31:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=TbF385YkTLFORJaCys9SkSX%2FOjMyGqS2U933vmGagxfX5ocbZqE%2BZnOOFrvgJyV6qJkljq%2BaIlopwxN9BMUQ0dDONV9avLqI%2FDm7DOLsJ6W1Y8xbtF6ZHSw8Duf8m1MwkvHK%2FV1sw1p3vCT9oqk01A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b354a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 Exit_ng-5.png
www.howtoremoveit.info/Images/itl/exitnag/ 14 KB
15 KB 78ms
72ms Image
image/png 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/Images/itl/exitnag/Exit_ng-5.png

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

6de2dfcea74c621e3b6f86ed54ee53f7d79c5c1a8bbe94d0670950f39a67f3dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /Images/itl/exitnag/Exit_ng-5.png
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 252498
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 14822
last-modified: Thu, 04 Mar 2021 12:55:26 GMT
server: cloudflare
etag: "62a5d3a5f510d71:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=2gaF7s%2BDc8p4uO5iTE24hZGF9pbOy2YAZx38KRJw%2BIlqwd%2BsLisNBadGbdN3hN8z%2BwL8J7wQSLc1fRiYKisvu7gofAOeidvt7LHhzj0afz5ZkxiCDSNVAYvU1g8OPK7feHCu23xSpH4o2PiVdZPdQg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b394a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 mail_icn.png
www.howtoremoveit.info/Images/ 3 KB
4 KB 79ms
72ms Image
image/png 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/Images/mail_icn.png

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

532881c1a967ba388f7bb2f8c2a259e57694b6146f9a4167575b2808698265b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /Images/mail_icn.png
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 252498
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 3494
last-modified: Thu, 05 Jul 2018 13:12:01 GMT
server: cloudflare
etag: "3328c7c26114d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ILpVtiivV9A%2FetW7i0jT0dKNfZqf%2FSprbGcpMhO8nQnKaorMDrOJmr%2FS7%2BrXm4LV1H5ZplOT98hDtmbplVONPKna2sAMZmurcg7mdqZ7NpyUuLHzf3uzWcuPNlTKKGO5bVT%2BB%2FjClDZVx7gNlP9iVQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b3a4a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 arow_dwn.png
www.howtoremoveit.info/Images/ 1 KB
2 KB 79ms
73ms Image
image/png 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/Images/arow_dwn.png

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

15cd412ddcfb0dc3a38ee3a344c740ee3cc99612c5c3a345f7a5f7ac80f925cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /Images/arow_dwn.png
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 326088
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1244
last-modified: Thu, 05 Jul 2018 13:12:00 GMT
server: cloudflare
etag: "191876c26114d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=aWPTVKXAlOB5NJO%2Bv8JDAZXfprW08FxcDAVrxdyhje30Ql5jbRa1iINopF%2FIEtb1jBF86Cua5cY%2F94tRqQmyTmgXOa7WEhn%2FeKlyS0gTgkmXM28NQQV5OJaS0KRCNoZp0qesDvZpBg0XKUik07iORQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134156b3c4a8c-FRA
access-control-allow-headers: Content-Type

GET
H2 200 bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/3.4.1/js/ 39 KB
11 KB 80ms
28ms Script
application/javascript 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/3.4.1/js/bootstrap.min.js

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.howtoremoveit.info
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 601, 617, 617
age: 7172763
cdn-cachedat: 2021-04-23 06:11:59
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: d78433da04e787261ec31a20e889dfe8
cf-ray: 66f13415adca4a6e-FRA
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H2 200 jquery.marquee.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jQuery.Marquee/1.5.0/ 6 KB
2 KB 25ms
13ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jQuery.Marquee/1.5.0/jquery.marquee.min.js

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

23b9b39ea61308052256b9921bf1c0de6698bcf0c04e3e4f2978adc86168ff6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.howtoremoveit.info
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 8165958
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1756
cf-request-id: 0963e43ef4000018e568918000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:41 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ebd-1718"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=nPTkPtrRg8FMHULY5t04UoivP1SmU6%2BQoIC2DjAK54ah1FfSNLwA%2FqjpuqxcOod3XBVfUF%2B1G7NjJo6ukoXZJZrfELXSHH9yG0XSABLNKHlX1r6dfsj6ob%2FaSqMKk6zYkX5ly26BPLaQR9kiXQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 66f134156f832bc2-FRA
expires: Tue, 05 Jul 2022 07:16:06 GMT

GET
H3-29 200 LoadAllJS Show response
www.howtoremoveit.info/bundles/ 149 KB
16 KB 591ms
583ms Script
text/javascript 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.howtoremoveit.info/bundles/LoadAllJS?v=bVl02MWpqjNt5fEtSWFJnbUnda5lKV9hV0160UnSl0o1

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

1c2b28f45f088ec611ac864869ad9b9984ca74a49c238bafda418601afabcb94

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /bundles/LoadAllJS?v=bVl02MWpqjNt5fEtSWFJnbUnda5lKV9hV0160UnSl0o1
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
content-encoding: br
vary: User-Agent
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
access-control-allow-methods: POST, GET, OPTIONS
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Thu, 15 Jul 2021 07:16:07 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=haYTcw8ZgFWOYjhoixYZ3V59UT8WDBo3pRCRkpQmTVig6rnxITbm30O6ASXFLWfS%2Ful%2BHV2ll%2FE5%2B8%2Fumo5PAtB6rSM%2FPPsLhhkF%2Ftiawa5copX9QfUYb1JlBVv17oO6%2Br2IZBsUX1T67MicxW7YJg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public
cf-ray: 66f134156af04a8c-FRA
access-control-allow-headers: Content-Type
expires: Fri, 15 Jul 2022 07:16:07 GMT

GET
H3-29 200 fontawesome-webfont.woff
www.howtoremoveit.info/Content/fonts/ 96 KB
96 KB 76ms
70ms Font
font/x-woff 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.howtoremoveit.info/Content/fonts/fontawesome-webfont.woff?v=4.7.0

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

ba0c59deb5450f5cb41b3f93609ee2d0d995415877ddfa223e8a8a7533474f07

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

sec-fetch-mode: cors
origin: https://www.howtoremoveit.info
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired
:path: /Content/fonts/fontawesome-webfont.woff?v=4.7.0
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://www.howtoremoveit.info
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 252498
x-powered-by: ASP.NET
access-control-allow-methods: POST, GET, OPTIONS
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Mon, 31 Dec 2018 12:45:13 GMT
server: cloudflare
etag: W/"27df5bac6a1d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=S7CLQx9TkmTTNcxd8KIEwx8jkLvRRcR5GycvQwKLO14ePHCK%2Fi8L5JGxwPOEj%2Bm1H00onp%2FTBZJp9eAvcsHB%2BPLqd%2BM4mTzME9QBypqDGjra0UX93csvIQaugtiCjOPQWQlnIApWKrfgWEBecqKK8Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/x-woff
access-control-allow-origin: *
cache-control: max-age=691200
cf-ray: 66f134156b384a8c-FRA
access-control-allow-headers: Content-Type

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 16 KB
16 KB 12ms
6ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.howtoremoveit.info
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 13 Jul 2021 13:27:21 GMT
x-content-type-options: nosniff
age: 150525
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:09 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Jul 2022 13:27:21 GMT

GET
H3-29 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600,700

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

24f7e397faec79e62c37ff2f00b170f6dc1557fb46ac169f9f1897a9d641dd03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.howtoremoveit.info
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 13 Jul 2021 08:57:43 GMT
x-content-type-options: nosniff
age: 166703
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15764
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:17 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Jul 2022 08:57:43 GMT

GET
H3-29 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 16 KB
16 KB 8ms
6ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600,700

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

efb3cdc5e4582fd67dffab6fc6e5062074ce3f8c51747346af944e97749dc309

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.howtoremoveit.info
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Jul 2021 21:40:42 GMT
x-content-type-options: nosniff
age: 207324
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15948
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:32 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 12 Jul 2022 21:40:42 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 13ms
12ms XHR
text/plain 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j91&a=894546622&t=pageview&_s=1&dl=https%3A%2F%2Fwww.howtoremoveit.info%2F&ul=en-us&de=UTF-8&dt=Latest%20Technology%20News%20%7C%20Computer%20Security%20%7C%20Internet%20Technology&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1515957896&gjid=1446204018&cid=1100268901.1626333367&tid=UA-100349367-1&_gid=735940401.1626333367&_r=1&_slc=1&z=958784142

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 15 Jul 2021 07:16:06 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.howtoremoveit.info
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 cross-slider.png
www.howtoremoveit.info/images/ 253 B
900 B 17ms
17ms Image
image/png 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.howtoremoveit.info/images/cross-slider.png

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

369837cb4f3eda2b658d0eba141b05affe052314745da91ed8e50c00a71f60f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

:path: /images/cross-slider.png
pragma: no-cache
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired; _ga=GA1.2.1100268901.1626333367; _gid=GA1.2.735940401.1626333367; _gat=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
access-control-allow-methods: POST, GET, OPTIONS
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 252496
x-powered-by: ASP.NET
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 253
last-modified: Mon, 18 Mar 2019 10:38:59 GMT
server: cloudflare
etag: "b22b8cb76ddd41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=8Ubl%2Fd2GzAZTLq8vosGn4UTfWYbIM9RMQCziyU8r994q7nw%2FbnLWXy1GXNH6ITcVikAftai0uBaIRZO%2F7vOHiSaTXP9u6KwjuPSKQCDWAqErbEBNP1py8PnTF9iyT1rOmTUIGhblRi9MxaAShscltw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 66f134164d264a8c-FRA
access-control-allow-headers: Content-Type

GET
H3-29 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210708/r20190131/ 243 KB
90 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210708/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-5937574569441766&plah=www.howtoremoveit.info&amaexp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7d7731cd19278dd8d68435b1df5709fd2e12e8f13e43d86409ccc26f3354ea52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 92103
x-xss-protection: 0
server: cafe
etag: 18322328620552464558
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 15 Jul 2021 07:16:06 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210708/r20190131/ Frame 121B 10 KB
5 KB 6ms
5ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210708/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

20b3bad1427e2212dd847357841f993f025b5061c4af1d382dcc727e102cc1e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210708/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.howtoremoveit.info/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.howtoremoveit.info/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Thu, 15 Jul 2021 00:54:05 GMT
expires: Thu, 29 Jul 2021 00:54:05 GMT
content-type: text/html; charset=UTF-8
etag: 15579341980913220427
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4579
x-xss-protection: 0
age: 22921
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 en.json Show response
www.howtoremoveit.info/usercontrol/indicatorLang/ 2 KB
1 KB 587ms
586ms XHR
application/json 2606:4700:3035::6815:16d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.howtoremoveit.info/usercontrol/indicatorLang/en.json

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.4.0/jquery.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:16d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

b573339ddfd293b054d763091f0f2f9024de4c6eabafb4bc9961ef124365b47a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload

Request headers

sec-fetch-mode: cors
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: empty
x-requested-with: XMLHttpRequest
cookie: ASP.NET_SessionId=zfq34fqppsjlbyihnqupmpue; th=Fired; _ga=GA1.2.1100268901.1626333367; _gid=GA1.2.735940401.1626333367; _gat=1
:path: /usercontrol/indicatorLang/en.json
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type: application/json; charset=utf-8
accept: */*
cache-control: no-cache
:authority: www.howtoremoveit.info
referer: https://www.howtoremoveit.info/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept: */*
Referer: https://www.howtoremoveit.info/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json; charset=utf-8

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
access-control-allow-methods: POST, GET, OPTIONS
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Wed, 21 Nov 2018 10:28:04 GMT
server: cloudflare
etag: W/"c98f16e38481d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=aRfDgcx8K3wm7ysUl190B12IBpPc09L1A7IVt4Fw%2B1qsrb8lCjD5sT%2F7SNLCSMjME6NtXr31iwRTIumB5LrCpHJ45m%2BCTMlYiVeGkmTDpp9kVejbRyAeZUy1C5GGwV2GmeUq8pnH84StGf7tiMMeyw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=691200
cf-ray: 66f13416ce5d4a8c-FRA
access-control-allow-headers: Content-Type

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
93 B 21ms
21ms XHR
text/plain 2a00:1450:400c:c06::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j91&tid=UA-100349367-1&cid=1100268901.1626333367&jid=1515957896&gjid=1446204018&_gid=735940401.1626333367&_u=IEBAAEAAAAAAAC~&z=169441037

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c06::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 15 Jul 2021 07:16:06 GMT
content-type: text/plain
access-control-allow-origin: https://www.howtoremoveit.info
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 208 B
267 B 22ms
14ms Script
text/javascript 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.howtoremoveit.info&callback=_gfp_s_&client=ca-pub-5937574569441766

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210708/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-5937574569441766&plah=www.howtoremoveit.info&amaexp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

c1cb8cbacd74c74a4acf5aa0bef40b7d92b487046a8d6bf68dbe83df198d52bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 198
x-xss-protection: 0

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 38ms
38ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&tn=DIV&cls=BottomSliderSec&ign=false&pw=1600&ph=1200&x=0&y=1130.4

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jul 2021 07:16:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 14ms
14ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.howtoremoveit.info

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 15 Jul 2021 07:16:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 14ms
14ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.howtoremoveit.info

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 15 Jul 2021 07:16:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0C49 1 KB
411 B 83ms
83ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&adk=1314090037&adf=164220786&lmt=1626333366&plat=1%3A16809992%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366798&bpp=4&bdt=754&idt=94&shv=r20210708&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8167601955083&frm=20&pv=2&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=120

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6059f945bb0940302119ba1878cd7d1f0cbd2bf60cdf8ec10deabea2ecc9944e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5937574569441766&output=html&adk=1314090037&adf=164220786&lmt=1626333366&plat=1%3A16809992%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366798&bpp=4&bdt=754&idt=94&shv=r20210708&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8167601955083&frm=20&pv=2&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=120
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.howtoremoveit.info/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.howtoremoveit.info/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 15 Jul 2021 07:16:06 GMT
server: cafe
content-length: 388
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 15-Jul-2021 07:31:06 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 15 Jul 2021 07:16:06 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a5fe34971b4cbe72c700e5b903b7b4e93e36bbf951abb7cfc3a1bacd63ab255

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:06 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1626261977363740"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28063
x-xss-protection: 0
expires: Thu, 15 Jul 2021 07:16:06 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 16ms
16ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-100349367-1&cid=1100268901.1626333367&jid=1515957896&_u=IEBAAEAAAAAAAC~&z=981273548

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jul 2021 07:16:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 18ms
18ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-100349367-1&cid=1100268901.1626333367&jid=1515957896&_u=IEBAAEAAAAAAAC~&z=981273548

Requested by

Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jul 2021 07:16:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F24E 69 KB
23 KB 752ms
752ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=280&slotname=3096791380&adk=1331721975&adf=2381872099&pi=t.ma~as.3096791380&w=1200&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366802&bpp=5&bdt=757&idt=123&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=195&ady=669&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=T5ZGnmyvp2&p=https%3A//www.howtoremoveit.info&dtd=127

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fbce2676a40a9619bbcf6cfae9d5da8abb71320d4aa82f0c504d9de7e411f172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5937574569441766&output=html&h=280&slotname=3096791380&adk=1331721975&adf=2381872099&pi=t.ma~as.3096791380&w=1200&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366802&bpp=5&bdt=757&idt=123&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=195&ady=669&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=T5ZGnmyvp2&p=https%3A//www.howtoremoveit.info&dtd=127
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.howtoremoveit.info/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.howtoremoveit.info/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 15 Jul 2021 07:16:07 GMT
server: cafe
content-length: 23759
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 15-Jul-2021 07:31:06 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 15 Jul 2021 07:16:07 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame D599 67 KB
25 KB 444ms
444ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=600&slotname=4915375718&adk=3019375545&adf=167443777&pi=t.ma~as.4915375718&w=273&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=273x600&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366807&bpp=1&bdt=762&idt=126&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1148&ady=1806&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=svNWN9UtfU&p=https%3A//www.howtoremoveit.info&dtd=129

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9b2c84c8ffa6181855c6d4bb618df4710becc75f612913359b48e4cd3387682b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5937574569441766&output=html&h=600&slotname=4915375718&adk=3019375545&adf=167443777&pi=t.ma~as.4915375718&w=273&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=273x600&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366807&bpp=1&bdt=762&idt=126&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1148&ady=1806&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=svNWN9UtfU&p=https%3A//www.howtoremoveit.info&dtd=129
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.howtoremoveit.info/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.howtoremoveit.info/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 15 Jul 2021 07:16:07 GMT
server: cafe
content-length: 25337
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 15-Jul-2021 07:31:06 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 15 Jul 2021 07:16:07 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame D866 68 KB
25 KB 850ms
850ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=600&slotname=5120651931&adk=863691058&adf=1889130561&pi=t.ma~as.5120651931&w=273&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=273x600&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366808&bpp=1&bdt=763&idt=133&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C273x600&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1148&ady=2900&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=ZuEKV64edp&p=https%3A//www.howtoremoveit.info&dtd=135

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c98f05b88f26752a2570ceef44928e9e10efb94ed95a3cb5240593838852516b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5937574569441766&output=html&h=600&slotname=5120651931&adk=863691058&adf=1889130561&pi=t.ma~as.5120651931&w=273&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=273x600&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366808&bpp=1&bdt=763&idt=133&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C273x600&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1148&ady=2900&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=ZuEKV64edp&p=https%3A//www.howtoremoveit.info&dtd=135
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.howtoremoveit.info/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.howtoremoveit.info/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 15 Jul 2021 07:16:07 GMT
server: cafe
content-length: 25767
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 15-Jul-2021 07:31:06 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 15 Jul 2021 07:16:07 GMT
cache-control: private

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.howtoremoveit.info

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 15 Jul 2021 07:16:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
14ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.howtoremoveit.info

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 15 Jul 2021 07:16:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 19DD 77 KB
24 KB 782ms
782ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=90&slotname=4667386051&adk=692682234&adf=4050520369&pi=t.ma~as.4667386051&w=728&lmt=1626333366&psa=0&format=728x90&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366809&bpp=2&bdt=764&idt=139&shv=r20210708&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc51d1e5889e5c76c-227c86ff6bc900dc%3AT%3D1626333366%3ART%3D1626333366%3AS%3DALNI_MakYRNpXy-O423JeNXGJLOPItKFrQ&prev_fmts=0x0%2C1200x280%2C273x600%2C273x600&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=1123&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfoeE%7C&abl=CF&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&fsb=1&xpc=ZUN6gri07v&p=https%3A//www.howtoremoveit.info&dtd=142

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9639cbd6bd254bbfd7b931bb0008fb542393652b3372d1b4864f70e727c5fb7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5937574569441766&output=html&h=90&slotname=4667386051&adk=692682234&adf=4050520369&pi=t.ma~as.4667386051&w=728&lmt=1626333366&psa=0&format=728x90&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366809&bpp=2&bdt=764&idt=139&shv=r20210708&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc51d1e5889e5c76c-227c86ff6bc900dc%3AT%3D1626333366%3ART%3D1626333366%3AS%3DALNI_MakYRNpXy-O423JeNXGJLOPItKFrQ&prev_fmts=0x0%2C1200x280%2C273x600%2C273x600&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=1123&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfoeE%7C&abl=CF&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&fsb=1&xpc=ZUN6gri07v&p=https%3A//www.howtoremoveit.info&dtd=142
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.howtoremoveit.info/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.howtoremoveit.info/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 15 Jul 2021 07:16:07 GMT
server: cafe
content-length: 24582
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 15-Jul-2021 07:31:06 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 15 Jul 2021 07:16:07 GMT
cache-control: private

GET
H2 200 12187778933508226408
tpc.googlesyndication.com/daca_images/simgad/ Frame D599 87 KB
87 KB 8ms
7ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/12187778933508226408

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=600&slotname=4915375718&adk=3019375545&adf=167443777&pi=t.ma~as.4915375718&w=273&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=273x600&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366807&bpp=1&bdt=762&idt=126&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1148&ady=1806&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=svNWN9UtfU&p=https%3A//www.howtoremoveit.info&dtd=129

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2302a23b054223a6273bb81e895eb9849a6c34c74cff1c519c63544dcd7d8b48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 13 Jul 2021 07:30:56 GMT
x-content-type-options: nosniff
age: 171911
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 88635
x-xss-protection: 0
last-modified: Tue, 28 Jul 2020 09:27:52 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Jul 2022 07:30:56 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210708/r20110914/ Frame D599 17 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210708/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed045b94f4874ac13890f9c4370e2b14b30c2a12a79d22e52d20872440b60ede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:11:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 278
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7114
x-xss-protection: 0
server: cafe
etag: 15784850791818150134
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Jul 2021 07:11:29 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/ Frame D599 3 KB
1 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:15:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Jul 2021 07:15:55 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D599 124 KB
37 KB 29ms
14ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

67eba3529a67e088bd83ae179b0fcab337a0e5804ca07132d47a5013dff6e43d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1626261971611604"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38113
x-xss-protection: 0
expires: Thu, 15 Jul 2021 07:16:07 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/ Frame D599 14 KB
6 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7e5e8d7a52cffab98c6c3957e1c30af475c697d4d50ba91aeab0b11eea32a166

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:11:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 259
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6198
x-xss-protection: 0
server: cafe
etag: 11976405653130873325
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Jul 2021 07:11:48 GMT

GET
H2 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/ Frame D599 26 KB
11 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

33810f0c864e6976ea984d30e291cec728715733ef03501e9df966502fc5d9db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 18:56:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 44374
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10735
x-xss-protection: 0
server: cafe
etag: 17247008803534814624
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Jul 2021 18:56:33 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame D599 0
0 42ms
42ms Fetch
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CRIfgtuDvYK-EOoiMbNzBsMAK6-6f02HL9YHL9Au_4R4QASCM45pOYJUCoAGE6_3-AsgBAqkCgX3U6zHXsz6oAwHIA8kEqgTeAU_QfkAKDY7nIyYNlXjL5eoo7_ZNQa_Cwbp78RH-rtIRrm2Ega0LnCgX8nctnkKp2snOVZI6MFAztsKbOdirb0YbDPZZfwPPXfuc919-v8Dp3RV2DTxiN3WsBcZOeov5vvOJX3akyXVQ9ZJcPHdn9t1AB36rNmirskkhP9df-5A7o4BeUuyRx_3jG5CCuMOmUE6Vu3dy998quMKCo2QqzCwBHiARNN2T4FJFzttRRjXERfLhTldBCM_ESPmdMkzw4TW5vBtNjt5uZlkurrlzQXLFZ1H1DI3EzlxZGhsccMAEj6D60f4CkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBgKAB-SUgoEBqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcEEKLcMdIICQiA4YAQEAEYH4AKAcgLAdgTDdAVAZgWAYAXAbIXGgoYCAASFHB1Yi01OTM3NTc0NTY5NDQxNzY2&sigh=i7fBxfHoztI

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=600&slotname=4915375718&adk=3019375545&adf=167443777&pi=t.ma~as.4915375718&w=273&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=273x600&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366807&bpp=1&bdt=762&idt=126&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1148&ady=1806&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=svNWN9UtfU&p=https%3A//www.howtoremoveit.info&dtd=129
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 15 Jul 2021 07:16:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 15 Jul 2021 07:16:07 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame D3D6 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=600&slotname=4915375718&adk=3019375545&adf=167443777&pi=t.ma~as.4915375718&w=273&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=273x600&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366807&bpp=1&bdt=762&idt=126&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1148&ady=1806&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=svNWN9UtfU&p=https%3A//www.howtoremoveit.info&dtd=129
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=600&slotname=4915375718&adk=3019375545&adf=167443777&pi=t.ma~as.4915375718&w=273&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=273x600&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366807&bpp=1&bdt=762&idt=126&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1148&ady=1806&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=svNWN9UtfU&p=https%3A//www.howtoremoveit.info&dtd=129

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 15 Jul 2021 06:42:56 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1991
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame D3D6
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

39ms
39ms

Document
text/html

2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmI4JLlxmcYKFnnGPdPtElLVeOF4NqZ_zBdoEkIKi15TwYkOHt9gBGnu0XtNs0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 15 Jul 2021 07:16:07 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Thu, 15-Jul-2021 08:16:07 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 15 Jul 2021 07:16:07 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 15 Jul 2021 07:16:07 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame D599 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b1e63e30afdec4dad3ad5f14dde873c582b5fb4259b1a7c10f4fd955779257c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 _htgYqD-D_hqupanZs0dgoAXJAmF8Earzw--3TVapKE.js Show response
pagead2.googlesyndication.com/bg/ Frame B5DA 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/_htgYqD-D_hqupanZs0dgoAXJAmF8Earzw--3TVapKE.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fe1b6062a0fe0ff86aba96a766cd1d828017240985f046abcf0fbedd355aa4a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 05:29:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6421
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13252
x-xss-protection: 0
last-modified: Tue, 06 Jul 2021 09:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 15 Jul 2022 05:29:06 GMT

GET
H2 404 d5715631-e42f-48d1-8c34-568dcf95a92d.js
cdn.mouseflow.com/projects/ 0
0 121ms
105ms Script
text/html 23.111.9.38
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mouseflow.com/projects/d5715631-e42f-48d1-8c34-568dcf95a92d.js
Requested by: Host: www.howtoremoveit.info
URL: https://www.howtoremoveit.info/bundles/LoadAllJS?v=bVl02MWpqjNt5fEtSWFJnbUnda5lKV9hV0160UnSl0o1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.38 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 css
fonts.googleapis.com/ Frame F24E 3 KB
578 B 24ms
22ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=280&slotname=3096791380&adk=1331721975&adf=2381872099&pi=t.ma~as.3096791380&w=1200&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366802&bpp=5&bdt=757&idt=123&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=195&ady=669&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=T5ZGnmyvp2&p=https%3A//www.howtoremoveit.info&dtd=127

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 15 Jul 2021 07:12:15 GMT
server: ESF
date: Thu, 15 Jul 2021 07:16:07 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 15 Jul 2021 07:16:07 GMT

GET
H3-29 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/ Frame F24E 1 KB
909 B 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:09:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 407
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 882
x-xss-protection: 0
server: cafe
etag: 11243716317595354070
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Jul 2021 07:09:20 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210708/r20110914/ Frame F24E 17 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210708/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed045b94f4874ac13890f9c4370e2b14b30c2a12a79d22e52d20872440b60ede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:11:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 278
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7114
x-xss-protection: 0
server: cafe
etag: 15784850791818150134
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Jul 2021 07:11:29 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/ Frame F24E 3 KB
1 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:15:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Jul 2021 07:15:21 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F24E 124 KB
37 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

67eba3529a67e088bd83ae179b0fcab337a0e5804ca07132d47a5013dff6e43d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1626261971611604"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38113
x-xss-protection: 0
expires: Thu, 15 Jul 2021 07:16:07 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/ Frame F24E 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7e5e8d7a52cffab98c6c3957e1c30af475c697d4d50ba91aeab0b11eea32a166

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:11:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 259
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6198
x-xss-protection: 0
server: cafe
etag: 11976405653130873325
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Jul 2021 07:11:48 GMT

GET
H2 200 ef3ed83fa5244dfc7f7ca8c70cdace65.js Show response
www.gstatic.com/mysidia/ Frame F24E 26 KB
11 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ef3ed83fa5244dfc7f7ca8c70cdace65.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea13739a6ab669cc2f16a95685c1ed8c0fa771606e3a217cc2093b91103012df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 13 Jul 2021 12:36:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 153566
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10755
x-xss-protection: 0
last-modified: Wed, 07 Jul 2021 17:11:01 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 11 Oct 2021 12:36:41 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame F24E 0
0 44ms
43ms Fetch
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CJCiNtuDvYPjROYqxbO3mg4gI4IPYmmPPn9uQvg6nzYyWjw4QASCM45pOYJUCoAGFpuq0AsgBAakCgX3U6zHXsz6oAwHIA8MEqgTmAU_QaSmQaoBsMYVa7A15hDCPLZtdE4JDl-sGCWmw56I4ff0jMgBV72kDwvtSQmZKyNRk05mXHUCQO94WAeHaSpWb4b32cBbgJMG4WFseuYmdOuSaD2y1gnzSN9rFcuxzW2_nD8jFshlO6VDrO7ycGYrkScDXHr1p29LGioNYvmoHdThXruGEFQr6XpqEVICTovW_Y_CXxCnnejZmwr4OtbL88uTtR7PiJAO6n8T3tAzBxk2imQAJnja6Q_oOn8h8wXQNnxuNoUZankC2Yqj0zzh3uSxsAwPQFE-UXjZFcFQBoIGsUSkgwASxrKvCzwOSBQQIBBgBkgUECAUYBKAGUYAH49mVywGoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwQQw4Va0ggJCIDhgBAQARgfgAoByAsB2BMMiBQB0BUBmBYBgBcBshcaChgIABIUcHViLTU5Mzc1NzQ1Njk0NDE3NjY&sigh=V_I4GvFaK_A

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=280&slotname=3096791380&adk=1331721975&adf=2381872099&pi=t.ma~as.3096791380&w=1200&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366802&bpp=5&bdt=757&idt=123&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=195&ady=669&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=T5ZGnmyvp2&p=https%3A//www.howtoremoveit.info&dtd=127
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 15 Jul 2021 07:16:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 8CFE 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=280&slotname=3096791380&adk=1331721975&adf=2381872099&pi=t.ma~as.3096791380&w=1200&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366802&bpp=5&bdt=757&idt=123&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=195&ady=669&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=T5ZGnmyvp2&p=https%3A//www.howtoremoveit.info&dtd=127
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmI4JLlxmcYKFnnGPdPtElLVeOF4NqZ_zBdoEkIKi15TwYkOHt9gBGnu0XtNs0; DSID=NO_DATA; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=280&slotname=3096791380&adk=1331721975&adf=2381872099&pi=t.ma~as.3096791380&w=1200&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366802&bpp=5&bdt=757&idt=123&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=195&ady=669&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=T5ZGnmyvp2&p=https%3A//www.howtoremoveit.info&dtd=127

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 15 Jul 2021 06:42:56 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1991
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame F24E 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7d4aa663b9db452336ce2c8fd517ceeb9897db094e5f57d223995ddd6abcfa4c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame F24E 21 KB
21 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 13 Jul 2021 03:22:28 GMT
x-content-type-options: nosniff
age: 186819
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21716
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:21 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Jul 2022 03:22:28 GMT

GET
H3-29 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame F24E 21 KB
21 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 13 Jul 2021 07:00:41 GMT
x-content-type-options: nosniff
age: 173726
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21552
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:16 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Jul 2022 07:00:41 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 19DD 3 KB
578 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=90&slotname=4667386051&adk=692682234&adf=4050520369&pi=t.ma~as.4667386051&w=728&lmt=1626333366&psa=0&format=728x90&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366809&bpp=2&bdt=764&idt=139&shv=r20210708&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc51d1e5889e5c76c-227c86ff6bc900dc%3AT%3D1626333366%3ART%3D1626333366%3AS%3DALNI_MakYRNpXy-O423JeNXGJLOPItKFrQ&prev_fmts=0x0%2C1200x280%2C273x600%2C273x600&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=1123&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfoeE%7C&abl=CF&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&fsb=1&xpc=ZUN6gri07v&p=https%3A//www.howtoremoveit.info&dtd=142

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 15 Jul 2021 05:23:26 GMT
server: ESF
date: Thu, 15 Jul 2021 07:16:07 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 15 Jul 2021 07:16:07 GMT

GET
H3-29 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/ Frame 19DD 1 KB
909 B 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:09:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 407
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 882
x-xss-protection: 0
server: cafe
etag: 11243716317595354070
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Jul 2021 07:09:20 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210708/r20110914/ Frame 19DD 17 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210708/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed045b94f4874ac13890f9c4370e2b14b30c2a12a79d22e52d20872440b60ede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:11:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 278
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7114
x-xss-protection: 0
server: cafe
etag: 15784850791818150134
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Jul 2021 07:11:29 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/ Frame 19DD 3 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:15:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Jul 2021 07:15:21 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 19DD 124 KB
37 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

67eba3529a67e088bd83ae179b0fcab337a0e5804ca07132d47a5013dff6e43d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1626261971611604"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38113
x-xss-protection: 0
expires: Thu, 15 Jul 2021 07:16:07 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/ Frame 19DD 14 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7e5e8d7a52cffab98c6c3957e1c30af475c697d4d50ba91aeab0b11eea32a166

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:11:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 259
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6198
x-xss-protection: 0
server: cafe
etag: 11976405653130873325
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Jul 2021 07:11:48 GMT

GET
H3-29 200 ef3ed83fa5244dfc7f7ca8c70cdace65.js Show response
www.gstatic.com/mysidia/ Frame 19DD 26 KB
11 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ef3ed83fa5244dfc7f7ca8c70cdace65.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea13739a6ab669cc2f16a95685c1ed8c0fa771606e3a217cc2093b91103012df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 06:50:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1525
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10755
x-xss-protection: 0
last-modified: Tue, 13 Jul 2021 05:41:01 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 13 Oct 2021 06:50:42 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 19DD 0
0 42ms
42ms Fetch
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CQl49tuDvYKqHO5OdlgSl4KfIBuCD2Jpjz6TbkL4Op82Mlo8OEAEgjOOaTmCVAqABhabqtALIAQGpAoF91Osx17M-qAMByAPDBKoE4wFP0KRKbjundAD1o-PA_zv5Di8h6Mjhzn2gwHyev81nFjxnmjSbej3OZysBGMYmbqqjdBputACgYvzdRr3Y1K3pAABwTo2P0uvq1sHbSLNATz6JUxz2BymgznAGGFFTVHLeoNxuTjSFVAAAzo1q5Dt5eqpJEu8L6VkEzSFH73MdCpuapRgkxPqwq2XajhjGvDDvTYwJl9PYo2hslGimALtJCX1d6qk-VaZ8Nn7ZtzoByXLiFu657TAlTNVK3YHom_wVHTC9woGtRQZZKD0N7FYE9xyS_jJU4Niv8tLzcyvyWmrawMAEsayrws8DkgUECAQYAZIFBAgFGASgBmaAB-PZlcsBqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcFEN-esAPSCAkIiOGAEBABGB-ACgHICwHYEwyIFAPQFQGYFgGAFwGyFxoKGAgAEhRwdWItNTkzNzU3NDU2OTQ0MTc2Ng&sigh=zbMZoC0Ux40

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=90&slotname=4667386051&adk=692682234&adf=4050520369&pi=t.ma~as.4667386051&w=728&lmt=1626333366&psa=0&format=728x90&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366809&bpp=2&bdt=764&idt=139&shv=r20210708&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc51d1e5889e5c76c-227c86ff6bc900dc%3AT%3D1626333366%3ART%3D1626333366%3AS%3DALNI_MakYRNpXy-O423JeNXGJLOPItKFrQ&prev_fmts=0x0%2C1200x280%2C273x600%2C273x600&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=1123&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfoeE%7C&abl=CF&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&fsb=1&xpc=ZUN6gri07v&p=https%3A//www.howtoremoveit.info&dtd=142
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 15 Jul 2021 07:16:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 088E 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=90&slotname=4667386051&adk=692682234&adf=4050520369&pi=t.ma~as.4667386051&w=728&lmt=1626333366&psa=0&format=728x90&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366809&bpp=2&bdt=764&idt=139&shv=r20210708&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc51d1e5889e5c76c-227c86ff6bc900dc%3AT%3D1626333366%3ART%3D1626333366%3AS%3DALNI_MakYRNpXy-O423JeNXGJLOPItKFrQ&prev_fmts=0x0%2C1200x280%2C273x600%2C273x600&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=1123&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfoeE%7C&abl=CF&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&fsb=1&xpc=ZUN6gri07v&p=https%3A//www.howtoremoveit.info&dtd=142
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmI4JLlxmcYKFnnGPdPtElLVeOF4NqZ_zBdoEkIKi15TwYkOHt9gBGnu0XtNs0; DSID=NO_DATA; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=90&slotname=4667386051&adk=692682234&adf=4050520369&pi=t.ma~as.4667386051&w=728&lmt=1626333366&psa=0&format=728x90&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366809&bpp=2&bdt=764&idt=139&shv=r20210708&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc51d1e5889e5c76c-227c86ff6bc900dc%3AT%3D1626333366%3ART%3D1626333366%3AS%3DALNI_MakYRNpXy-O423JeNXGJLOPItKFrQ&prev_fmts=0x0%2C1200x280%2C273x600%2C273x600&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=1123&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfoeE%7C&abl=CF&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&fsb=1&xpc=ZUN6gri07v&p=https%3A//www.howtoremoveit.info&dtd=142

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 15 Jul 2021 06:42:56 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1991
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 2457598221282159932
tpc.googlesyndication.com/simgad/ Frame D866 99 KB
99 KB 8ms
7ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/2457598221282159932?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qlVPfFAdfZGdsDFOIhXLUC4g5lGYQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=600&slotname=5120651931&adk=863691058&adf=1889130561&pi=t.ma~as.5120651931&w=273&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=273x600&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366808&bpp=1&bdt=763&idt=133&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C273x600&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1148&ady=2900&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=ZuEKV64edp&p=https%3A//www.howtoremoveit.info&dtd=135

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

495ae1f3daf7dd8dcb503fe170f14666117adb468a8ab8de88d8a38244714d7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 13 Jul 2021 00:00:51 GMT
x-content-type-options: nosniff
last-modified: Fri, 15 Jan 2021 17:03:23 GMT
server: sffe
age: 198916
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 101740
x-xss-protection: 0
expires: Wed, 13 Jul 2022 00:00:51 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210708/r20110914/ Frame D866 17 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210708/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed045b94f4874ac13890f9c4370e2b14b30c2a12a79d22e52d20872440b60ede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:11:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 278
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7114
x-xss-protection: 0
server: cafe
etag: 15784850791818150134
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Jul 2021 07:11:29 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/ Frame D866 3 KB
1 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:15:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Jul 2021 07:15:21 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D866 124 KB
37 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

67eba3529a67e088bd83ae179b0fcab337a0e5804ca07132d47a5013dff6e43d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:07 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1626261971611604"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38113
x-xss-protection: 0
expires: Thu, 15 Jul 2021 07:16:07 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/ Frame D866 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7e5e8d7a52cffab98c6c3957e1c30af475c697d4d50ba91aeab0b11eea32a166

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:11:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 259
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6198
x-xss-protection: 0
server: cafe
etag: 11976405653130873325
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Jul 2021 07:11:48 GMT

GET
H3-29 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/ Frame D866 26 KB
11 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210708/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

33810f0c864e6976ea984d30e291cec728715733ef03501e9df966502fc5d9db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 18:56:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 44374
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10735
x-xss-protection: 0
server: cafe
etag: 17247008803534814624
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Jul 2021 18:56:33 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame D866 0
0 42ms
42ms Fetch
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CVEp8tuDvYMHEOs-ybOWxgJgGqtTx42LOn42PpQ3I8M3uqwkQASCM45pOYJUCoAGcr_uoAsgBAqgDAcgDyQSqBNsBT9AzaY6JdIYRFotYlKJISiloHfaJsskkwTydEuc6CyOjIjGi5ugAQaDt09WLkFTuZ6pXrI_TSo0TNe7HP43OkbF5Ynpkjhq_NGyf9eHHryOXp5qBy1Lfcrm9QYjkYYZzoe4aMbBFGsK9nB1mqGtg08fBXUrPUz0kPCoClCx1emjkuNK9paASMJMgpXtaaOpw0zR6s67nwnKFB_ZjNyi7viwRj39Qc2XmIUOwSJdk5tlJooRU_fm0IK5UUL_iOAAmnM2DrE9amurQv4UqKvv7dL-Zc0F-WvcBGz1SwASR-ZPlugOSBQQIBBgBkgUECAUYBKAGAoAHzNCE1wGoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwQQzLA70ggJCIDhgBAQARgfgAoByAsB2BMN0BUBmBYBgBcBshcaChgIABIUcHViLTU5Mzc1NzQ1Njk0NDE3NjY&sigh=OlRrVr05ONw

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=600&slotname=5120651931&adk=863691058&adf=1889130561&pi=t.ma~as.5120651931&w=273&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=273x600&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366808&bpp=1&bdt=763&idt=133&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C273x600&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1148&ady=2900&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=ZuEKV64edp&p=https%3A//www.howtoremoveit.info&dtd=135
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 15 Jul 2021 07:16:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 19DD 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bbd41610f23dac8f183bc8af83d2b6348e5bc13d43d80b973697b3029e52a599

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 19DD 21 KB
21 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 13 Jul 2021 03:22:28 GMT
x-content-type-options: nosniff
age: 186819
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21716
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:21 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Jul 2022 03:22:28 GMT

GET
H3-29 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 19DD 21 KB
21 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 13 Jul 2021 07:00:41 GMT
x-content-type-options: nosniff
age: 173726
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21552
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:16 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Jul 2022 07:00:41 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 8CFE
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

39ms
39ms

Document
text/html

2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmI4JLlxmcYKFnnGPdPtElLVeOF4NqZ_zBdoEkIKi15TwYkOHt9gBGnu0XtNs0; DSID=NO_DATA; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 15 Jul 2021 07:16:07 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Thu, 15-Jul-2021 08:16:07 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 15 Jul 2021 07:16:07 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 15 Jul 2021 07:16:07 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 _htgYqD-D_hqupanZs0dgoAXJAmF8Earzw--3TVapKE.js Show response
pagead2.googlesyndication.com/bg/ Frame E509 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/_htgYqD-D_hqupanZs0dgoAXJAmF8Earzw--3TVapKE.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fe1b6062a0fe0ff86aba96a766cd1d828017240985f046abcf0fbedd355aa4a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 05:29:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6421
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13252
x-xss-protection: 0
last-modified: Tue, 06 Jul 2021 09:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 15 Jul 2022 05:29:06 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 9597 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=600&slotname=5120651931&adk=863691058&adf=1889130561&pi=t.ma~as.5120651931&w=273&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=273x600&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366808&bpp=1&bdt=763&idt=133&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C273x600&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1148&ady=2900&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=ZuEKV64edp&p=https%3A//www.howtoremoveit.info&dtd=135
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmI4JLlxmcYKFnnGPdPtElLVeOF4NqZ_zBdoEkIKi15TwYkOHt9gBGnu0XtNs0; DSID=NO_DATA; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5937574569441766&output=html&h=600&slotname=5120651931&adk=863691058&adf=1889130561&pi=t.ma~as.5120651931&w=273&fwrn=4&fwrnh=100&lmt=1626333366&rafmt=1&psa=0&format=273x600&url=https%3A%2F%2Fwww.howtoremoveit.info%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626333366808&bpp=1&bdt=763&idt=133&shv=r20210708&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C273x600&nras=1&correlator=8167601955083&frm=20&pv=1&ga_vid=1100268901.1626333367&ga_sid=1626333367&ga_hid=894546622&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1148&ady=2900&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44745300%2C182982000%2C31060972&oid=2&pvsid=3560261753872132&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=ZuEKV64edp&p=https%3A//www.howtoremoveit.info&dtd=135

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 15 Jul 2021 06:42:56 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1991
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame D866 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1d5eef4fb1cc85ad55f657aced9c1f1ad2789079abdae417e02d83f067ea8b86

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 088E
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

39ms
39ms

Document
text/html

2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmI4JLlxmcYKFnnGPdPtElLVeOF4NqZ_zBdoEkIKi15TwYkOHt9gBGnu0XtNs0; DSID=NO_DATA; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 15 Jul 2021 07:16:08 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Thu, 15-Jul-2021 08:16:08 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 15 Jul 2021 07:16:08 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 15 Jul 2021 07:16:08 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 _htgYqD-D_hqupanZs0dgoAXJAmF8Earzw--3TVapKE.js Show response
pagead2.googlesyndication.com/bg/ Frame F4A7 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/_htgYqD-D_hqupanZs0dgoAXJAmF8Earzw--3TVapKE.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fe1b6062a0fe0ff86aba96a766cd1d828017240985f046abcf0fbedd355aa4a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 05:29:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6422
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13252
x-xss-protection: 0
last-modified: Tue, 06 Jul 2021 09:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 15 Jul 2022 05:29:06 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 9597
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

39ms
38ms

Document
text/html

2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmI4JLlxmcYKFnnGPdPtElLVeOF4NqZ_zBdoEkIKi15TwYkOHt9gBGnu0XtNs0; DSID=NO_DATA; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 15 Jul 2021 07:16:08 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Thu, 15-Jul-2021 08:16:08 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 15 Jul 2021 07:16:08 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 15 Jul 2021 07:16:08 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 _htgYqD-D_hqupanZs0dgoAXJAmF8Earzw--3TVapKE.js Show response
pagead2.googlesyndication.com/bg/ Frame DAC7 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/_htgYqD-D_hqupanZs0dgoAXJAmF8Earzw--3TVapKE.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fe1b6062a0fe0ff86aba96a766cd1d828017240985f046abcf0fbedd355aa4a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 05:29:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6422
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13252
x-xss-protection: 0
last-modified: Tue, 06 Jul 2021 09:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 15 Jul 2022 05:29:06 GMT

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 19ms
19ms XHR
application/json 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210708&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47cc308077d1f9ad5e5f6336770c635f3879c420eb3b27d708520c35d17b89ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 15 Jul 2021 07:16:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8410
x-xss-protection: 0

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 07:16:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Thu, 15 Jul 2021 07:16:08 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 66AC 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.howtoremoveit.info/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.howtoremoveit.info/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Thu, 15 Jul 2021 07:13:50 GMT
expires: Fri, 15 Jul 2022 07:13:50 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 138
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame C6ED 783 B
532 B 18ms
18ms Document
text/html 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

ef3fc1c8d0c9f30a0b87b7a394f76e85815f802cb3cc550cbbd63d5e69c43914

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-wM/oPQSZbqVaMz5gqDP/+g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.howtoremoveit.info/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.howtoremoveit.info/

Response headers

expires: Thu, 15 Jul 2021 07:16:08 GMT
date: Thu, 15 Jul 2021 07:16:08 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-wM/oPQSZbqVaMz5gqDP/+g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 _htgYqD-D_hqupanZs0dgoAXJAmF8Earzw--3TVapKE.js Show response
pagead2.googlesyndication.com/bg/ Frame 66AC 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/_htgYqD-D_hqupanZs0dgoAXJAmF8Earzw--3TVapKE.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fe1b6062a0fe0ff86aba96a766cd1d828017240985f046abcf0fbedd355aa4a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 05:29:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6422
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13252
x-xss-protection: 0
last-modified: Tue, 06 Jul 2021 09:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 15 Jul 2022 05:29:06 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 40ms
40ms Image
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20210708&jk=3560261753872132&bg=!BgWlBUHNAAZjFomlYxY7ACkAdvg8Wpjpjx5MttWf_69-6Kai7gOfYrcM9MisZFzcEt24zBlOvJjK-AIAAABmUgAAAAxoAQeZAnoDfFWrvD7GkWXfxVUqu8qEipbNOqXDtvKkw9H9qYwoXzKkpcwQPcZt85wLLB9weqR3iHVr-eC61oJ0-F6rgW9FMKPwJuZoU_lXTWZgg29VRLPqQPCgYnxhLuNTeElbgmzjEPycg_Vuc_wYjRTYtp_ZWSBA0HP9_UmK-QG-ydcOTus0icD9q3x4k1BWObzUaiUPkCQo7vEaZOvQt6ZIIkc8WVPqBABmHxxlFsS1spaSfcdwT6UKspMmxc8DJoAKuaM4n0QuznKGQeoFPQVyb9Giy2eSaJmy0yxq4OSIVfJAC8LnCNt4Xj0k776iLvmfv_sYO69fi-lWkeiOL1nI8PolPQ4OBpKE5rAZbvcv97oE12qyo1z85iZTfpqj56Opis3i7EvhVX-wJCg-40A1BF4auXe5P-upeyBwXZpDSQSP3pEXYlfTZ4BoTHjzXj-cAMic6JROFnjvvqcdJBM3rFy7Lhvepjmyw_E6ggTR_kZ3xRI2Nx2IlF7uRKvhozt2wKuotlMF02tERl2x8-gHEvnRD6f5TXdaehPJotWhnJeWIh5ZcmhGluNQbplEz3AUs9VeJKeMaFpaHCo_zDtjaHEXt3ye5Z45OuJQmGlfpVsozyJwr60tJNL7WHoAS9JH4KDD8apTdmfGRXot8un_mwfqABnAfr0CAJuA2mr6u0QviJ-WPylzRpEjlhw3QSTLPSJqrbIdmaZyb8Ls6Cn33GZCYagPeTlKexfiS55HsdFZm3j2K5AByCtneydzpzwohzzN8SyDdOGBf56X1dUEHYmoPpoKVTLhPChbaLu6YqhAHBshyimWfndrNvM1h8cVviuDgeW1kKTf31Wj

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.howtoremoveit.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jul 2021 07:16:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F24E 42 B
64 B 16ms
16ms Fetch
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssbi5qpbkdnsOWQn2-BU5xmE4D_XnnElDV3mwUZp0MokGSgLiDyvus9nRTw-aYhvZsuth2NWkIm9YOCvBJWTdKg7UvOT8bE5pP5BNQPSGAfMhtbRsY45uoRqW8Dug&sai=AMfl-YTyzZJDnTTMC6UlIdpGgim6_Z_-a2qB_BAvp274uOCRjwltpNChuueL-zcOQC9mZpkWe3yg2dUgCfsJ&sig=Cg0ArKJSzI42sea_2JerEAE&id=lidar2&mcvt=1000&p=669,195,949,1395&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210714&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=1331721975&rs=2&met=mue&la=1&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1626333366931&dlt=755&rpt=38&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jul 2021 07:16:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 19DD 42 B
64 B 16ms
16ms Fetch
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvHE0DUwM4T1Y_x_ADs6twAIwd_cSqflGdSmtG_zu7Oar8bH6pSNRU3lAi0y9H4E50c8tNV_XTkEpmJeuhTL9M5F2pK_lfqGjelHUalNq80y3te8s9znq8FkktcqQ&sai=AMfl-YR9zB0VzhVxUZzI8Zd9L0eu1fa5O3W4dKEGQlQ0sjSh4EeozSHkb8ivV49mO2dmk2G2fn7nvIyi7C6iIlpsF4HALX-XhiOJmrv6U7OQMf9Ryf6Ars_5XWXdZiGlLlar&sig=Cg0ArKJSzLGSOgolXfQ_EAE&id=lidar2&mcvt=1000&p=1123,436,1213,1164&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20210714&bin=7&avms=nio&bs=0,0&mc=0.86&if=1&app=0&itpl=22&adk=692682234&rs=2&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1626333366952&dlt=798&rpt=26&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jul 2021 07:16:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

150 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

9 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-19 19:45:34	Name: test_cookie Value: CheckForPermission
.doubleclick.net/	1970-01-20 05:07:09	Name: IDE Value: AHWqTUmI4JLlxmcYKFnnGPdPtElLVeOF4NqZ_zBdoEkIKi15TwYkOHt9gBGnu0XtNs0
.howtoremoveit.info/	1970-01-20 05:07:09	Name: __gads Value: ID=c51d1e5889e5c76c-227c86ff6bc900dc:T=1626333366:RT=1626333366:S=ALNI_MakYRNpXy-O423JeNXGJLOPItKFrQ
.howtoremoveit.info/	1970-01-19 19:45:33	Name: _gat Value: 1
.howtoremoveit.info/	1970-01-19 19:46:59	Name: _gid Value: GA1.2.735940401.1626333367
.doubleclick.net/	1970-01-19 19:45:36	Name: DSID Value: NO_DATA
.howtoremoveit.info/	1970-01-20 13:16:45	Name: _ga Value: GA1.2.1100268901.1626333367
www.howtoremoveit.info/	1970-01-19 20:28:45	Name: th Value: Fired
www.howtoremoveit.info/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: zfq34fqppsjlbyihnqupmpue

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js(Line 1) Message: OneSignal: Using fallback ES5 Stub for backwards compatibility.
console-api	warning	URL: https://ajax.googleapis.com/ajax/libs/jquery/3.4.0/jquery.min.js(Line 2) Message: jQuery.Deferred exception: Cannot read property 'top' of undefined TypeError: Cannot read property 'top' of undefined at HTMLDocument.<anonymous> (https://www.howtoremoveit.info/:1213:47) at e (https://ajax.googleapis.com/ajax/libs/jquery/3.4.0/jquery.min.js:2:29453) at t (https://ajax.googleapis.com/ajax/libs/jquery/3.4.0/jquery.min.js:2:29755) undefined
console-api	log	URL: https://www.howtoremoveit.info/bundles/LoadAllJS?v=bVl02MWpqjNt5fEtSWFJnbUnda5lKV9hV0160UnSl0o1(Line 92) Message: Service Worker Registered
console-api	log	URL: https://www.howtoremoveit.info/bundles/LoadAllJS?v=bVl02MWpqjNt5fEtSWFJnbUnda5lKV9hV0160UnSl0o1(Line 95) Message: Service Worker Ready

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
ajax.googleapis.com
cdn.mouseflow.com
cdn.onesignal.com
cdnjs.cloudflare.com
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
pagead2.googlesyndication.com
partner.googleadservices.com
stackpath.bootstrapcdn.com
stats.g.doubleclick.net
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.howtoremoveit.info
z-na.amazon-adsystem.com
13.224.101.72
142.250.74.194
2001:4de0:ac18::1:a:1a
23.111.9.38
2606:4700:3035::6815:16d1
2606:4700::6810:135e
2606:4700::6812:bcf
2606:4700::6812:e134
2a00:1450:4001:800::2002
2a00:1450:4001:801::2004
2a00:1450:4001:802::2002
2a00:1450:4001:803::200a
2a00:1450:4001:808::2002
2a00:1450:4001:809::2003
2a00:1450:4001:810::2004
2a00:1450:4001:810::200e
2a00:1450:4001:811::2008
2a00:1450:4001:812::2002
2a00:1450:4001:827::2003
2a00:1450:4001:827::200a
2a00:1450:4001:828::2001
2a00:1450:4001:828::2003
2a00:1450:4001:829::2003
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::200e
2a00:1450:4001:82f::2002
2a00:1450:400c:c06::9c
00529cc4947e8493a8da51d3d75f09726e28ba6816ec2ba724c87d1cb4a1983d
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8
0bfe7bb5f3f94d511b0a4c06af0bfdf8f3cbcb5bb7e26930ae6e3e38f71dc0c2
0c31345c4bbe218e27851d6f702a1d242cde8aea49f977b5c4ffaac36ebfe102
0d5fcf4470214156877210c27c06b8c7b6f5dbc9115c3c18ae214a911889be2c
15cd412ddcfb0dc3a38ee3a344c740ee3cc99612c5c3a345f7a5f7ac80f925cd
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1c2b28f45f088ec611ac864869ad9b9984ca74a49c238bafda418601afabcb94
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
1d5eef4fb1cc85ad55f657aced9c1f1ad2789079abdae417e02d83f067ea8b86
20b3bad1427e2212dd847357841f993f025b5061c4af1d382dcc727e102cc1e4
2302a23b054223a6273bb81e895eb9849a6c34c74cff1c519c63544dcd7d8b48
23b9b39ea61308052256b9921bf1c0de6698bcf0c04e3e4f2978adc86168ff6e
24f7e397faec79e62c37ff2f00b170f6dc1557fb46ac169f9f1897a9d641dd03
2de7002ff4737368f9dcb6cd8467ee9c2738483d88c5e3cf8af14f7a3e67eb19
2ea38822f8bbbe74502b9274bcade3eacaccef4be92b6674aa6df6299370f863
33810f0c864e6976ea984d30e291cec728715733ef03501e9df966502fc5d9db
369837cb4f3eda2b658d0eba141b05affe052314745da91ed8e50c00a71f60f3
3a5fe34971b4cbe72c700e5b903b7b4e93e36bbf951abb7cfc3a1bacd63ab255
3d52eb4784c784ef86bda77a144cfb18105d5cbd88a206611953bb7cbc49598d
3f6e3803d173e4e575336ae9d9f479a56f53fcb81c432e84f04258378e3279fe
47cc308077d1f9ad5e5f6336770c635f3879c420eb3b27d708520c35d17b89ec
495ae1f3daf7dd8dcb503fe170f14666117adb468a8ab8de88d8a38244714d7b
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
4ca739a13d804ea8806c9878d5b463d2a2c2a75b61a1b2f8a8e104e9b0daecb5
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
532881c1a967ba388f7bb2f8c2a259e57694b6146f9a4167575b2808698265b4
5358815b4581d676a6727445317f28ad470121100384003dbf6d43f05ec46f2e
56d80532e1283478e0ca27d16ede80bed7687bee01742ab59aac81bae5a83805
5950d97f521bf0718d31ba1bc5b48728cd3272787a563d8a2dfd844dc706995f
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
5b1e63e30afdec4dad3ad5f14dde873c582b5fb4259b1a7c10f4fd955779257c
5da979027e919fdc08bc56e72fe84540f9af47be519c869dbce5e0defa3404ee
5e8640bb201940a4d28fe9c4c02cb70957f302f53df2f69184d3ee5a4b4b470c
6059f945bb0940302119ba1878cd7d1f0cbd2bf60cdf8ec10deabea2ecc9944e
64d8001df3401f972aa146ac27f20fb0c3be8bc5fd4c072b372ea7ccd3b75313
67eba3529a67e088bd83ae179b0fcab337a0e5804ca07132d47a5013dff6e43d
69e8c8b8b157abec05ceb0d8df7f59abc91d6d03f0a4fa8734fea1f628fee5c3
6de2dfcea74c621e3b6f86ed54ee53f7d79c5c1a8bbe94d0670950f39a67f3dd
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
7a89ed061d4f08b38f6fb2208eb01ef977d76506665ccacf6543b1452ae36eb8
7d4aa663b9db452336ce2c8fd517ceeb9897db094e5f57d223995ddd6abcfa4c
7d7731cd19278dd8d68435b1df5709fd2e12e8f13e43d86409ccc26f3354ea52
7e5e8d7a52cffab98c6c3957e1c30af475c697d4d50ba91aeab0b11eea32a166
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8554fcdb838bc7bb17830f1be629b21a517f965747a30eb85077e3e24e69e6d1
86222f2978279f3de4c54d5b2375528bac3bdadad1df82d8a63c2dd6c3ec11b8
885dd3ba5ec2b5ff297ac0b4812cd6ea2cd57d4d221729b5518a0b814d4f89b2
8ad3573efbb722f24cebf078ef75b9de59a8ed463480cd3268fe38dc654db08f
8d60979751668c634c300bdff7af7565f67064815f9e200140c78fbf215ce0f4
914c9b1cd12a30ef04543e0cdcc2e24514a38c5675f25f18cf9e946575315f42
9208a1abfe29525febf3ee4deb8c8dc73de02141a4e642975802a1d72d69cbf8
93037a46b7069133315f774b6fdd329c54299c36d29c8d8233ee7704f28c5ad2
9639cbd6bd254bbfd7b931bb0008fb542393652b3372d1b4864f70e727c5fb7b
9b2c84c8ffa6181855c6d4bb618df4710becc75f612913359b48e4cd3387682b
9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a6f4e21e8920d976b1e9d7bdfa33e2d314c9aee23d65bb7a33c8fe481f6604ac
a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199
ae62dd075f4359b389158ec0ce732971da832938b5d630a24eb2e89111b00e1b
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b573339ddfd293b054d763091f0f2f9024de4c6eabafb4bc9961ef124365b47a
b9558f7016a4385a8b72db292eec2a6c2b0c259c713122b105202fe661e21fc3
ba0c59deb5450f5cb41b3f93609ee2d0d995415877ddfa223e8a8a7533474f07
bbd41610f23dac8f183bc8af83d2b6348e5bc13d43d80b973697b3029e52a599
bc58805330fbc8d179dae79257bd71e3ccad7e42af1ca9dac81bce49b8a19936
bc90e085ea5f538e02d672930d3bde710e982465d1978d5075cf9d7355c49970
bcfbdb36bd6283ffb2c4db85ecdba67421a292ed485334fe5e17561c33aa66a9
c1cb8cbacd74c74a4acf5aa0bef40b7d92b487046a8d6bf68dbe83df198d52bf
c56b74107d4b4dd635d525c968c3f48f44e6ecc2028ca32f413eccb0b3c2e30d
c7ba43f00109270a7653d06745a827eb57f5f0cb6c0264d9c762b4c51a35729a
c98f05b88f26752a2570ceef44928e9e10efb94ed95a3cb5240593838852516b
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
d557ac01f6bfe50ee326ee5f2d49f424ec776af5da5abb4231083ab4a772feb9
d9b635248efd4b596cad402579c29a619b4379cfb553a32589350b04c07f2bfa
de816a8f60f41bc7c3a17f9bcec549beb46fdb9c086dc21c347de992d5fd5c82
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea13739a6ab669cc2f16a95685c1ed8c0fa771606e3a217cc2093b91103012df
eb70f6e954d178c4200bf8907568d7b86398b52c3a693fef5875a998a4ce7916
ed045b94f4874ac13890f9c4370e2b14b30c2a12a79d22e52d20872440b60ede
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef3fc1c8d0c9f30a0b87b7a394f76e85815f802cb3cc550cbbd63d5e69c43914
efb3cdc5e4582fd67dffab6fc6e5062074ce3f8c51747346af944e97749dc309
f22da31728b179d3a21d80a13f54b75c2e5362c0b35386d5e57690c1abf08121
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
f2f0648e4bdb13171776559355551d34ea5e6e19ebebdda40c0233c09dfcefd3
f98624809e936abad66ee499e8233b11724c69775403d975ff4464165fbb7199
fbce2676a40a9619bbcf6cfae9d5da8abb71320d4aa82f0c504d9de7e411f172
fd368bf4cbbdb094b795520500791b8fc40c50ea697888038188d3f0ebbadf21
fe1b6062a0fe0ff86aba96a766cd1d828017240985f046abcf0fbedd355aa4a1

www.howtoremoveit.info Open in urlscan Pro 2606:4700:3035::6815:16d1 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

133 Requests

100 %HTTPS

89 %IPv6

17 Domains

23 Subdomains

28 IPs

4 Countries

2758 kBTransfer

4476 kBSize

9 Cookies

6 Outgoing links

Redirected requests

133 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.howtoremoveit.info Open in urlscan Pro
2606:4700:3035::6815:16d1 Public Scan

Screenshot
Live screenshot

Full Image

133
Requests

100 %
HTTPS

89 %
IPv6

17
Domains

23
Subdomains

28
IPs

4
Countries

2758 kB
Transfer

4476 kB
Size

9
Cookies

133 HTTP transactions
4 data transactions